ASD Essentials for Enterprise IT DET-03: Incident identification: timely triage against incident thresholds using correlated indicators

What does DET-03 require?

Alerts and events are triaged promptly against defined thresholds to decide whether an incident has occurred, and that decision rests on indicators drawn together from identities, applications, data and infrastructure rather than on a single isolated signal.

Maintained by Gerard Blokdyk

Other controls in Capability domain: Visibility and response – ASD Essentials for Enterprise IT

DET-01 Centralised event logging: protected central log storage, forwarded high-value logs and configuration changes
DET-02 Cyber security event detection: detection logic for unauthorised change, anomalous authentication and suspicious execution on normalised, time-synchronised, enriched logs
DET-05 Detection capability efficacy: review coverage periodically for gaps from new assets, services and architecture changes
IDE-01 Asset identification: automated discovery inventory and current records of infrastructure, software, identities, credentials and data
IDE-04 Security risk identification: use weaknesses, adversary techniques and threat behaviours in risk assessments and review them continuously
RES-03 Incident response: use documented, tested and approved procedures
RES-04 Incident insight: post-incident reviews of the gaps that enabled each stage, and evaluation of monitoring and response procedures
RES-05 Incident coordination: integrate external coordination obligations into response

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ASD Essentials for Enterprise IT controls