Metric dimensions, trace attributes, application telemetry, or agent-collected data may include personal or otherwise sensitive information when instrumentation is not configured to exclude it. The data is then stored, shown on dashboards, and forwarded to external systems with the access controls of the monitoring service rather than those of the originating system. This impacts the confidentiality of the captured data.
Sensitive Data is Captured in Telemetry
CCC.Monitor.TH01
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CP01 | Custom Metric Ingestion | The service can receive user-defined, numeric time-series data points pushed by applications or external systems through its API, in addition to the metrics it collects automatically from provider resources. |
| CCC.Monitor.CP02 | Distributed Tracing | The service may be configured to collect traces that link a single request to the resulting operations in downstream components and external systems, providing an end-to-end view of a transaction. |
| CCC.Monitor.CP08 | Application Performance Monitoring | The service may be configured to collect application-level telemetry such as request latency, error rates, and dependency calls through instrumentation, in order to monitor performance and user experience. |
| CCC.Monitor.CP09 | Dashboards | The service can present metrics, alerts, service level objectives, and uptime results in user-defined visual dashboards that may be shared with other users. |
| CCC.Monitor.CP11 | Integration with External Tools | The service may be configured to forward alerts, notifications, and metric data to external systems such as incident management, ticketing, or third-party observability platforms. |
| CCC.Monitor.CP12 | Agent-Based Telemetry Collection | The service can collect metrics and traces from compute instances through a provider-supplied agent that runs on the instance and authenticates to the service using the instance identity or a configured credential. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CN07 | Restrict Telemetry to Approved Fields | Ensure that only explicitly selected metrics, dimensions, and trace attributes are collected, so that sensitive data is neither captured in telemetry nor carried out through it. |
| CCC.Monitor.CN08 | Restrict Telemetry Destinations and Action Targets | Ensure that telemetry is forwarded only to approved external systems and that alerts can invoke only approved actions with least-privilege identities. |