DET-02 Cyber security event detection

three actionsAlso in ASD Essentials for enterprise IT

Set detection rules that catch unauthorised changes, unusual sign-ins and unusual service management activity, such as raised privileges. Learn what normal resource use looks like so you can spot unusual activity. Keep logs in a common format, with synchronised timestamps and added context, so events can be linked.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events.

ASD, Information Security Manual (ISM), Principle DET-02

The three actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

C: Customer
S: Supplied
P: Provider-inherited

Action 1 of 3
Ensure detection logic identifies unauthorised changes, anomalous authentication activity and anomalous control-plane activity, including consent grants, federation changes and privilege elevations.
In plain English: Ensure detection rules catch unauthorised changes, unusual sign-ins and unusual service management activity. This includes consent grants (permissions users or admins give apps), federation changes and raised privileges.
Domains
Visibility and response
Who does it
PaaSSupplied
SaaSProvider-inherited
Action 2 of 3
Baseline resource utilisation to monitor for and detect anomalous activity.
In plain English: Work out what normal resource use looks like so you can monitor for and spot unusual activity.
Domains
Visibility and response
Who does it
PaaSSupplied
SaaSProvider-inherited
Action 3 of 3
Ensure event logs are normalised, time-synchronised and enriched to support correlation across cloud services and environments.
In plain English: Make sure event logs have a common format, synchronised timestamps and added context. This lets you link events across cloud services and environments.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSSupplied
SaaSProvider-inherited