Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.
Centralized and Comprehensive Log Aggregation
CCC.Logging.CN01 · Observability
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP10 | Log Publication | The service automatically publishes structured, verbose records of activities, operations, or events that occur within the service. |
| CCC.Logging.CP01 | Service Log Capture | The service can be configured to collect logs emitted by other cloud services at the level of verbosity selected for each source. |
| CCC.Logging.CP02 | Application Log Ingestion | The service can be configured to ingest logs from custom applications running in the cloud environment through a collection agent or an ingestion API. |
| CCC.Logging.CP06 | Log Filtering and Transformation | The service may be configured to filter, normalise, and transform raw log data at ingestion to reduce storage volume and improve usability. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Logging.TH07 | Security-relevant Events are Not Logged | Security-critical actions may not be logged because log capture is not enabled for a source, verbosity is set too low, or a filter or transformation rule discards the relevant entries at ingestion. The events are absent from the log store, so threats go undetected and post-incident analysis lacks evidence, reducing the integrity and availability of the audit trail. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.Logging.CN01.AR01 | When a new cloud account or project is created, provider-level audit logging for it MUST be enabled. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Logging.CN01.AR02 | When a new cloud compute resource is deployed, it MUST be configured to forward all relevant logs (e.g., OS, application, service logs) to the central log sink. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Logging.CN01.AR03 | When provider-level audit or network flow logs are generated, the service MUST receive them in the central log sink. | tlp-clear, tlp-green, tlp-amber, tlp-red |