Skip to main content

Management / Logging / Controls / DEV

Alert on Log Ingestion Failure

CCC.Logging.CN09 · Observability

Ensure that throttled, rejected, or silently missing log data is detected promptly, so that gaps in the audit trail are visible before they hinder detection or forensics.

Related Capabilities

IDTitleDescription
CCC.Logging.CP03Real-Time Log IngestionThe service automatically makes ingested log entries available for search and alerting in near real time, so that detection and response are not delayed.
CCC.Logging.CP04Centralised Log CollectionThe service may be configured to aggregate logs from resources in multiple accounts or projects into a single central logging destination.
CCC.Logging.CP05Custom Log Format SupportThe service can be configured to ingest custom log formats, including logs from on-premises systems or other cloud environments, through its collection agents.
CCC.Logging.CP06Log Filtering and TransformationThe service may be configured to filter, normalise, and transform raw log data at ingestion to reduce storage volume and improve usability.
CCC.Logging.CP11Log-based MetricsThe service may be configured to derive numeric metrics from log entries that match a query or filter, for performance monitoring and alerting.
CCC.Core.CP04Transaction Rate LimitsThe service can throttle, delay, or reject excess requests when transactions exceed a user-specified rate limit, and always provides industry-standard throughput up to that limit.
CCC.Core.CP16BudgetingThe service may be configured to take a user-specified action when a spending threshold is met or exceeded on a child or networked resource.
CCC.Core.CP19Child Resource ScalingThe service may be configured to scale child resources automatically or on-demand.
CCC.Core.CP24Core Processing UnitsThe service provides users and child resources with access to core processing units (CPUs) for executing instructions and performing computations.
CCC.Core.CP25Random Access Memory AllocationThe service provides users and child resources with access to random access memory (RAM) for temporary data storage and fast data retrieval during processing tasks.
CCC.Core.CP26Persistent StorageThe service provides users and child resources with access to persistent storage for saving and retrieving data reliably over time.
CCC.Core.CP31Elastic ScalingThe service automatically adjusts its resource allocation (such as CPU, memory, and storage) based on current demand and workload.
CCC.Core.CP07Event PublicationThe service automatically publishes a structured state-change record upon creation, deletion, or modification of data, configuration, components, or child resources.
CCC.Core.CP09Metrics PublicationThe service automatically publishes structured, numeric, time-series data points related to the performance, availability, and health of the service or its child resources.
CCC.Core.CP10Log PublicationThe service automatically publishes structured, verbose records of activities, operations, or events that occur within the service.

Related Threats

IDTitleDescription
CCC.Logging.TH01Log Entries are Delayed or Dropped During IngestionLog volume bursts, ingestion quota throttling, network bottlenecks, slow transformation rules, or custom-format entries that fail to parse may delay the ingestion pipeline or overflow agent and sink buffers. Log entries arrive late or are dropped, so log-based metrics under-count, detections fire after the fact and the audit trail has gaps, reducing the availability and integrity of log data.
CCC.Core.TH12Resource Constraints are ExhaustedExceeding the resource constraints through excessive consumption, resource-intensive operations, or lowering of rate-limit thresholds can impact the availability of elements such as memory, CPU, or storage. This may disrupt availability of the service or child resources by denying the associated functionality to users. If the impacted system is not designed to expect such a failure, the effect could also cascade to other services and resources.
CCC.Core.TH16Publications are DisabledPublication of events, metrics, and runtime logs may be disabled, leading to a lack of expected security and operational information being shared. This can impact system availability by delaying the detection of incidents while also impacting system design decisions and enforcement of operational thresholds, such as autoscaling or cost management.

Assessment Requirements

IDTextApplicability
CCC.Logging.CN09.AR01When log events are throttled or rejected for exceeding an ingestion quota, the service MUST generate an alert.tlp-clear, tlp-green, tlp-amber, tlp-red
CCC.Logging.CN09.AR02When no log entry has been received from a configured log source for longer than the organisation's defined heartbeat interval, the service MUST generate an alert.tlp-green, tlp-amber, tlp-red

Guideline Mappings

FrameworkIDRemarks
NIST-CSFDE.CM-09
NIST_800_53AU-4
NIST_800_53AU-5