GRC Store

Search / finos-ccc/ccc.logging.th / v2026.06-rc3

Release · v2026.06-rc3

FINOS-CCC/CCC.Logging.TH Threat Catalog

FINOS-CCC/CCC.Logging.TH

Threats for Logging technologies, as defined by the FINOS Common Cloud Controls project.

Published by FINOS Common Cloud Controls

Install

OCI v1.1
$grcli unpack --repository finos-ccc/ccc.logging.th --tag v2026.06-rc3
Coordinate
oci.grc.store/finos-ccc/ccc.logging.th:v2026.06-rc3
Manifest digest
sha256:ef22b8087ab3297c562a3ec8309a34eedfb07086ac40c1317f6688950dcd2cbf

Provenance

1 layer
Digest Media type Size
074ef16fb998… application/vnd.gemara.artifact.v1+yaml 8.2 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "v1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "CCC.Logging.TH",
            "type": "ThreatCatalog"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "finos-ccc/ccc.logging.th",
            "tag": "v2026.06-rc3"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/common-cloud-controls",
          "GITHUB_RUN_ATTEMPT": "2",
          "GITHUB_RUN_ID": "26768391088",
          "GITHUB_SHA": "24594e28430c12318cacffe7fdda6a3ea272d975",
          "GITHUB_WORKFLOW": "Batch Release All Catalogs",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "artifacts/management/logging/threats.yaml",
            "uri": "file://artifacts/management/logging/threats.yaml",
            "digest": {
              "sha256": "074ef16fb998a800a31296bf21cfc6d32335892e8b9438b3a4f2fe485426b456"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/common-cloud-controls@24594e28430c12318cacffe7fdda6a3ea272d975",
            "digest": {
              "gitCommit": "24594e28430c12318cacffe7fdda6a3ea272d975"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/common-cloud-controls/actions/runs/26768391088",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.2.2"
          }
        },
        "metadata": {
          "invocationId": "26768391088-2",
          "startedOn": "2026-06-01T16:45:00.483894367Z",
          "finishedOn": "2026-06-01T16:45:00.582617617Z"
        },
        "byproducts": [
          {
            "name": "threats.yaml",
            "digest": {
              "sha256": "074ef16fb998a800a31296bf21cfc6d32335892e8b9438b3a4f2fe485426b456"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "threats.yaml",
      "type": "ThreatCatalog",
      "id": "CCC.Logging.TH",
      "role": "artifact"
    }
  ]
}

CCC Logging Threats

Threats for Logging technologies, as defined by the FINOS Common Cloud Controls project.

ID
CCC.Logging.TH
Version
v2026.06-rc3
Gemara version
v1.2.0
Author
FINOS Common Cloud Controls

Observability

The Observability group covers entries related to logging, monitoring, metrics, alerting, and event publication. This includes audit trail integrity, enumeration detection, and protection against tampering or unauthorized access to operational telemetry.

  1. CCC.Logging.TH01 Log Ingestion Performance Degradation

    The logging service's ingestion pipeline experiences performance degradation due to overwhelming log volumes, network bottlenecks, or inefficient processing, leading to delayed availability of log data for analysis and potential log loss if buffers overflow.

    Capabilities
    • CCC.Logging.Capabilities
      • CCC.Logging.CP03 — Real-Time Log Ingestion
      • CCC.Logging.CP04 — Centralised Log Collection
      • CCC.Logging.CP06 — Log Filtering & Transformation

  2. CCC.Logging.TH03 Log Schema or Format Drift

    Changes in source application or cloud service log formats, schemas, or underlying data structures lead to parsing failures, incomplete log ingestion, or render existing queries and dashboards ineffective, hindering comprehensive analysis.

    Capabilities
    • CCC.Logging.Capabilities
      • CCC.Logging.CP05 — Custom Log Format Support
      • CCC.Logging.CP06 — Log Filtering & Transformation
      • CCC.Logging.CP11 — Log-based Metrics

  3. CCC.Logging.TH04 Inadequate Log Anonymization/Masking

    Sensitive data (e.g., PII, secrets, authentication tokens) is ingested into logs without proper anonymization, masking, or redaction at source or during ingestion. This creates a significant data exposure risk, particularly for data not intended for broad log access.

    Capabilities
    • CCC.Logging.Capabilities
      • CCC.Logging.CP06 — Log Filtering & Transformation
      • CCC.Logging.CP08 — Retention Policies

  4. CCC.Logging.TH05 Log Retention Policy Evasion or Misconfiguration

    Log data is deleted prematurely or retained longer than legally required due to misconfigured retention policies, manual overrides, or evasion tactics. This can lead to non-compliance with regulatory requirements or loss of critical forensic evidence.

    Capabilities
    • CCC.Logging.Capabilities
      • CCC.Logging.CP07 — Immutable Storage
      • CCC.Logging.CP08 — Retention Policies
      • CCC.Logging.CP12 — Log Archiving

  5. CCC.Logging.TH07 Insufficient Logging

    If security-critical actions are not logged, it becomes more difficult to detect threats and conduct post-incident analysis.

    Capabilities
    • CCC.Core.Capabilities
      • CCC.Core.CP10 — Logging
    • CCC.Logging.Capabilities
      • CCC.Logging.CP01 — Service Log Capture
      • CCC.Logging.CP02 — Application Log Ingestion

Data Resilience

The Data Resilience group covers entries related to ensuring data availability, integrity, and sovereignty across its lifecycle. This includes replication, backup, recovery, region restrictions, and protection against data loss or corruption.

  1. CCC.Logging.TH02 Unauthorized Data Transfer Out of a Trusted Boundary

    Sensitive log data, including PII, financial transaction details, or system vulnerabilities, is exfiltrated directly from the logging service's query or API interfaces by authorized but malicious insiders or compromised accounts exploiting legitimate access.

    Capabilities
    • CCC.Core.Capabilities
      • CCC.Core.CP06 — Access Control
      • CCC.Core.CP14 — API Access
      • CCC.Core.CP22 — Location Lock-In

Ingestion

The Ingestion group covers entries related to how a service receives or retrieves data, inputs, or commands for processing. This includes both active (pull-based) and passive (push-based) ingestion patterns.

  1. CCC.Logging.TH06 Log Injection

    User-supplied data such as scripts, control characters, escape sequences, or code fragments may be written to logs without proper encoding or sanitization. This can result in malformed or unexpected log entries that could disrupt or compromise systems that process or display these logs, including log viewers or downstream services.

    Capabilities
    • CCC.Core.Capabilities
      • CCC.Core.CP10 — Logging
    • CCC.Logging.Capabilities
      • CCC.Logging.CP01 — Service Log Capture
      • CCC.Logging.CP02 — Application Log Ingestion