ASD ISM 2116 Use cyber threat intelligence for event detection
What it says
Cyber threat intelligence services are used to support the detection of cyber security events and the identification of cyber security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCyber threat intelligence is fed into log monitoring and detection tooling so that matches against known indicators help detect cyber security events and identify cyber security incidents.
Cyber threat intelligence (CTI) is information about known attacker indicators, such as malicious IP addresses, domains, file hashes, and attacker techniques. This control is about loading that intelligence into your log monitoring and detection tools so that when your logs show activity matching a known indicator, an alert is raised. It is a detection control, not a prevention one: its job is to help you spot and confirm that a cyber security event or incident is occurring, not to block it.
Free. Save your status, tasks and notes.
Why it matters
If cyber threat intelligence is not ingested into log monitoring and detection tooling, indicators of compromise (IOCs) and attacker techniques that appear in collected logs pass unmatched, so connections to known malicious infrastructure, known-bad file hashes, and recognised attacker tradecraft go unflagged. Cyber security events tied to known threats are missed in the noise of normal log volume, and genuine incidents are identified late or only after damage is done, extending attacker dwell time.
How to implement
Subscribe to or connect at least one cyber threat intelligence source (commercial feed, ACSC/government advisories, or an open feed such as MISP via STIX/TAXII) and configure it to deliver IOCs and attacker TTPs into your SIEM or detection platform.
Configure automated, scheduled ingestion of indicators (malicious IP addresses, domains, URLs, file hashes) into the SIEM so the indicator set refreshes without manual effort and stale indicators are aged out.
Build correlation or detection rules that compare collected log data (firewall, proxy, DNS, endpoint, authentication, and email logs) against ingested indicators and raise an alert on any match.
Map your ingested indicator types to the log sources you actually collect, and add any missing telemetry (for example enable DNS or proxy logging) so domain and URL indicators have data to match against.
Wire CTI-match alerts into your event triage and incident-identification workflow so a confirmed indicator match is escalated and recorded as a candidate cyber security incident.
Tune CTI-driven rules to suppress known false positives and de-prioritise low-confidence or expired indicators, and review match volumes so analysts focus on high-confidence detections.
Keep it running
Treat CTI ingestion as a continuously maintained detection capability, not a one-off setup: indicator feeds change constantly, so keep automated feed updates running and confirm new indicators reach the SIEM and detection rules. Tune CTI-driven alert rules to suppress known false positives and stale indicators so analysts are not buried, and age out or retire indicators on a defined schedule. Periodically validate that an IOC match in collected logs actually fires an alert and is triaged into the event-to-incident workflow, and align ingested intelligence (IP, domain, hash, URL, TTP feeds) with the log sources you actually collect so there is something to match against.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for a demonstration of the cyber threat intelligence feed integration with the SIEM or detection tooling, including the connector or integration configuration.
Look at
Look at whether at least one cyber threat intelligence feed is actually ingested, and check the timestamp of the last successful indicator update.
Good evidence
At least one feed is configured and active, and the last successful indicator update is recent and within the organisation's expected refresh cycle.
- Check 2 of 5What an auditor asks for
Ask for
Ask for a sample of CTI detection or correlation rules from the SIEM or detection tooling.
Look at
Look at whether the rules match collected log fields (source or destination IP, domain, URL, file hash, or TTP) against current indicators, and whether they are set to raise an alert when matched.
Good evidence
The sampled rules compare live log fields against current indicators and generate an alert on a match rather than logging silently.
- Check 3 of 5What an auditor asks for
Ask for
Ask for a demonstration tracing one CTI indicator match end to end, starting from a logged match against a known-bad indicator.
Look at
Look at whether the match generated an alert and whether that alert entered the event triage and incident-identification workflow.
Good evidence
The indicator match produced an alert that was triaged, and the record shows how the event was assessed for whether it was a cyber security incident.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the list of ingested indicator types and the inventory of log sources collected by the detection tooling.
Look at
Look at whether the indicator types align with the log sources collected, for example that domain and URL indicators have proxy or DNS logs to match against.
Good evidence
Each ingested indicator type has a corresponding log source available, so matching is actually possible rather than indicators sitting unused.
- Check 5 of 5What an auditor asks for
Ask for
Ask for a sample of incident records where cyber threat intelligence contributed to identifying the incident.
Look at
Look at whether the matching indicator is recorded in the incident record and whether it is traceable back to the source log.
Good evidence
Incident records name the specific indicator that contributed to identification and link it to the source log entry, showing CTI supported the identification of the incident.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.8, Timely analysis of event logs from non-internet-facing servers, which this control covers in full and more.
ISO/IEC 27001: 4 mappings
This control partially overlaps A.5.7.
ISM-2116 requires organisations to use cyber threat intelligence services to support detection of cyber security events and identification of incidents. ISO/IEC 27001 Annex A 5.7 requires collecting and analysing threat-related information to produce threat intelligence, which is a direct input to (or can be met via) the intelligence "services" ISM-2116 expects to be consumed. The overlap is the intelligence lifecycle element (collection/analysis vs consumption), while ISM-2116 is explicitly about operationalising intelligence in detection and incident identification rather than producing it.
This control supports A.5.25.
ISM-2116 requires organisations to use cyber threat intelligence services to support detecting events and identifying incidents. ISO/IEC 27001 Annex A 5.25 requires assessment of information security events and a decision on whether they are incidents, and ISM-2116 supports that decision by providing threat-informed criteria (e.g. whether observed indicators align to known threat actor behaviour, active exploitation in the sector, or confirmed malicious infrastructure). Annex A 5.25 is the governance decision point, whereas ISM-2116 focuses on intelligence enrichment that improves the accuracy and speed of categorisation.
This control supports A.8.15.
ISM-2116 requires using cyber threat intelligence services to support detection of cyber security events and identification of incidents. Annex A 8.15 requires producing, protecting and analysing logs, which provides the telemetry that CTI can be applied to for detection and triage. ISM-2116 focuses on the intelligence-driven aspect of detection, while Annex A 8.15 focuses on the logging capability needed to make that use of CTI effective.
This control supports A.8.16.
ISM-2116 requires use of cyber threat intelligence services to improve the detection of cyber security events and identification of incidents. ISO/IEC 27001 Annex A 8.16 requires monitoring for anomalous behaviour and taking action to evaluate potential incidents, and ISM-2116 strengthens this by supplying concrete adversary context (e.g. current campaigns, TTPs, malicious infrastructure) to convert "anomalies" into higher-confidence detections and faster evaluations. Annex A 8.16 sets the monitoring/evaluation obligation, while ISM-2116 provides the intelligence-driven content and prioritisation that makes that monitoring materially more effective.
ASD Essential Eight: 3 mappings
This control is broader than E8-RA-ML3.8.
ISM-2116 requires cyber threat intelligence services to be used to support detection of cyber security events and identification of incidents. E8-RA-ML3.8 focuses on timely analysis of event logs from non-internet-facing servers to detect events, which is one specific detection activity that threat intelligence can enhance via IOCs, TTPs and correlation rules. The candidate is limited to a particular log source and activity, whereas ISM-2116 is broader in requiring CTI use across event detection and incident identification.
This control supports E8-AC-ML2.8.
ISM-2116 requires use of cyber threat intelligence services to support the detection of cyber security events and identification of incidents. ASD Essential Eight E8-AC-ML2.8 requires timely analysis of cyber security events to identify incidents, and ISM-2116 supports this by providing incident correlation inputs (e.g. validated IOCs, actor TTPs, campaign timelines, and confidence ratings) that help analysts rapidly confirm maliciousness and scope during triage. E8-AC-ML2.8 is about the analysis activity and timeliness, while ISM-2116 is about ensuring the analysis is intelligence-driven rather than purely telemetry-driven.
This control supports E8-RA-ML2.10.
ISM-2116 requires cyber threat intelligence services to be used to support event detection and incident identification. ASD Essential Eight E8-RA-ML2.10 requires timely analysis of cyber security events to identify incidents, and ISM-2116 supports it by enabling threat-based incident hypotheses (e.g. "possible credential theft", "known ransomware staging behaviour") that guide which event sequences to correlate and which alerts to prioritise. E8-RA-ML2.10 measures the timeliness/discipline of event-to-incident analysis, while ISM-2116 improves the quality of that analysis by injecting external/internal adversary knowledge.
ASD Essentials for enterprise IT: 4 mappings
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; ISM-2116 requires cyber threat intelligence services to be used to support the detection of cyber security events, which can help inform that logic.
- IT.DET-03.2Correlate signals across identities, applications, data and infrastructure to identify incidentsPartially overlaps
This control partially overlaps IT.DET-03.2.
IT.DET-03.2 requires incidents to be identified from indicators across identities, applications, data and infrastructure, not isolated signals; ISM-2116 serves the same goal by requiring cyber threat intelligence services to support event detection and incident identification.
- IT.IDE-04.1Feed continuously reviewed threat intelligence and weaknesses into risk assessmentsPartially overlaps
This control partially overlaps IT.IDE-04.1.
IT.IDE-04.1 requires risk assessments to draw on relevant weaknesses, malicious actor techniques and threat behaviours; ISM-2116 puts cyber threat intelligence services to a different use, supporting detection of cyber security events and identification of incidents.
- IT.PRO-16.2Monitor vendor advisories and threat intelligence to act on supply chain exposurePartially overlaps
This control partially overlaps IT.PRO-16.2.
IT.PRO-16.2 requires using vendor advisories and threat intelligence to track supplier, product and component exposure to compromise and act in risk-proportionate timeframes; ISM-2116 also uses cyber threat intelligence services, but to detect cyber security events and identify incidents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.