DET-01 Centralised event logging
3 actions under this Detect principle in ASD Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation.
Quoted as published. Everything else on this page is written by Control Stack.
The three actions
- IT.DET-01.1Encrypt Event Logs and Restrict Access to Prevent Tampering and Deletion
Keeps event logs safe from being read, changed or deleted without approval, with encryption and locked-down logging systems and accounts.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.DET-01.2Forward High-Value Security Logs and Configuration Changes to Central Log Storage
Sends key security logs and setting changes from network gear, servers, computers and apps to one central store.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.DET-01.3Establish Centralised Event Log Storage Protected from Unauthorised Access and Tampering
Keeps event logs in one central store only approved staff can open and no one can tamper with.
Domains:Visibility and response
Back to the full Essentials for enterprise IT action list, or browse the complete control library.