The service may be configured to detect sensitive data such as personal information, credentials, or tokens in log entries at ingestion and mask or redact it before storage. Not every provider offers this natively (GCP Cloud Logging has no ingestion-time masking).
Sensitive Data Masking
CCC.Logging.CP14
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Logging.TH04 | Sensitive Data is Logged Without Masking | Sensitive data (e.g., PII, secrets, authentication tokens) is ingested into logs without proper anonymization, masking, or redaction at source or during ingestion. The sensitive values are stored in the log store and exposed to every user and sink with read access to those logs, compromising the confidentiality of the data. |