The service may be configured to filter, normalise, and transform raw log data at ingestion to reduce storage volume and improve usability.
Log Filtering and Transformation
CCC.Logging.CP06
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Logging.TH01 | Log Entries are Delayed or Dropped During Ingestion | Log volume bursts, ingestion quota throttling, network bottlenecks, slow transformation rules, or custom-format entries that fail to parse may delay the ingestion pipeline or overflow agent and sink buffers. Log entries arrive late or are dropped, so log-based metrics under-count, detections fire after the fact and the audit trail has gaps, reducing the availability and integrity of log data. |
| CCC.Logging.TH04 | Sensitive Data is Logged Without Masking | Sensitive data (e.g., PII, secrets, authentication tokens) is ingested into logs without proper anonymization, masking, or redaction at source or during ingestion. The sensitive values are stored in the log store and exposed to every user and sink with read access to those logs, compromising the confidentiality of the data. |
| CCC.Logging.TH07 | Security-relevant Events are Not Logged | Security-critical actions may not be logged because log capture is not enabled for a source, verbosity is set too low, or a filter or transformation rule discards the relevant entries at ingestion. The events are absent from the log store, so threats go undetected and post-incident analysis lacks evidence, reducing the integrity and availability of the audit trail. |