Essentials for cloud
DET-01 Centralised event logging
Collect security logs in a central store that protects them from unauthorised access, changes or deletion. Turn on each provider's audit logging at a sufficient level and keep logs long enough. Send security-relevant logs and configuration changes to that store.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation.
The two actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 2
Establish a centralised event log storage capability that protects logs from unauthorised access, modification or deletion.
In plain English: Set up a central store for event logs that protects them from unauthorised access, change or deletion.
- Domains
- Visibility and response
- Who does it
- PaaSSupplied
- SaaSSupplied
Action 2 of 2
Enable provider audit logging at sufficient tiers and retention, and forward security-relevant logs and configuration changes to a central capability.
In plain English: Turn on provider audit logging at a sufficient tier and retention period. Send security-relevant logs and configuration changes to a central store.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Disable or Modify Tools
- Account Manipulation
- Create Account
- Modify Cloud Resource Hierarchy
- Modify Authentication Process
- Modify Cloud Compute Infrastructure
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.