Management / Logging / Controls / v2026.11
Detect and Alert on Potential Log Exfiltration
CCC.Logging.CN06 · Observability
Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Core.CP06 | Access Control | The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes. |
| CCC.Core.CP14 | API Access | The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE. |
| CCC.Core.CP22 | Location Lock-In | The service may be configured to restrict the deployment of child resources to specific geographic locations. |
| CCC.Logging.CP09 | Internal Sink | The service may be configured to continuously route log data to a storage bucket, data warehouse, or messaging child resource within the same cloud provider. |
| CCC.Logging.CP10 | External Sink | The service may be configured to route log events to an external SIEM or data analysis system outside the cloud platform. |
Related Threats
| ID | Title | Description |
|---|
| CCC.Logging.TH02 | Log Data is Transferred Outside the Trust Boundary | Sensitive log data, including PII, financial transaction details, or system vulnerabilities, may be exfiltrated through the query or API interfaces by a compromised or over-privileged account, or routed out by a sink configured to deliver logs to a destination outside the trusted boundary. Log data leaves the organisation's control, compromising its confidentiality. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.Logging.CN06.AR01 | When a single principal executes an anomalously high number of log queries, an alert MUST be generated. | tlp-green, tlp-amber, tlp-red |