A telemetry agent runs on the monitored instance with a credential that is authorized to publish telemetry and with a configuration that selects which host data is collected. If the credential is extracted or the configuration is modified, the agent can be made to collect arbitrary files or process data, or the credential can be reused to publish telemetry on behalf of other instances. This impacts the confidentiality of host data and the integrity of collected telemetry.
Telemetry Agent Credentials or Configuration are Compromised
CCC.Monitor.TH09
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CP01 | Custom Metric Ingestion | The service can receive user-defined, numeric time-series data points pushed by applications or external systems through its API, in addition to the metrics it collects automatically from provider resources. |
| CCC.Monitor.CP12 | Agent-Based Telemetry Collection | The service can collect metrics and traces from compute instances through a provider-supplied agent that runs on the instance and authenticates to the service using the instance identity or a configured credential. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CN06 | Scope Telemetry Publishing Permissions | Ensure that an identity can publish telemetry only for the resources it owns, so that a compromised workload or agent cannot fabricate telemetry about other systems or create unbounded metric series. |