How can ManageEngine support Australian organizations in meeting these standards?
With ManageEngine Log360 (SIEM), Australian government entities and other organizations can start aligning with the principles of the Essential Eight Maturity Model. See the key clauses and how our solution helps in the table below.
MFAMFA
| Clause | Functionality | Explanation |
|---|---|---|
| (ML2/ML3) Successful and unsuccessful MFA events are centrally logged. | Log360
|
Log360 collects and centrally stores authentication events, including successful and failed MFA attempts, from AD, Microsoft Entra ID, and integrated services, through its EventLog Analyzer and ADAudit Plus components. The events are indexed for search, reporting, and real-time alerting, satisfying the requirement to centrally log MFA activity. |
Restrict administrative privilegesRestrict administrative privileges
| Clause | Functionality | Explanation |
|---|---|---|
| (ML2/ML3) Privileged access events are centrally logged. | Log360
|
ADAudit Plus consolidates every action taken by Domain Admins, Enterprise Admins, and other privileged users, including logons, object access, and LAPS password retrievals, into a single searchable audit trail within Log360. EventLog Analyzer's Privileged User Monitoring and Auditing (PUMA) reports extend this to servers and applications, centrally recording privileged access events with who, what, when, and where. |
| (ML2/ML3) Privileged user account and security group management events are centrally logged. | Log360
|
ADAudit Plus captures the creation, deletion, modification, and movement of user accounts and every addition, removal, and attribute change to AD security groups, with before-and-after values and the identity of whoever made the change. Changes to privileged groups such as Domain Admins and to AdminSDHolder raise real-time alerts, centrally logging privileged account and security-group management events. |
Application controlApplication control
| Clause | Functionality | Explanation |
|---|---|---|
| (ML2/ML3) Allowed and blocked application control events are centrally logged. | Log360
|
Log360, through EventLog Analyzer, centrally collects Windows event logs, including the allow and block events generated by application control mechanisms such as Windows Defender Application Control and AppLocker, and its custom log parser can onboard non-standard sources. All collected events are searchable, reportable, and alertable. Log360 does not enforce application control itself; enforcement requires a dedicated application control mechanism on the endpoints. |
User application hardeningUser application hardening
| Clause | Functionality | Explanation |
|---|---|---|
| (ML2/ML3) PowerShell module logging, script block logging, and transcription events are centrally logged. | Log360
|
EventLog Analyzer within Log360 centrally collects Windows event logs, including PowerShell module logging, script block logging, and transcription events, once the corresponding Windows and Group Policy audit settings are enabled. The events are archived, searchable, and available to the correlation engine. Log360 performs the central collection; enabling the PowerShell logging policies is an endpoint configuration task. |
| (ML2/ML3) Command line process creation events are centrally logged. | Log360
|
EventLog Analyzer centrally collects Windows process-creation events (Event ID 4688) with command-line detail once command-line auditing is enabled via Group Policy, storing them in the searchable archive for reporting and correlation. As with other Windows logs, Log360 handles central collection while the audit policy is configured on the endpoints. |
Central loggingCentral logging, monitoring, and response (common ML2/ML3 requirements across MFA, Restrict administrative privileges, Application control, and User application hardening)
| Clause | Functionality | Explanation |
|---|---|---|
| (ML2/ML3) Event logs are protected from unauthorized modification and deletion. | Log360
|
EventLog Analyzer writes collected logs to a central archive that is compressed, encrypted, and time-stamped to make it tamper-evident, with a configurable retention period. Holding logs on the Log360 server, separate from the originating hosts, and applying role-based access to the console protects the event record from unauthorized modification or deletion. |
| (ML2: internet-facing servers; ML3: non-internet-facing servers and workstations) Event logs are analyzed in a timely manner to detect cybersecurity events. | Log360
|
Log360's high-speed processing engine analyzes logs from internet-facing servers, non-internet-facing servers, and workstations in real time. Out-of-the-box correlation rules, threat-intelligence feeds (IoC and IP/URL/domain reputation), and dashboards surface security events as they occur, meeting the timely-analysis requirement across the server and workstation scopes introduced at ML2 and ML3. |
| (ML2/ML3) Cybersecurity events are analyzed in a timely manner to identify cybersecurity incidents. | Log360
|
Log360 escalates events to incidents through its correlation engine and ML-powered UEBA module, which baselines normal user and entity behavior, applies dynamic peer grouping, and raises risk scores for anomalous activity. The Incident Workbench adds contextual data from AD and threat intelligence so analysts can identify genuine cybersecurity incidents in a timely manner. |
| (ML2/ML3) Following the identification of a cybersecurity incident, the cybersecurity incident response plan is enacted. | Log360
|
Log360 partially addresses this clause. Its SOAR capability executes predefined playbooks and automated workflows on detection to contain or reduce the impact of an incident, and incident timelines with ITSM integration support case management and forensic review. Authoring the incident response plan and meeting any external reporting obligations remain organizational activities outside the software. |
Regular backupsRegular backups
| Clause | Functionality | Explanation |
|---|---|---|
| (ML1: unprivileged accounts; ML2/ML3: extended to privileged accounts excluding backup administrators) Access to backups is restricted and backups are protected from modification and deletion. | Log360
|
Log360 partially addresses this clause. Through DataSecurity Plus file integrity monitoring and EventLog Analyzer file-access auditing, it can monitor backup repositories held on Windows file systems and raise real-time alerts on access, modification, or deletion by unauthorized accounts, providing detective coverage. It does not set the access-control restrictions on backup media; enforcing who may access, modify, or delete backups is a function of the backup system and file-system permissions. |
Essential Eight Maturity Model clause text, © Commonwealth of Australia, Australian Signals Directorate. Licensed under CC BY 4.0 (creativecommons.org/licenses/by/4.0). This chart presents a modified version of the original text. Source: cyber.gov.au.
Conclusion
Now that you've explored how the Essential Eight Maturity Model strengthens cyber resilience across Australian organizations and how Log360 helps you meet every clause, it's time to take the next step.
Whether it's identity governance, audit logging, threat detection, or building a compliance-ready audit trail, we're here to guide you through it. Start a 30-day free trial to experience our solutions in your own environment, or contact us to schedule a one-on-one consultation.
Disclaimer: The information provided on this page is for general knowledge and awareness purposes only. It is not intended to serve as professional, legal, or regulatory advice. Compliance with the Essential Eight Maturity Model depends on your organization's specific environment, processes, and risk profile.
To accurately assess your compliance posture, we strongly recommend engaging a qualified consultant, compliance agency, or referring directly to the official Australian Signals Directorate documentation and guidelines.