Essential Eight RA-ML3.8 Timely analysis of event logs from non-internet-facing servers
What it says
Event logs from non-internet-facing servers are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReview logs of internal servers promptly to spot security threats.
This control is about quickly checking the activity logs of your internal servers that don't connect to the internet. It's important because it helps you catch any unusual or harmful behaviour, which could indicate a security problem, before it becomes a bigger issue.
Free. Save your status, tasks and notes.
Why it matters
Unchecked internal server logs can conceal attacker footprints, enabling undetected lateral movement and privilege abuse, which jeopardises sensitive data.
How to implement
IT team should regularly review server logs to spot any strange activity by setting up a schedule to look at these logs daily or weekly.
System administrator should use automated tools to alert them of suspicious patterns in logs by configuring alerts for anomalies or known threat indicators.
Security officer should ensure logs are stored securely and remain unchanged by implementing access controls and secure storage solutions.
IT team should conduct training for key staff on how to review logs effectively and identify potential threats during regular team meetings or training sessions.
Keep it running
Review non-internet-facing server logs daily via SIEM/alerts, triaging auth failures, new admin accounts, service changes and lateral movement indicators.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How often are the logs of non-internet-facing servers reviewed?
Look at
Check schedules or policies for log review frequencies.
Good evidence
Logs are reviewed daily or weekly as per the policy.
- Check 2 of 3What an auditor asks for
Ask for
What steps are taken to secure the logs?
Look at
Examine access control settings on log files.
Good evidence
Logs are accessible only to authorised personnel and stored securely.
- Check 3 of 3What an auditor asks for
Ask for
Are there alerts set up for suspicious log activities?
Look at
Review the configuration of log monitoring tools or software.
Good evidence
Alerts are configured to notify the IT team of anomalies immediately.
Mappings
Closest match in ASD Information Security Manual: ISM-1907, Timely analysis of non-internet-server logs, which asks for the same thing.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1907.
E8-RA-ML3.8 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement for the same asset class (non-internet-facing servers) and the same outcome (detection of cyber security events via timely log analysis). The scope and intent align closely, making this a direct one-to-one mapping.
This control partially meets ISM-1987.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. E8-RA-ML3.8 requires the same timely analysis outcome but restricts the log source to non-internet-facing servers. This makes E8-RA-ML3.8 a subset implementation within the wider log-analysis expectation of ISM-1987.
This control partially meets ISM-2116.
ISM-2116 requires cyber threat intelligence services to be used to support detection of cyber security events and identification of incidents. E8-RA-ML3.8 focuses on timely analysis of event logs from non-internet-facing servers to detect events, which is one specific detection activity that threat intelligence can enhance via IOCs, TTPs and correlation rules. The candidate is limited to a particular log source and activity, whereas ISM-2116 is broader in requiring CTI use across event detection and incident identification.
This control partially overlaps ISM-1906.
E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1906 is similar in method (timely log analysis for detection) but applies to internet-facing servers rather than internal servers. They overlap on the monitoring practice but differ materially in the system exposure context and therefore the specific logging scope.
This control partially overlaps ISM-1961.
E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1961 applies the same requirement to non-internet-facing network devices, which often interact with and generate complementary evidence for server-side investigations. They overlap on timely log analysis for event detection but cover different technology classes (servers vs network devices).
This control partially overlaps ISM-1986.
E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include both internet-facing and non-internet-facing systems depending on the environment. The overlap is the same activity (timely server log analysis), but ISM-1986 is scoped by criticality rather than network exposure.
This control depends on ISM-0120.
ISM-0120 requires cyber security personnel to have access to sufficient data sources and tools to monitor systems for key indicators of compromise. E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events, which depends on centralised logging access and analysis tools being available to the team. E8-RA-ML3.8 is limited to a specific log source and activity, while ISM-0120 is broader capability enablement across systems and data sources.
This control depends on ISM-1979.
ISM-1979 requires centrally logging security-relevant events for server applications on non-internet-facing servers. E8-RA-ML3.8 relates by requiring timely analysis of non-internet-facing server event logs to detect cyber security events, which depends on having accessible and aggregated logs from those servers. ISM-1979 does not require analysis timeliness, while E8-RA-ML3.8 does.
ASD Essentials for enterprise IT: 2 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML3.8 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events, so those events can then be triaged.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-RA-ML3.8 (restrict administrative privileges) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.