DET-02 Detect

Cyber security event detection

Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events.

Enterprise IT actions

IT.DET-02.1

Ensure event logs are normalised, time-synchronised and enriched to support correlation across systems and environments.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
ASD’s indicators

Not effective
- Logs are not time-synchronised to an authoritative source.
- Logs are ingested in raw format and are neither normalised nor enriched.
Partially effective
- Logs are time-synchronised but are not normalised to a common schema.
- Some enrichment is applied but critical contextual data such as asset classification or account type is missing.
Fully effective
- Logs are time-synchronised to the authoritative time source.
- Logs are normalised into the common log schema and enriched with contextual metadata.
- Enriched logs support correlation across relevant systems, environments and data sources in the central logging platform.
Related frameworks

ISM
ISM-0585, ISM-0988, ISM-1405, ISM-1959
NIST CSF 2.0
DE.AE-03, DE.AE-06, DE.CM-03, PR.PS-04
NIST SP 800-171r3
03.03.02, 03.03.07, 03.03.05, 03.03.06
AESCSF v2
SITUATION-1e, SITUATION-3f, RESPONSE-1d

Rate this action in the Navigator
IT.DET-02.2

Ensure detection logic identifies unauthorised changes, anomalous authentication activity and suspicious software execution.
- Every phaseVisibility and response
ASD’s indicators

Not effective
- No detection logic is deployed to identify unauthorised changes, anomalous authentication activity or suspicious software execution events originating from assets.
- Detection relies entirely on manual log review with no automated rules or alerting.
Partially effective
- Detection logic exists but does not cover all three categories (unauthorised changes, anomalous authentication, suspicious execution).
- Rules are deployed but are not tested or tuned on a regular cycle defined by the organisation.
Fully effective
- Detection logic is deployed, and unauthorised configuration changes, anomalous authentication patterns and suspicious process execution events are captured and produce alerts.
- Detection logic is tested and tuned on a regular cycle defined by the organisation to maintain effectiveness.
- Detection coverage is reviewed following cyber security incidents or significant environmental changes.
Related frameworks

ISM
ISM-1986, ISM-2116
NIST CSF 2.0
DE.CM-01, DE.CM-03, DE.CM-09, DE.AE-02, DE.AE-07
NIST SP 800-171r3
03.14.06, 03.03.05, 03.01.07
AESCSF v2
SITUATION-2d, ACCESS-2i, SITUATION-2e
Essential Eight
Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

Rate this action in the Navigator

Operational technology actions

Action 1

Capture and monitor network traffic continuously on both sides of all OT-connected demilitarised zone boundaries.
- Phase 1Boundary services
Rate this action in the Navigator
Action 2

Capture and monitor traffic at interfaces between segments within OT, using detection methods with a high signal-to-noise ratio, and alert on control protocols crossing segment boundaries where they are not expected.
- Phase 1Boundary services
Rate this action in the Navigator

Cloud actions

Action 1

Ensure detection logic identifies unauthorised changes, anomalous authentication activity and anomalous control-plane activity, including consent grants, federation changes and privilege elevations
- Every phaseVisibility and response
- ResponsibilityPaaS: Supplied, SaaS: Provider
Rate this action in the Navigator
Action 2

Baseline resource utilisation to monitor for and detect anomalous activity
- Every phaseVisibility and response
- ResponsibilityPaaS: Supplied, SaaS: Provider
Rate this action in the Navigator
Action 3

Ensure event logs are normalised, time-synchronised and enriched to support correlation across cloud services and environments.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
- ResponsibilityPaaS: Supplied, SaaS: Provider
Rate this action in the Navigator

Open the Navigator

More Detect principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.