The service automatically makes ingested log entries available for search and alerting in near real time, so that detection and response are not delayed.
Real-Time Log Ingestion
CCC.Logging.CP03
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Logging.TH01 | Log Entries are Delayed or Dropped During Ingestion | Log volume bursts, ingestion quota throttling, network bottlenecks, slow transformation rules, or custom-format entries that fail to parse may delay the ingestion pipeline or overflow agent and sink buffers. Log entries arrive late or are dropped, so log-based metrics under-count, detections fire after the fact and the audit trail has gaps, reducing the availability and integrity of log data. |