| CCC.Logging.TH01 | Log Entries are Delayed or Dropped During Ingestion | Log volume bursts, ingestion quota throttling, network bottlenecks, slow transformation rules, or custom-format entries that fail to parse may delay the ingestion pipeline or overflow agent and sink buffers. Log entries arrive late or are dropped, so log-based metrics under-count, detections fire after the fact and the audit trail has gaps, reducing the availability and integrity of log data. | 0 | 1 | 1 |
| CCC.Logging.TH02 | Log Data is Transferred Outside the Trust Boundary | Sensitive log data, including PII, financial transaction details, or system vulnerabilities, may be exfiltrated through the query or API interfaces by a compromised or over-privileged account, or routed out by a sink configured to deliver logs to a destination outside the trusted boundary. Log data leaves the organisation's control, compromising its confidentiality. | 0 | 2 | 2 |
| CCC.Logging.TH04 | Sensitive Data is Logged Without Masking | Sensitive data (e.g., PII, secrets, authentication tokens) is ingested into logs without proper anonymization, masking, or redaction at source or during ingestion. The sensitive values are stored in the log store and exposed to every user and sink with read access to those logs, compromising the confidentiality of the data. | 0 | 1 | 1 |
| CCC.Logging.TH05 | Logs are Deleted Early or Retained Beyond Policy | Log data is deleted prematurely or retained longer than legally required due to misconfigured retention policies or manual overrides. This can lead to non-compliance with regulatory requirements or loss of critical forensic evidence, reducing the availability of the audit trail and the confidentiality of data that should no longer exist. | 0 | 1 | 2 |
| CCC.Logging.TH06 | Forged or Malformed Entries are Written to Logs | User-supplied data containing line breaks, control characters, or escape sequences may be written to logs without proper encoding or sanitization. Injected content can forge additional log records, split or truncate genuine entries, or disrupt downstream parsers, so the stored audit trail no longer reflects what occurred, reducing the integrity of log data. | 0 | 2 | 1 |
| CCC.Logging.TH07 | Security-relevant Events are Not Logged | Security-critical actions may not be logged because log capture is not enabled for a source, verbosity is set too low, or a filter or transformation rule discards the relevant entries at ingestion. The events are absent from the log store, so threats go undetected and post-incident analysis lacks evidence, reducing the integrity and availability of the audit trail. | 0 | 2 | 1 |