vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Activity Tracker events 

IBM Cloud

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with IBM Watson® Text to Speech in IBM Cloud®.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the tutorial [Getting started with IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).



 Customization events 

The following tables list the Text to Speech actions for model customization that generate events.

The names of the actions for the customization events have changed. The old names are deprecated. Use the names in the following tables instead. For more information, see [Updates to Activity Tracker actions for customization](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-release-notestext-to-speech-12april2021) in the release notes for IBM Cloud.



 Create events 



Table 1. Customization .create actions that generate events

 Action Description 

 text-to-speech.custom-model.create Create a custom model (POST /v1/customizations). 
 text-to-speech.custom-model-word-list.create Create a word list for a custom model (POST /v1/customizations/{customization_id}/words). 
 text-to-speech.custom-model-word.create Create a word for a custom model (PUT /v1/customizations/{customization_id}/words/{word}). 







 Read events 



Table 2. Customization .read actions that generate events

 Action Description 

 text-to-speech.custom-model-list.read Read a list of custom models created by a user (GET /v1/customizations).
By monitoring for risks, you can identify security vulnerabilities and quickly work to mitigate the impact and fix the issue. By using Security and Compliance Center along with [external integrations](https://cloud.ibm.com/security-compliance/integrations) (such as, OpenShift Compliance Operator (OSCO), Tanium, NeuVector, and so on), you can build a robust approach for monitoring for security and compliance issues.





 IBM Cloud Flow Logs for VPC 

[Flow Logs for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs) enables the collection, storage, and presentation of information about the Internet Protocol (IP) traffic flowing to and from network interfaces within your VPC.

Flow logs can help with a number of tasks, including:



* Troubleshooting why specific traffic isn't reaching an instance, which helps to diagnose restrictive security group rules
* Recording the metadata of network traffic that is reaching your instance
* Determining source and destination traffic from the network interfaces
* Adhering to compliance regulations
* Assisting with root cause analysis









 Integration 



 IBM Event Streams for IBM Cloud (optional) 

[Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-about) is a high-throughput message bus built with Apache Kafka. It is optimized for event ingestion into IBM Cloud and event stream distribution between your services and applications.

You can use Event Streams to complete the following tasks:



* Offload work to back-end worker applications.
* Connect event streams to streaming analytics to realize powerful insights.
* Publish event data to multiple applications to react in real time.



Event Streams offers a fully managed Apache Kafka service, ensuring durability and high availability for our clients. By using Event Streams, you have support around the clock from our team of Kafka experts.







 Databases 



 IBM Cloud Hyper Protect DBaaS for MongoDB (optional) 

Moving confidential and mission-critical data to the cloud presents data confidentiality, security, and reliability concerns.
14 Dec 2021 

New source: IBM Cloud® Security and Compliance Center
: Integrating Security and Compliance Center with Event Notifications can help you route security events by the supported channels. For more information, see [Enabling event notifications for Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-event-notifications&interface=ui).





 28 Oct 2021 

Introducing Event Notifications
: Event Notifications is Generally Available. IBM Cloud Monitoring as a source is supported to route events to communication channels like email, SMS, and webhooks.
[Save entity](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/add_entity_save.png)







 Teaching your assistant about topics to ignore 

It is important to help your assistant stay focused on the types of customer questions and business transactions you have designed it to handle. You can use information collected from real customer conversations to highlight subjects that you do not want your assistant to even attempt to address.

For more information, see [Defining what's irrelevant](https://cloud.ibm.com/docs/assistant?topic=assistant-irrelevance-detection).
The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for SI-4 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 SI-4 (a) <br><br> * Check whether Flow Logs for VPC are enabled<br> * Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services<br><br><br> 
 SI-4 (b) <br><br> * Check whether Flow Logs for VPC are enabled<br> * Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services<br><br><br> 
 SI-4 (c) <br><br> * Check whether Flow Logs for VPC are enabled<br> * Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services<br><br><br> 







 NIST supplemental guidance 

Information system monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the information system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the information system. Organizations can monitor information systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include, for example, selected perimeter locations and near server farms supporting critical applications, with such devices typically being employed at the managed interfaces associated with controls SC-7 and AC-17. Einstein network monitoring devices from the Department of Homeland Security can also be included as monitoring devices. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of information systems to support such objectives.
* [Understanding what is logged and monitored by default](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorhealth-default)



* [Auditing events for Satellite actions](https://cloud.ibm.com/docs/satellite?topic=satellite-monitoraudit-events)
* [IBM monitoring to resolve and report location alerts](https://cloud.ibm.com/docs/satellite?topic=satellite-monitormonitoring-default)



* [Viewing location, host, and cluster health](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorview-health)



* [Viewing location health](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorlocation-health)
* [Viewing host health](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorhost-health)
* [Viewing cluster health](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorcluster-health)
* [Viewing Kubernetes resources in clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorkubernetes-resources-health)
* [Viewing Satellite Config registration status for clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorsatconfig-registration-status)



* [Setting up Monitoring for Satellite location platform metrics](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorsetup-mon)



* [Available metrics](https://cloud.ibm.com/docs/satellite?topic=satellite-monitoravailable-metrics)
* [Attributes for segmentation](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorattributes)



* [Setting up monitoring for clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorsetup-clusters-monitoring)
If no filter is defined for a source, none of the events from that source are ingested.
* If a filter is defined for a source but no event notifications are passed through, the number of notifications that bounced are still considered "ingested" because they were analyzed by a filter.







 Topic 



* A landing place for filtered events. Topics hold a set of incoming event notifications of interest. Each source is connected to a topic through a user-defined filter. Notifications that pass into a topic are pushed to all subscribed destinations. A topic can connect to multiple sources.
* Event notifications that end up in a topic are routed to destinations. A topic can be connected to multiple sources. Although topics are innately coupled to sources by using filters, they are not innately coupled to destinations. That coupling happens through subscriptions.







 Destination 

A delivery target for Event Notifications. In other contexts, destinations are also called channels, sinks, consumers, or subscribers.



* Human destination: A device, server, or application presents notifications for human consumption. Examples of human destinations are email servers, SMS text providers, and push notification services.

Specific email addresses, phone numbers, and device IDs can be part of a subscription to a destination, but they are not part of the destination itself.
* Service destinations: A cloud service or an application where notifications are consumed programmatically. A webhook to a backend microservice is an example of a service destination.





 Service-to-service 

A way to describe a notification that travels from a cloud service to a service destination. In other contexts, service-to-service is also categorized as app-to-app.





 Service-to-human 

A way to describe a notification that travels from a cloud service to a human destination. In other contexts, service-to-human is also categorized as app-to-person.







 Subscription 

An association of one topic to one destination. If a destination requires additional information to operate correctly (for example, email addresses for an email destination), then that information is included in the subscription.





 Subscriber 

An entity that is targeted by a subscription.
By setting up notifications you can make sure that certifications do not expire. Note that Secrets Manager allows you to order certificates.

Consider implementing more stringent access rules to resources. [Context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis) allow defining access restrictions based on network zones and endpoint types. Thus, it is possible to isolate teams, users and resources by location.







 Evaluate and monitor app security 

Events related to IBM Cloud account activities, such as logging in or provisioning a service, are logged to Activity Tracker. It does not, however, directly integrate any application-related events. But some services have options to enable tracking of security events. Examples are [Object Storage which allows both read and write events to be tracked](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-at) and [App ID which can track sign-in, sign-up and other runtime events](https://cloud.ibm.com/docs/appid?topic=appid-at-eventsat-monitor-runtime-activity) when enabled. Applications can ingest security and diagnostic events into [Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-started). Moreover, most [services support sending usage logs directly to Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-cloud_services).

By sending both application logs, such as general diagnostics and security-related information like failed logins to a single logging facility, you can aggregate the logs and perform security analysis in application context, across the full stack. You can use the queries as foundation for [defining alerts](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-alerts). Alerts help you to monitor your app and related services.
Allowing your customers to change the topic of the conversation 

In general, an action is designed to lead a customer through a particular process without any interruptions. However, real conversations almost never follow such a simple flow. In the middle of a conversation, customers might get distracted, ask questions about related issues, misunderstand something, or change their minds about what they want to do.

The Change conversation topic feature enables your assistant to handle these digressions, dynamically responding to the user by changing the conversation topic as needed.



 How changing the topic works 

This example shows a customer who changes the conversation topic while they are entering a credit card. When the assistant asks What is your CVV number?, the customer (who is new to credit cards) asks what a CVV is. The assistant is designed to handle this possibility, so it switches to a different action that answers the customer's question. It then continues where it left off.

![Example: changing the conversation topic](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/changing-topic-example.gif)

The assistant determines when to change the conversation topic as follows:



1. When the assistant asks a question and receives a response, it first validates the response to see whether it answers the question. In the CVV example, the assistant expects a number as a response.
2. If the input is not recognized as an answer to the question, the assistant then evaluates the input to see whether it matches another action. (Changing the topic cannot switch the conversation to a different assistant.)

If the input does not answer the question, and it does not match any existing action of the assistant, a step validation error results. For more information about validation errors and how they are handled, see [Handling errors in the conversation](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-handle-errors).
3. If the input matches a different action, the assistant switches to the matching action.
[Save entity](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/add_entity_save.png)







 Teaching your assistant about topics to ignore 

It is important to help your assistant stay focused on the types of customer questions and business transactions you have designed it to handle. You can use information collected from real customer conversations to highlight subjects that you do not want your assistant to even attempt to address.

For more information, see [Defining what's irrelevant](https://cloud.ibm.com/docs/assistant?topic=assistant-irrelevance-detection).
Actual cost breakdowns are visible from your Invoices in the IBM Cloud Dashboard. For detailed steps, see the [Billing](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-saas-pricingibp-saas-pricing-billing) section in the Pricing topic.





 Is there a best practice for monitoring my blockchain resources? 

You are responsible for the health monitoring and resource allocation of the blockchain nodes in your Kubernetes cluster. While requests against the nodes are being actively processed, you should be monitoring for spikes in resource consumption to avoid problems. IBM recommends that you configure IBM Cloud Monitoring and set up alerts to track when blockchain nodes are reaching their limits. See the tutorial on [IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started) for more details.

You should be aware that JavaScript and TypeScript smart contracts require more resources than contracts written in Golang. Therefore, when you are allocating resources to your cluster, it is important to ensure adequate resources are available to your smart contract pods when they are deployed on a channel and during transaction processing. The pods containing the smart contracts will consume as much resources as they need to function.
Data that is stored with a cloud database service can be accessed across clusters, zones, and regions. For security-related information, see the database service-specific IBM Cloud documentation.





 Monitoring and logging 

The key to detect malicious attacks in your cluster is the proper monitoring and logging of metrics and all the events that happen in the cluster. Monitoring and logging can also help you understand the cluster capacity and availability of resources for your app so that you can plan accordingly to protect your apps from a downtime.

Does IBM monitor my cluster?
: Every cluster master is continuously monitored by IBM to control and remediate process level Denial-Of-Service (DOS) attacks. IBM Cloud Kubernetes Service automatically scans every node where the master is deployed for vulnerabilities that are found in Kubernetes and OS-specific security fixes. If vulnerabilities are found, IBM Cloud Kubernetes Service automatically applies fixes and resolves vulnerabilities on behalf of the user to ensure master node protection.

What information is logged?
: By default, IBM Cloud Kubernetes Service automatically collects logs for the following cluster components:



* Containers: Logs that are written to STDOUT or STDERR.
* Apps: Logs that are written to a specific path inside your app.
* Workers: Logs from the Ubuntu operating system that are sent to /var/log/syslog and /var/log/auth.log.
* Kubernetes API server: Every cluster-related action that is sent to the Kubernetes API server is logged for auditing reasons, including the time, the user, and the affected resource. For more information, see [Kubernetes audit logs](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/). You can access these logs by using IBM Cloud Activity Tracker. For more information, see the [getting started tutorial](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).
* Ingress: Logs for an Ingress application load balancer (ALB) that manages inbound network traffic.
A message will be displayed indicating that sample lines are sent that can be used to verify your connection.

![Verify your connection](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/streaming-verify.png)









 Step 4. Verify sample data can reach the topic in Event Streams 

To continue, you must verify that sample data can reach the topic in Event Streams.

To verify that sample data is streaming, you can use IBM Cloud Monitoring.



1. Check that you have an instance of Monitoring in the same region as your Event Streams instance. This instance must be configured to collect platform metrics. For more information, see [Enabling platform metrics](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).
2. [Launch the Monitoring UI](https://cloud.ibm.com/docs/monitoring?topic=monitoring-launch).
3. In the Dashboards section, go to Dashboard templates and select the template IBM Event Streams (Enterprise).
4. Create a copy of the template by clicking Create custom dashboard.
5. Edit the panel Topic bytes in per second.

![Edit panel.](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/streaming-topic-metric.png)
6. Customize the metric to see data per topic.

![Customize metric.](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/streaming-topic-metric-1.png)
7.
Voice-of-Customer Analysis [Guardio](https://www.ibm.com/case-studies/guardio-cloud-bullying-detection-application) Helping parents protect children from cyberbullying by flagging and detecting certain messages across social media accounts 
 Data Mining [Bradesco](https://www.ibm.com/watson/stories/bradesco/) Addressing and resolving customer conversations at scale through a trained virtual assistant 
 [Legalmation](https://www.ibm.com/case-studies/legalmation) Detecting citizens' civic concerns with 97% accuracy using IBM Watson 
 Accrete Delivering highly accurate insight into financial markets with artificial intelligence 







 Blogs 



* [How to find new football stars with AI technology](https://www.ibm.com/blogs/client-voices/how-find-new-football-stars-ai/)
* [Buzz Radar Cognitive Command Center makes insights actionable with IBM Watson](https://www.ibm.com/blogs/cloud-computing/2018/05/31/cognitive-command-center-buzz-radar-ibm-watson/)
* [Train Better with NLU Classifications](https://medium.com/ibm-data-ai/train-better-with-nlu-classifications-bd4070173e4)
Monitoring login sessions for trusted profiles 

Trusted profiles are used to automatically grant federated users access to your account, and you can use Activity Tracker to monitor which federated users and compute resources apply a trusted profile.

You can also monitor active user login sessions. For more information, see [Monitoring login sessions](https://cloud.ibm.com/docs/account?topic=account-end-user-sessions).



 Before you begin 

You must create an instance of the Activity Tracker service in the Frankfurt (eu-de) region to monitor events for IAM trusted profiles. For more information, see [Provisioning an instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-provision).





 Reviewing login sessions by using Activity Tracker 

Complete the following steps to review login sessions by using Activity Tracker:



1. In the IBM Cloud console, go to the Navigation menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_hamburger.svg) > Observability > Activity Tracker.
2. Click Open dashboard on the dashboard that you use to monitor trusted profiles.
3. Click Sources and select iam-identity to filter the results and view only IAM Identity login events.
4. Use the search field to view trusted profiles login events for users or to view trusted profiles login events for compute resources.



1. For users, search action:iam-identity.user-authcode OR action:iam-identity.user-identitycookie.login.



* action:iam-identity.user-authcode indicates a login that is initiated by the user.
* action:iam-identity.user-identitycookie.login indicates an authentication that is based on a browser cookie.



2. For compute resources, search action:iam-identity.computeresource-token.login.



5.