Skip to main content

Management / Logging / Threats / v2026.11

Log Data is Transferred Outside the Trust Boundary

CCC.Logging.TH02

Sensitive log data, including PII, financial transaction details, or system vulnerabilities, may be exfiltrated through the query or API interfaces by a compromised or over-privileged account, or routed out by a sink configured to deliver logs to a destination outside the trusted boundary. Log data leaves the organisation's control, compromising its confidentiality.

Related Capabilities

IDTitleDescription
CCC.Core.CP06Access ControlThe service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes.
CCC.Core.CP14API AccessThe service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE.
CCC.Core.CP22Location Lock-InThe service may be configured to restrict the deployment of child resources to specific geographic locations.
CCC.Logging.CP09Internal SinkThe service may be configured to continuously route log data to a storage bucket, data warehouse, or messaging child resource within the same cloud provider.
CCC.Logging.CP10External SinkThe service may be configured to route log events to an external SIEM or data analysis system outside the cloud platform.

Related Controls

IDTitleDescription
CCC.Logging.CN06Detect and Alert on Potential Log ExfiltrationIdentify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.
CCC.Logging.CN08Restrict Log Sink Destinations to the Trust PerimeterEnsure that log data can only be routed to sink or export destinations inside the organisation's defined trust perimeter, so that a misconfigured or compromised sink cannot deliver logs to an external party. Routing logs to a sink is not data replication, so this control is distinct from core CN10.