DET-02 Cyber security event detection
2 actions under this Detect principle in ASD Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
The two actions
- IT.DET-02.1Normalise, Time-Synchronise and Enrich Event Logs for Cross-System Correlation
Puts logs in one format and on one trusted clock, adding details like account type, so events can be matched across systems.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.DET-02.2Deploy Detection Rules for Unauthorised Changes, Anomalous Authentication and Suspicious Software Execution
Sets rules to alert on unapproved changes, odd sign-ins and suspicious programs, and keeps them tested and tuned.
Domains:Visibility and response
Back to the full Essentials for enterprise IT action list, or browse the complete control library.