auditing-observability-pipeline-collector-trustlisted

# Auditing observability pipeline collector trust: when telemetry is an untrusted input A telemetry collector sits in a trusted spot, workloads and infrastructure send it their logs, metrics, and traces, and it forwards, transforms, and stores that data with credentials that reach real backends. That position makes it an under-examined trust boundary. The data it ingests is often accepted without authenticating the sender, so anyone who can reach the ingestion endpoint can inject telemetry. The processors that transform that data can be driven by fields the sender controls, and a processor that executes, routes, or queries based on a telemetry field acts on attacker input. The collector's own credentials and exporters can reach sensitive destinations, so compromising the pipeline reaches the backends it writes to. You audit these by checking whether ingestion is authenticated and whether any processor or exporter acts on attacker-controllable content. ## When to use - A telemetry collector or agent ingests logs, metrics, or traces from workloads or the network. - The collector transforms, routes, or stores telemetry, and processors may read sender-controlled fields. - The collector runs with credentials whose exporters reach databases, object stores, or other backends. ## Scope check Test collectors and pipelines only in environments you own or are authorized to assess, on non-production telemetry. Injecting telemetry or exercising a processor touches a live pipeline, so