| CCC.Monitor.TH01 | Sensitive Data is Captured in Telemetry | Metric dimensions, trace attributes, application telemetry, or agent-collected data may include personal or otherwise sensitive information when instrumentation is not configured to exclude it. The data is then stored, shown on dashboards, and forwarded to external systems with the access controls of the monitoring service rather than those of the originating system. This impacts the confidentiality of the captured data. | 0 | 1 | 2 |
| CCC.Monitor.TH02 | System Health is Exposed to Unauthorized Viewers | Dashboards, uptime results, and service level objective status may be shared beyond the intended audience through overly broad sharing settings or public links. Degraded or failing components are then visible to unauthorized viewers, who can target systems that are already in a weakened state or time activity to coincide with existing incidents. This impacts the confidentiality of operational information and the availability of the affected systems. | 0 | 1 | 1 |
| CCC.Monitor.TH03 | Monitoring Probes Overload the Monitored Target | Synthetic and uptime checks may be configured with excessive frequency, concurrency, or number of provider-operated locations, or their definitions may be modified to point at a different target. The probe traffic then consumes the capacity of the monitored endpoint from trusted provider address ranges that are typically exempt from rate limiting. This impacts the availability of the monitored system. | 0 | 1 | 1 |
| CCC.Monitor.TH04 | Monitoring Probes are Used to Reach Internal Systems | Synthetic and uptime checks run with an identity, network placement, and stored credentials that allow them to reach endpoints not otherwise exposed. If the check definition or its script can be modified, the check becomes a trusted path through which arbitrary requests are issued against internal systems and their responses are recorded. This impacts the confidentiality and integrity of the internal systems reached. | 0 | 1 | 1 |
| CCC.Monitor.TH05 | Telemetry is Used as a Data Exfiltration Channel | Custom metric values and dimensions, trace attributes, and agent-collected fields may be populated with encoded sensitive data by a compromised workload. The data is accepted as ordinary telemetry, staged in the monitoring service, and forwarded to external systems through configured integrations, bypassing controls applied to the workload's own network egress. This impacts the confidentiality of the exfiltrated data. | 0 | 1 | 3 |
| CCC.Monitor.TH06 | Telemetry Volume Inflates Monitoring Costs | Custom metrics and agent-collected telemetry are billed per metric series and per data point, and alert-triggered actions may invoke external systems that charge per request. A misconfigured or compromised workload can publish high-cardinality metrics or fire alerts at high frequency, and the resulting charges accrue before the pattern is detected. This impacts the availability of the monitoring budget and of systems whose scaling depends on it. | 0 | 1 | 3 |
| CCC.Monitor.TH07 | Alert-Triggered Actions Execute Unauthorized Code | Alert conditions and their action targets may be created or modified by a user with write access to alerting configuration. Ordinary metric data then triggers the action, which invokes a function, workflow, or webhook with the identity granted to the monitoring service, including re-compromise of a compute instance that has just been replaced. This impacts the integrity of the systems the action can reach. | 0 | 2 | 1 |
| CCC.Monitor.TH08 | Alerts are Suppressed Without Expiry or Authorization | Alert suppression, snooze, or action-disable settings may be applied by a user with write access to alerting configuration while telemetry continues to be published. Alert conditions are still evaluated but no notification or action is delivered, so the activity that would have raised the alert proceeds undetected. This impacts the availability of security and operational information and delays incident response. | 0 | 2 | 1 |
| CCC.Monitor.TH09 | Telemetry Agent Credentials or Configuration are Compromised | A telemetry agent runs on the monitored instance with a credential that is authorized to publish telemetry and with a configuration that selects which host data is collected. If the credential is extracted or the configuration is modified, the agent can be made to collect arbitrary files or process data, or the credential can be reused to publish telemetry on behalf of other instances. This impacts the confidentiality of host data and the integrity of collected telemetry. | 0 | 1 | 1 |
| CCC.Monitor.TH10 | Monitoring Scope Exposes Telemetry Across Accounts | A cross-account monitoring scope may be configured to link more accounts, subscriptions, or projects than intended, or the central monitoring account may be granted to users who are not authorized in the linked accounts. Users of the scope can then read metrics, traces, and alert state for every linked account without holding access in those accounts. This impacts the confidentiality of telemetry across tenancy boundaries. | 0 | 2 | 1 |