Custom metric values and dimensions, trace attributes, and agent-collected fields may be populated with encoded sensitive data by a compromised workload. The data is accepted as ordinary telemetry, staged in the monitoring service, and forwarded to external systems through configured integrations, bypassing controls applied to the workload's own network egress. This impacts the confidentiality of the exfiltrated data.
Telemetry is Used as a Data Exfiltration Channel
CCC.Monitor.TH05
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CP01 | Custom Metric Ingestion | The service can receive user-defined, numeric time-series data points pushed by applications or external systems through its API, in addition to the metrics it collects automatically from provider resources. |
| CCC.Monitor.CP02 | Distributed Tracing | The service may be configured to collect traces that link a single request to the resulting operations in downstream components and external systems, providing an end-to-end view of a transaction. |
| CCC.Monitor.CP11 | Integration with External Tools | The service may be configured to forward alerts, notifications, and metric data to external systems such as incident management, ticketing, or third-party observability platforms. |
| CCC.Monitor.CP12 | Agent-Based Telemetry Collection | The service can collect metrics and traces from compute instances through a provider-supplied agent that runs on the instance and authenticates to the service using the instance identity or a configured credential. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CN06 | Scope Telemetry Publishing Permissions | Ensure that an identity can publish telemetry only for the resources it owns, so that a compromised workload or agent cannot fabricate telemetry about other systems or create unbounded metric series. |
| CCC.Monitor.CN07 | Restrict Telemetry to Approved Fields | Ensure that only explicitly selected metrics, dimensions, and trace attributes are collected, so that sensitive data is neither captured in telemetry nor carried out through it. |
| CCC.Monitor.CN08 | Restrict Telemetry Destinations and Action Targets | Ensure that telemetry is forwarded only to approved external systems and that alerts can invoke only approved actions with least-privilege identities. |