DET-03 Detect

Cyber security incident identification

Cyber security events are analysed in a timely manner to identify cyber security incidents.

Enterprise IT actions

IT.DET-03.1

Triage alerts and events in a timely manner to determine whether cyber security incident thresholds have been met.
- Every phaseVisibility and response
ASD’s indicators

Not effective
- No documented triage process exists.
- Alerts are routinely ignored or left unreviewed.
- No incident severity thresholds are defined.
Partially effective
- A triage process exists but response times are not defined or consistently met.
- Severity thresholds are defined but escalation procedures are informal.
Fully effective
- A documented triage process with defined severity thresholds and response timeframes is in place.
- Alerts are triaged within the timeframes defined by the organisation and escalated where cyber security incident thresholds are met.
- Triage performance is tracked and reported.
Related frameworks

ISM
ISM-0120, ISM-0125
NIST CSF 2.0
DE.AE-02, DE.AE-04, DE.AE-08, RS.MA-01
NIST SP 800-171r3
03.06.01, 03.06.02, 03.14.06
AESCSF v2
RESPONSE-1b, RESPONSE-2a, RESPONSE-2d
Essential Eight
Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

Rate this action in the Navigator
IT.DET-03.2

Use indicators from across identities, applications, data and infrastructure activity rather than isolated signals when identifying cyber security incidents.
- Every phaseVisibility and response
ASD’s indicators

Not effective
- Investigation relies on single-source alerts with no cross-source correlation.
- Correlation rules do not consider signals from multiple data sources.
Partially effective
- Some correlation exists but is limited to specific data source pairs.
- Cross-source investigation is performed manually but not supported by automated correlation.
Fully effective
- Correlation rules and investigation procedures consider signals across identities, applications, data and infrastructure.
- Automated correlation supports detection of multi-stage adversary activity.
Related frameworks

ISM
ISM-0120, ISM-2116, ISM-2117
NIST CSF 2.0
DE.AE-03, DE.AE-04, DE.AE-07, DE.AE-08
NIST SP 800-171r3
03.03.05, 03.14.06, 03.06.01
AESCSF v2
RESPONSE-1d, SITUATION-3f, RESPONSE-2i
Essential Eight
Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

Rate this action in the Navigator

Cloud actions

Action 1

Triage alerts and events in a timely manner to determine whether cyber security incident thresholds have been met
- Every phaseVisibility and response
- ResponsibilityPaaS: Supplied, SaaS: Supplied
Rate this action in the Navigator
Action 2

Use available indicators from all connected sources, rather than isolated signals, when performing cyber security incident identification activities
- Every phaseVisibility and response
- ResponsibilityPaaS: Supplied, SaaS: Supplied
Rate this action in the Navigator

More Detect principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.