Security-critical actions may not be logged because log capture is not enabled for a source, verbosity is set too low, or a filter or transformation rule discards the relevant entries at ingestion. The events are absent from the log store, so threats go undetected and post-incident analysis lacks evidence, reducing the integrity and availability of the audit trail.
Security-relevant Events are Not Logged
CCC.Logging.TH07
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP10 | Log Publication | The service automatically publishes structured, verbose records of activities, operations, or events that occur within the service. |
| CCC.Logging.CP01 | Service Log Capture | The service can be configured to collect logs emitted by other cloud services at the level of verbosity selected for each source. |
| CCC.Logging.CP02 | Application Log Ingestion | The service can be configured to ingest logs from custom applications running in the cloud environment through a collection agent or an ingestion API. |
| CCC.Logging.CP06 | Log Filtering and Transformation | The service may be configured to filter, normalise, and transform raw log data at ingestion to reduce storage volume and improve usability. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Logging.CN01 | Centralized and Comprehensive Log Aggregation | Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service. |