The service may be configured to forward alerts, notifications, and metric data to external systems such as incident management, ticketing, or third-party observability platforms.
Integration with External Tools
CCC.Monitor.CP11
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.TH01 | Sensitive Data is Captured in Telemetry | Metric dimensions, trace attributes, application telemetry, or agent-collected data may include personal or otherwise sensitive information when instrumentation is not configured to exclude it. The data is then stored, shown on dashboards, and forwarded to external systems with the access controls of the monitoring service rather than those of the originating system. This impacts the confidentiality of the captured data. |
| CCC.Monitor.TH05 | Telemetry is Used as a Data Exfiltration Channel | Custom metric values and dimensions, trace attributes, and agent-collected fields may be populated with encoded sensitive data by a compromised workload. The data is accepted as ordinary telemetry, staged in the monitoring service, and forwarded to external systems through configured integrations, bypassing controls applied to the workload's own network egress. This impacts the confidentiality of the exfiltrated data. |
| CCC.Monitor.TH06 | Telemetry Volume Inflates Monitoring Costs | Custom metrics and agent-collected telemetry are billed per metric series and per data point, and alert-triggered actions may invoke external systems that charge per request. A misconfigured or compromised workload can publish high-cardinality metrics or fire alerts at high frequency, and the resulting charges accrue before the pattern is detected. This impacts the availability of the monitoring budget and of systems whose scaling depends on it. |
| CCC.Monitor.TH07 | Alert-Triggered Actions Execute Unauthorized Code | Alert conditions and their action targets may be created or modified by a user with write access to alerting configuration. Ordinary metric data then triggers the action, which invokes a function, workflow, or webhook with the identity granted to the monitoring service, including re-compromise of a compute instance that has just been replaced. This impacts the integrity of the systems the action can reach. |