Ensure that user-supplied content inside a log entry cannot create, split, or alter log records, so that injected control characters do not forge entries or disrupt downstream processing.
Preserve Log Entry Boundaries on Ingestion
CCC.Logging.CN10 · Ingestion
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP10 | Log Publication | The service automatically publishes structured, verbose records of activities, operations, or events that occur within the service. |
| CCC.Logging.CP01 | Service Log Capture | The service can be configured to collect logs emitted by other cloud services at the level of verbosity selected for each source. |
| CCC.Logging.CP02 | Application Log Ingestion | The service can be configured to ingest logs from custom applications running in the cloud environment through a collection agent or an ingestion API. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Logging.TH06 | Forged or Malformed Entries are Written to Logs | User-supplied data containing line breaks, control characters, or escape sequences may be written to logs without proper encoding or sanitization. Injected content can forge additional log records, split or truncate genuine entries, or disrupt downstream parsers, so the stored audit trail no longer reflects what occurred, reducing the integrity of log data. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.Logging.CN10.AR01 | When a log entry containing line breaks or control characters is ingested, the service MUST store it as a single structured log record. | tlp-clear, tlp-green, tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|---|---|
| NIST_800_53 | SI-10 |