Management / Monitoring / Controls / DEV
Restrict Telemetry Destinations and Action Targets
CCC.Monitor.CN08 · Access
Ensure that telemetry is forwarded only to approved external systems and that alerts can invoke only approved actions with least-privilege identities.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Monitor.CP01 | Custom Metric Ingestion | The service can receive user-defined, numeric time-series data points pushed by applications or external systems through its API, in addition to the metrics it collects automatically from provider resources. |
| CCC.Monitor.CP02 | Distributed Tracing | The service may be configured to collect traces that link a single request to the resulting operations in downstream components and external systems, providing an end-to-end view of a transaction. |
| CCC.Monitor.CP08 | Application Performance Monitoring | The service may be configured to collect application-level telemetry such as request latency, error rates, and dependency calls through instrumentation, in order to monitor performance and user experience. |
| CCC.Monitor.CP09 | Dashboards | The service can present metrics, alerts, service level objectives, and uptime results in user-defined visual dashboards that may be shared with other users. |
| CCC.Monitor.CP11 | Integration with External Tools | The service may be configured to forward alerts, notifications, and metric data to external systems such as incident management, ticketing, or third-party observability platforms. |
| CCC.Monitor.CP12 | Agent-Based Telemetry Collection | The service can collect metrics and traces from compute instances through a provider-supplied agent that runs on the instance and authenticates to the service using the instance identity or a configured credential. |
| CCC.Monitor.CP10 | Alert-Triggered Actions | The service may be configured to invoke an automated action, such as a workflow, a function, or a scaling operation, when an alert condition is met, in addition to emitting a notification. |
| CCC.Core.CP17 | Alerting | The service may be configured to emit a notification based on a user-defined condition related to the data published by a child or networked resource. |
Related Threats
| ID | Title | Description |
|---|
| CCC.Monitor.TH01 | Sensitive Data is Captured in Telemetry | Metric dimensions, trace attributes, application telemetry, or agent-collected data may include personal or otherwise sensitive information when instrumentation is not configured to exclude it. The data is then stored, shown on dashboards, and forwarded to external systems with the access controls of the monitoring service rather than those of the originating system. This impacts the confidentiality of the captured data. |
| CCC.Monitor.TH05 | Telemetry is Used as a Data Exfiltration Channel | Custom metric values and dimensions, trace attributes, and agent-collected fields may be populated with encoded sensitive data by a compromised workload. The data is accepted as ordinary telemetry, staged in the monitoring service, and forwarded to external systems through configured integrations, bypassing controls applied to the workload's own network egress. This impacts the confidentiality of the exfiltrated data. |
| CCC.Monitor.TH06 | Telemetry Volume Inflates Monitoring Costs | Custom metrics and agent-collected telemetry are billed per metric series and per data point, and alert-triggered actions may invoke external systems that charge per request. A misconfigured or compromised workload can publish high-cardinality metrics or fire alerts at high frequency, and the resulting charges accrue before the pattern is detected. This impacts the availability of the monitoring budget and of systems whose scaling depends on it. |
| CCC.Monitor.TH07 | Alert-Triggered Actions Execute Unauthorized Code | Alert conditions and their action targets may be created or modified by a user with write access to alerting configuration. Ordinary metric data then triggers the action, which invokes a function, workflow, or webhook with the identity granted to the monitoring service, including re-compromise of a compute instance that has just been replaced. This impacts the integrity of the systems the action can reach. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.Monitor.CN08.AR01 | When a notification channel or telemetry export destination is configured, the destination MUST be on an approved list of external systems. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Monitor.CN08.AR02 | When an alert-triggered action is configured, the action target MUST be on an approved list of functions, workflows, or endpoints. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Monitor.CN08.AR03 | When an alert-triggered action is invoked, the service MUST use an identity granted only the permissions required by that action. | tlp-clear, tlp-green, tlp-amber, tlp-red |