The service may be configured to invoke an automated action, such as a workflow, a function, or a scaling operation, when an alert condition is met, in addition to emitting a notification.
Alert-Triggered Actions
CCC.Monitor.CP10
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.TH06 | Telemetry Volume Inflates Monitoring Costs | Custom metrics and agent-collected telemetry are billed per metric series and per data point, and alert-triggered actions may invoke external systems that charge per request. A misconfigured or compromised workload can publish high-cardinality metrics or fire alerts at high frequency, and the resulting charges accrue before the pattern is detected. This impacts the availability of the monitoring budget and of systems whose scaling depends on it. |
| CCC.Monitor.TH07 | Alert-Triggered Actions Execute Unauthorized Code | Alert conditions and their action targets may be created or modified by a user with write access to alerting configuration. Ordinary metric data then triggers the action, which invokes a function, workflow, or webhook with the identity granted to the monitoring service, including re-compromise of a compute instance that has just been replaced. This impacts the integrity of the systems the action can reach. |