Essential Eight RA-ML3.9 Timely analysis of workstation event logs for security events
What it says
Event logs from workstations are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check logs on office computers to find security issues early.
Checking the event logs on your office computers regularly helps catch security problems early, like someone trying to hack in or mess with your systems. If you don't keep an eye on these logs, a cybercriminal could sneak in, and you might not know until they've stolen sensitive information or disrupted operations.
Free. Save your status, tasks and notes.
Why it matters
Neglecting timely log analysis allows attackers to escalate privileges undetected, leading to potential data breaches or operational disruption.
How to implement
The IT team should set up a routine schedule to review workstation event logs, ensuring they are checked at least once a week.
They could use specific software that collects these logs automatically and highlights any unusual activity.
System administrators should train employees about the importance of logging suspicious activity, teaching them to report anything unusual on their workstations immediately.
This can be done through annual security awareness training sessions.
Security officers should develop a baseline of what normal event log activity looks like for the organisation.
This can be achieved by analysing logs over time to identify typical patterns and flagging deviations for investigation.
IT managers should ensure that all office computers are configured to retain event logs for a minimum period, such as six months, to allow adequate time for analysis.
This may require adjusting system settings or using log management tools.
Keep it running
Review workstation event logs daily and triage alerts to spot suspicious sign-ins, privilege changes and malware activity early.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
How frequently are workstation event logs reviewed?
Look at
Check the documented schedule or records of log reviews.
Good evidence
Workstation logs are reviewed weekly with results documented.
- Check 2 of 4What an auditor asks for
Ask for
What tools or methods are used to analyse workstation event logs?
Look at
Look for software documentation and process guidelines.
Good evidence
The organisation uses specific log management software that automatically collects and highlights potential security events.
- Check 3 of 4What an auditor asks for
Ask for
How do employees report unusual system activity?
Look at
Review training materials and reporting processes.
Good evidence
Employees receive annual training and have a simple, documented process to report suspicious activity.
- Check 4 of 4What an auditor asks for
Ask for
How long are workstation event logs retained?
Look at
Examine system configuration policies.
Good evidence
Event logs are retained for at least six months, as confirmed by system settings or policy documents.
Mappings
Closest match in ASD Information Security Manual: ISM-0109, Timely analysis of workstation event logs, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.16.
Annex A 8.16 requires organisations to monitor networks, systems and applications for anomalous behaviour and take action to evaluate potential incidents. E8-RA-ML3.9 relates by mandating timely analysis of workstation event logs to detect security events, which is one concrete monitoring activity that can reveal anomalies. Annex A 8.16 is broader because it is not limited to workstations or to log analysis, and also expects appropriate follow-up actions beyond detection.
This control partially overlaps A.5.28.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. Annex A 5.28 requires procedures to identify, collect and preserve evidence related to information security events, which often relies on workstation logs as an evidence source. They overlap because timely log analysis under E8-RA-ML3.9 can trigger evidence collection, but Annex A 5.28 is broader and focused on evidentiary handling and preservation rather than detection monitoring.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-0109.
ISM-0109 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. E8-RA-ML3.9 contains the same requirement word for word as part of Essential Eight Maturity Level Three. Implementing one satisfies the other, although E8-RA-ML3.9 sits within the restrict administrative privileges strategy, so the analysis would be expected to cover privileged activity.
This control is broader than ISM-1228.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1228 is broader because it requires timely analysis of cyber security events generally (regardless of source) to identify incidents, which could include workstation-derived events plus other detection inputs. E8-RA-ML3.9 is a specific log-source-focused implementation that contributes to meeting ISM-1228 but does not cover all event sources or the full incident identification activity.
This control partially meets ISM-1987.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. E8-RA-ML3.9 applies the same requirement specifically to workstation event logs. E8-RA-ML3.9 therefore covers only one log source category, while ISM-1987 expects timely analysis across relevant security-product logs more generally.
This control partially overlaps ISM-1907.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1907 requires timely analysis of logs from non-internet-facing servers for the same detection purpose. The overlap is the log-analysis process and objective, while the key difference is the technology scope (workstations versus non-internet-facing servers).
This control partially overlaps ISM-1960.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1960 requires timely analysis of event logs from internet-facing network devices for the same purpose. They overlap on the operational monitoring requirement, but differ materially in log source and threat exposure context (end-user workstations vs internet-facing devices).
This control partially overlaps ISM-1961.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1961 sets the same expectation for analysing event logs, but for non-internet-facing network devices. They share the monitoring-and-detection practice, but apply it to different classes of assets, so the controls only partially align.
This control partially overlaps ISM-1986.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1986 applies the same core requirement (timely log analysis for event detection) but for critical servers rather than workstations. They overlap on the detection activity and timeliness expectation, but differ in asset scope (workstations vs critical servers) and therefore do not fully satisfy each other.
This control depends on ISM-2051.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-2051 requires software to generate sufficient event logs to support detection, which is a prerequisite for meaningful workstation log analysis. Without ISM-2051-level logging coverage and quality, implementing E8-RA-ML3.9 would be incomplete or ineffective because there may be insufficient events to analyse.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; E8-RA-ML3.9 requires event logs from workstations to be analysed in a timely manner to detect cyber security events, one place where that logic can be applied.
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML3.9 requires timely analysis of workstation event logs to detect cyber security events, detection that comes ahead of triage.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.