DET-01 · Detect

Centralised event logging

Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation.

Enterprise IT actions

• IT.DET-01.1

  Protect event logs from unauthorised access, modification or deletion, including by encrypting them during transit and at rest and securing the systems and accounts used to store, manage and analyse them.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Logs generated by applicable assets are not protected from modification or deletion.
  • Log access is not restricted to authorised roles with a business need.
  • Logs are neither encrypted during transit nor at rest.

  Partially effective

  • Logs are forwarded but integrity protections are not in place at the source.
  • Log access is restricted but some roles retain the ability to modify or delete logs.
  • Logs are encrypted during transit but are not protected with encryption at rest (or vice versa).

  Fully effective

  • Logs are protected against modification or deletion.
  • Logs are encrypted in transit and at rest.
  • Access to logs is restricted to authorised roles with a business need.
  Related frameworks

  ISM

  ISM-1984, ISM-1985

  NIST CSF 2.0

  PR.DS-01, PR.DS-02

  NIST SP 800-171r3

  03.03.08, 03.13.08

  AESCSF v2

  ARCHITECTURE-5b, ACCESS-2d

  Essential Eight

  Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

  MITRE ATT&CK

  T1070 Indicator Removal, T1685 Disable or Modify Tools

  Rate this action in the Navigator →
• IT.DET-01.2

  Forward high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to a central log storage capability.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Security-relevant logs from assets are not forwarded to a central logging capability.
  • High-value, security-relevant event logs or configuration changes from infrastructure, operating systems or applications are not forwarded.

  Partially effective

  • High-value, security-relevant event logs are forwarded, but coverage gaps are identified or completeness has not been validated.
  • Configuration change logs are forwarded inconsistently.
  • The utility of security log sources is reviewed, but on an ad hoc basis rather than according to a defined schedule.
  • Log forwarding is in place but latency is excessive for effective detection.

  Fully effective

  • High-value security-relevant event logs and configuration changes from all relevant infrastructure, operating systems and application sources are forwarded to the central logging capability.
  • Security log sources are reviewed at regular intervals to ensure their continued utility in detecting and responding to changing adversary techniques.
  • Log completeness has been validated against the expected log sources.
  • Logs are forwarded at a frequency that enables timely detection.
  Related frameworks

  ISM

  ISM-0585, ISM-1405, ISM-1983

  NIST CSF 2.0

  PR.PS-04, DE.CM-03, DE.AE-03, DE.CM-09

  NIST SP 800-171r3

  03.03.01, 03.03.03, 03.03.05, 03.01.07

  AESCSF v2

  SITUATION-1a, SITUATION-1c, SITUATION-1e

  Essential Eight

  Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

  MITRE ATT&CK

  T1070 Indicator Removal, T1685 Disable or Modify Tools

  Rate this action in the Navigator →
• IT.DET-01.3

  Establish a centralised event log storage capability that protects logs from unauthorised access or modification.

  • Every phaseVisibility and response
  ASD’s indicators

  Not effective

  • No centralised capability exists for storing event logs collected from systems across the environment.
  • Stored logs have no protection against modification or deletion by administrators of the systems generating them.
  • Access to the centralised capability is not restricted, or access is granted to roles without a documented need.
  • Log retention requirements are not defined.

  Partially effective

  • A centralised capability exists but does not receive logs from in-scope systems, or coverage is inconsistent.
  • Stored logs are protected from modification, but the controls do not consistently prevent deletion, or controls are not applied to all log types.
  • Access is restricted to a defined set of roles but access is not logged or monitored.
  • A retention period is defined but is inconsistently applied, or some log types are retained for shorter periods than required.

  Fully effective

  • A centralised event log storage capability is in place for logs collected from in-scope systems.
  • Stored logs are protected against unauthorised access, modification and deletion through technical controls including access restrictions, encryption at rest and integrity protection.
  • Access to the centralised capability is restricted to security operations personnel and other roles with a documented need, with access logged and monitored.
  • Log retention requirements are defined and aligned to investigative, regulatory and contractual obligations, with retention applied consistently across log types.
  Related frameworks

  ISM

  ISM-1405, ISM-1985, ISM-1988

  NIST CSF 2.0

  PR.PS-04, PR.DS-01, PR.AA-05

  NIST SP 800-171r3

  03.03.06, 03.03.08, 03.03.03

  AESCSF v2

  SITUATION-1e, SITUATION-1a, ACCESS-2d

  Essential Eight

  Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

  MITRE ATT&CK

  T1070 Indicator Removal, T1685 Disable or Modify Tools

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Perform host-based logging on operator, engineering and server systems within the OT environment, and maintain log collection, query and investigation capability that remains available when systems outside the OT environment are unavailable.

  • Phase 1Boundary services, Critical processes and services
  • Phase 2Privileged environments, Identity services
  • Phase 3Business systems
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Establish a centralised event log storage capability that protects logs from unauthorised access, modification or deletion

  • Every phaseVisibility and response
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 2

  Enable provider audit logging at sufficient tiers and retention, and forward security-relevant logs and configuration changes to a central capability.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →

Open the Navigator →

More Detect principles

• DET-02Cyber security event detection
• DET-03Cyber security incident identification
• DET-04Baseline high-risk access activities
• DET-05Detection capability efficacy

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.