Alert conditions and their action targets may be created or modified by a user with write access to alerting configuration. Ordinary metric data then triggers the action, which invokes a function, workflow, or webhook with the identity granted to the monitoring service, including re-compromise of a compute instance that has just been replaced. This impacts the integrity of the systems the action can reach.
Alert-Triggered Actions Execute Unauthorized Code
CCC.Monitor.TH07
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP17 | Alerting | The service may be configured to emit a notification based on a user-defined condition related to the data published by a child or networked resource. |
| CCC.Monitor.CP10 | Alert-Triggered Actions | The service may be configured to invoke an automated action, such as a workflow, a function, or a scaling operation, when an alert condition is met, in addition to emitting a notification. |
| CCC.Monitor.CP11 | Integration with External Tools | The service may be configured to forward alerts, notifications, and metric data to external systems such as incident management, ticketing, or third-party observability platforms. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CN08 | Restrict Telemetry Destinations and Action Targets | Ensure that telemetry is forwarded only to approved external systems and that alerts can invoke only approved actions with least-privilege identities. |