ASD Essentials for Enterprise IT DET-02: Cyber security event detection: detection logic for unauthorised change, anomalous authentication and suspicious execution on normalised, time-synchronised, enriched logs

What does DET-02 require?

Detection rules are built to catch unauthorised changes, abnormal authentication and suspicious program execution, and the underlying logs are normalised, clock-aligned and enriched so events can be correlated across systems and environments. Marked for every technical domain.

Maintained by Gerard Blokdyk

Other controls in Capability domain: Visibility and response – ASD Essentials for Enterprise IT

DET-01 Centralised event logging: protected central log storage, forwarded high-value logs and configuration changes
DET-03 Incident identification: timely triage against incident thresholds using correlated indicators
DET-05 Detection capability efficacy: review coverage periodically for gaps from new assets, services and architecture changes
IDE-01 Asset identification: automated discovery inventory and current records of infrastructure, software, identities, credentials and data
IDE-04 Security risk identification: use weaknesses, adversary techniques and threat behaviours in risk assessments and review them continuously
RES-03 Incident response: use documented, tested and approved procedures
RES-04 Incident insight: post-incident reviews of the gaps that enabled each stage, and evaluation of monitoring and response procedures
RES-05 Incident coordination: integrate external coordination obligations into response

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ASD Essentials for Enterprise IT controls