vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For example, to monitor management events from actions on IBM Cloud Object Storage (COS) buckets, you must create buckets in [(COS) EU-supported locations](https://cloud.ibm.com/docs/services/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-eu-managed).





 Step 4. Working with IBM Cloud services and CF apps 

To monitor activity from IBM Cloud services you must provision these resources in the Frankfurt EU-supported location in the IBM Cloud. Check that the services support EU-supported locations. Notice that most services generate location-based events so the region where they are provisioned define where the auditing events are generated.

Check the list of IBM Cloud resources that automatically collect events and forward them to the IBM Cloud Activity Tracker Event Routing service. See [Cloud services](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-cloud_services) and [Cloud services locations](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-cloud_services_locations&interface=cli).





 Step 5. Restrict user access to view and manage events 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud.

Every user that accesses the IBM Cloud Activity Tracker service in your account must be assigned an access policy with an IAM user role defined. The policy determines what actions the user can perform within the context of the service or instance you select. The allowable actions are customized and defined as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles. [Learn more about the IAM user roles for the IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iamservice).

You might have users across different geographies. However, to comply with EU law, only EU personnel can see and access log data from your EU-supported infrastructure, apps, and services.
<br>IBM is responsible for the security and compliance of the Activity Tracker Event Routing feature. Restrict access to Activity Tracker Event Routing and supported destinations such as Cloud Object Storage resources by using Cloud IAM access policies. Define IAM policies to control which users within your account have access to manage the service and related resources in your account. <br>[Learn more about controlling access through IAM](https://cloud.ibm.com/docs/atracker?topic=atracker-iam). 
 Validate targets for Activity Tracker Event Routing Provide the ability to check if the credentials that are used by Activity Tracker Event Routing are valid and allow uploading of objects to the bucket or routing of events to an [Configure 1 or more targets](https://cloud.ibm.com/docs/atracker?topic=atracker-atracker-resources&interface=cliatracker-resources-targets) with valid credentials to store auditing events. [Validate the credentials](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_cos&interface=clitarget-validate-cli-cos) that are used by Activity Tracker Event Routing. 







 Security and regulation compliance 



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Encrypt data Encrypt data in motion and at rest per compliance specifications. When using a cloud_object_storage target, ensure encryption of auditing data by configuring a COS bucket that has full control over the data encryption keys that are used. [IBM Cloud® Object Storage provides several options to encrypt your data.](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-encryption) 
 Meet security and compliance objectives Maintain controls that are commensurate to various industry compliance standards such the Financial Services specification. Set up and maintain security and regulation compliance for your apps and data. 







 Disaster recovery 



Table 5. Responsibilities for disaster recovery

 Task IBM Responsibilities Your Responsibilities 

 Restore functionality for Activity Tracker Event Routing Automatically recover and restart Activity Tracker Event Routing components after any disaster event.
To obtain the Cloud Identity and Access Management ID of an Cloud Identity and Access Management (IAM) service ID, the IBM Cloud CLI can be used.

ibmcloud iam service-id ServiceId-12345678-aaaa-bbbb-cccc-1234567890ab --output json

See the following example output:

{

    "active":true,

    "jti":"...",

    "iam_id":"iam-ServiceId-12345678-aaaa-bbbb-cccc-1234567890ab",

    "realmId":"iam",

     ....

}





 Mapping quotas onto an IBM Event Streams Enterprise cluster 

The Kafka API quotas are per-broker, however Enterprise plan capacity is described as a [per-cluster throughput](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-kafka_quotasenterprise_throughput). Therefore, if you want to limit a user to 10 MB/s in total, you apply a quota of 10/n MB/s to each broker (where n is the number of brokers in the cluster).

To find the number of brokers in a cluster, you can use the KafkaAdminClient.describeCluster call.

For more information, see the [Java documentation](https://kafka.apache.org/32/javadoc/org/apache/kafka/clients/admin/KafkaAdminClient.htmldescribeClusterorg.apache.kafka.clients.admin.DescribeClusterOptions).

The number of brokers can also be found by using the kafka-configs.sh shell script bundled in the Apache Kafka distribution.

bin/kafka-configs.sh --command-config command-config.properties --bootstrap-server "kafka-0.blah.cloud:9093" --describe --entity-type brokers





 Event Streams authorization
Access groups and trusted profiles can be used separately or hand-in-hand for user and access management, depending on your organization's needs.

For example, for the CustApp project, you might choose to create an IAM Admin trusted profile with the following policies:



* Administrator for access groups CustApp-Dev/Test/Prod. This way, the administrator can grant and revoke access to users by adding them to and removing them from access groups.
* Administrator for IAM Identity account management service. This way, the administrator can manage service IDs, trusted profiles, rules, and so on.
* Editor for User Management account management service. This way, the administrator can invite users to the account, view users in account, and so on.



With this trusted profile, the administrator can add developers to an access group with broad access policies to complete day-to-day actions and tasks in the development and test environments. Access for operations on the production environment can be set up in a trusted profile named Operator-Profile. This way, the developer can change job roles by logging in and applying the Operator-Profile when they need to take any operation actions on the CustApp in production.

If you have administrator access through a trusted profile, it is not recommended to invite users to an account while the profile is applied. Users should be invited by true account owners or administrators, or an error might occur.





 Use cases for organizing resources and assigning access 

Review the following use cases to help you prepare a plan that works for your organization. For each use case, it is recommended to use either access groups or trusted profiles to provide access to a group of users while maintaining a minimal number of access policies. By using access groups, you can simply add or remove users in your account from the access groups to assign or revoke access as needed. By using trusted profiles, you can easily update the conditions by which federated users from your corporate user directory are allowed to apply trusted profiles without having to invite them to the account or assign individual access to each user.



 Multiple users working together on a single project by using access groups 

Some of the users in your account need to manage the account and assign other users access. Some users need to create service instances that incur expenses.
You can select the assistant as the data source, and then filter the metrics by the appropriate dates to see only log data that was generated by the assistant while it was using the skill version.





 Show deployment IDs explained 

Applications that use the older v1 runtime API must specify a deployment ID in each messages sent using the /message API. This ID identifies the deployed app that the call was made from. The Analytics page can use this deployment ID to retrieve and display logs that are associated with a specific live application.

For assistants or custom apps that use the v2 version of the API, your assistant automatically includes an assistant ID with each /message call, so you can choose a data source by assistant name instead of using a deployment ID.

To add the deployment ID, v1 API users include the deployment property inside the metadata of the [context](https://cloud.ibm.com/apidocs/assistant/assistant-v1?curl=message), as in this example:

"context" : {
"metadata" : {
"deployment": "HelpDesk-Production"
}
}

For an Enterprise with Data Isolation plan, you can ask IBM to configure your instances to allow you to access log data from deployed applications across different instances. Each instance must the v1 API and specify a deployment ID with each /message call. (If your instances use the v2 API, you cannot get log data from across different instances.)

If log sharing is enabled, only someone with Manager service access to the current instance can view logs. The person can view logs from all of the instances that are being shared. Logs from across all of the participating instances are displayed, regardless of the current user's service level access to the other instances. Similarly, when someone with Manager service access to an instance sends a GET request to the v1 /logs API endpoint, logs from all instances that participate in log sharing are returned, regardless of the user's service level access to each instance.







 Making training data improvements 

Use insights from real user conversations to correct the model associated with your dialog skill.

If you use data from another data source, any improvements you make to the model are applied to the current dialog skill only.
IA-4 (c) <br><br> * IBM Cloud assigns identifiers that identify individuals, groups, roles, and devices<br> * Check whether Virtual Servers for VPC instances are identifable by the workload they are running based on the Auto Scale for VPC instance group definition<br> * Check whether Application Load Balancer for VPC has application port of the workload that is identifiable by the Auto Scale for VPC instance group definition<br> * IBMid selects and assigns identifiers that identify individuals<br> * Check whether Application Load Balancer for VPC has subnet identifiers of the workload that are identifiable by the Auto Scale for VPC instance group definition<br><br><br> 
 IA-4 (d) <br><br> * IBM Cloud prevents reuse of identifiers<br><br><br> 







 NIST supplemental guidance 

Common device identifiers include, for example, media access control (MAC), Internet protocol (IP) addresses, or device-unique token identifiers. Management of individual identifiers is not applicable to shared information system accounts (e.g., guest and anonymous accounts). Typically, individual identifiers are the user names of the information system accounts assigned to those individuals. In such instances, the account management activities of AC-2 use account names provided by IA-4. This control also addresses individual identifiers not necessarily associated with information system accounts (e.g., identifiers used in physical security control databases accessed by badge reader systems for access to information systems). Preventing reuse of identifiers implies preventing the assignment of previously used individual, group, role, or device identifiers to different individuals, groups, roles, or devices.
Managing IAM access for watsonx.data 

IBM Cloud® Identity and Access Management (IAM) controls access to IBM® watsonx.data service instances for users in your account. Every user that accesses the watsonx.data service in your account must be assigned an access policy with an IAM role.

Review the following roles, actions, and more to help determine the best way to assign access to watsonx.data.

The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. After you define the scope of the access policy, you assign a role.

Platform management roles enable users to perform tasks on service resources at the platform level. For more information about platform management roles, see [Platform management roles](https://cloud.ibm.com/docs/account?topic=account-userrolesplatformroles). For more information about IAM access, see [IAM access](https://cloud.ibm.com/docs/account?topic=account-userroles).

The following table describes the privileges that you can assign to platform management roles and associated permissions for watsonx.data service:



  watsonx.data formation 



Table 1. Roles and privileges for watsonx.data formation

 Privileges                               Administrator  User 

 Create Presto engine                     Y              N    
 Delete Presto engine                     Y              N    
 Restart the internal HMS                 Y              N    
 Scale the Presto engines                 Y              N    
 Scale the internal HMS                   Y              N    
 Unregister own or an external bucket     Y              N    
 Unregister any database                  Y              N    
 Activate catloged buckets (restart HMS)  Y              N    
 Register own buckets                     Y              Y    
 Unregister own buckets                   Y              Y    
 Register own databases                   Y              Y    
 Unregister own databases                 Y              Y
To view these events, you must [provision an instance](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-provisionprovision) of the IBM Cloud Activity Tracker service in the Frankfurt (eu-de) region. Then, you must [open the IBM Cloud Activity Tracker UI](https://cloud.ibm.com/docs/atracker?topic=atracker-launchlaunch_cloud_ui).





 Analyzing events 



 Catalog events 

You can find the value unavailable in catalog events. This value indicates when an update is made, but specific details about the update aren't included.





 User management events 

This section explains events that are generated when you manage users from the Manage > Access IAM > Users dashboard.

When you analyze user management events, target.name is set to the user ID of the user on which the action is requested.



 Modify the status of a user 

When you modify information about the user status from the User Details section, you get the following 2 events:



* Event with action user-management.user.update that reports a request in the account to modify the user's properties.
* Event with action user-management.user-setting.update that indicates the values of the user's properties after the update request completes.



Depending on the request, you might get additional events with action user-management.user-setting.update. If your account is a Lite one, you only get 1 event with action user-management.user.update.

For example, see the requestData field for the event user-management.user-setting.update:

"action": "user-management.user-setting.update",
"message": "User management service: update user settings",
"requestData": {
"2FA": false,
"allowed_ip_addresses": "",
"iam_id": "IBMid-xxxxxxx",
"origin": "BSS",
"security_questions_setup": false
}





 Restrict IP addresses
Then, save it in a version control tool.

The report includes a list of users, access groups, and service IDs that have access to the selected resource. You must have the Administrator role on the selected resource to view the report.

You can download the report as CSV or as JSON.

Generate an access report everytime permissions to work with logging instances change in the account.

You can use terraform to manage IAM permissions. Consider keeping the terraform script up to date with details of all the IAM resources so that you can recover faster in the event of a DR. For more information on using terraform to provision a logging instance, see [IBM Cloud Provider - Identity and Access Management (IAM)](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs).
* To get the list of instances including all the details, you can run the following command:

ibmcloud resource service-instances --all-resource-groups --output JSON > instances.json

Get current details everytime a change or a new logging instance is created in the account. Then, save the file you saved (instances.json) in a version control tool.

Once the export file is generated, do not modify it. Any change to that file will corrupt the file and you will not be able to import it. For more information, see [Export the configuration of resources in a logging instance](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-reuse_resource_definitions).

You can use terraform to provision logging instances. Consider keeping the terraform script up to date with details of all the instances so that you can recover faster in the event of a DR. For more information on using terraform to provision a logging instance, see [Provisioning an instance by using Terraforms](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-terraform-setup).
* To get the logging agent configuration information, including its version, export the logging agent yaml file for each agent that you have deployed and save it in a version control tool.
For more information, see [Managing your data in Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-mng-data). 
 Event Streams Activity Tracker Event Routing routes customer data to Event Streams by using a private connection. All data is encrypted in transit and at rest. For more information, see [Managing your data in Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-mng-data). 
 IBM Cloud Platform To authenticate requests to the service and authorize user actions, Activity Tracker Event Routing implements platform and service access roles in Cloud Identity and Access Management (IAM). For more information about required IAM permissions to work with the service, see [Managing access for Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-iam). Connections from Activity Tracker Event Routing to IAM do not use private connections. 
 IBM Cloud Databases for PostgreSQL Activity Tracker Event Routing uses IBM Cloud Databases for PostgreSQL for storing metadata. 







 Workload isolation 

Each regional deployment serves multiple tenants that are identified by the IBM Cloud account ID.



* There is 1 deployment per region that is responsible for running user workloads in the region.
* In a region, the deployment is highly available.
* The data that is collected is associated with the IBM Cloud account ID and not visible to the other users by virtue of this association.
* Data for all tenants is co-located in the same data stores and segmented by the tenant-specific IBM Cloud account ID to enforce access control policies.
* You can use IBM Cloud Identity and Access Management (IAM) to control which users see, create, use, and manage resources.
Therefore, you need an IAM policy for the IBM Log Analysis service with the platform role Editor.

Complete the following steps to assign a user editor role to the IBM Log Analysis service within the context of a resource group:



1. From the menu bar, click Manage > Access (IAM), and then select Users.
2. From the row for the user that you want to assign access, select the Actions menu, and then click Assign access.
3. Select Assign access within a resource group.
4. Select a resource group.
5. If the user does not have a role that is already granted for the selected resource group, choose a role for the Assign access to a resource group field.

Depending on the role that you select, the user can view the resource group on their dashboard, edit the resource group name, or manage user access to the group.

You can select No access, if you want the user to have access only to the IBM Log Analysis service in the resource group.
6. Select IBM Log Analysis.
7. Select the platform role Editor.
8. Click Assign.







 Granting permissions to manage logs and configure alerts 

As an IBM Log Analysis admin user, you must have permissions to run the following actions:



* Add logging log sources
* View logs
* Search logs
* Filter logs
* Configure alerts



Therefore, you need the following policies:



* An IAM policy for the IBM Log Analysis service with the platform role Editor. This policy grants permissions to view the service instance details through the command line and in the IBM Cloud dashboard.
* An IAM policy for the IBM Log Analysis service with the service role Manager. This policy grants permissions to monitor, filter and search log, and define alerts through the logging web UI.



Note: As an administrator of the service, when you grant a user these policies, consider doing it within the context of a resource group. An IBM Log Analysis instance is provisioned within the context of a resource group. Therefore, grant access permissions within the context of the resource group.
crn:v1:bluemix:public:iam::::role:Operator 
 Editor View, create, update, and delete Activity Tracker Event Routing resources. crn:v1:bluemix:public:iam::::role:Editor 
 Administrator View, create, update, and delete Activity Tracker Event Routing resources.<br><br>Assign access policies to manage Activity Tracker Event Routing resources to other users in the account. crn:v1:bluemix:public:iam::::role:Administrator 









 Account management service names 

If you are assigning access by using the CLI or API, the account management services use the following attributes and values:



Table 1. Account management service names

 Account management service Attribute and value 

 All Account Management services serviceType=platform_service 
 All IAM Account Management services service_group_id=IAM 
 Billing serviceName=billing 
 Catalog management serviceName=globalcatalog-collection 
 Context-based restrictions serviceName=context-based-restrictions 
 Enterprise serviceName=enterprise 
 Global catalog serviceName=globalcatalog 
 IAM Access Groups service serviceName=iam-groups 
 IAM Identity service serviceName=iam-identity 
 IBM Cloud Shell serviceName=cloudshell 
 License and entitlement serviceName=entitlement 
 Projects serviceName=project 
 Role management serviceName=iam-access-management 
 Security and Compliance Center serviceName=security-compliance 
 Support center serviceName=support 
 User management serviceName=user-management 







 Assigning access by using the CLI 

To assign access, run the user-policy-create command. For more information, see [ibmcloud iam user-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_user_policy_create). The following example command assigns a policy with the User API key creator role for the IAM Identity account management service.

ibmcloud iam user-policy-create name@example.com --roles "User API key creator" --service-name iam-identity