vania-janet/multiturn-rag-retrieval-data huggingface dataset:
iam-groups.rule.delete An event is generated when an initiator deletes a rule from an access group. 
 iam-groups.rules.list An event is generated when an initiator views the rules for an access group. 









 Trusted profiles events 

The following table lists the actions that generate an event:



Table 5. Events that are generated for trusted profiles

 Action Description 

 iam-identity.account-profile.create An event is generated when an initiator creates a trusted profile. 
 iam-identity.account-profile.update An event is generated when an initiator updates a trusted profile. 
 iam-identity.account-profile.delete An event is generated when an initiator deletes a trusted profile. 







 Policy events 

The following table lists the actions that generate an event:



Table 6. Events that are generated for policy actions

 Action Description 

 iam-am.policy.create An event is generated when an initiator adds a policy to a user or access group. 
 iam-am.policy.update An event is generated when an initiator modifies permissions to a policy of a user or access group. 
 iam-am.policy.delete An event is generated when an initiator deletes a policy that is assigned to a user or access group. 







 Service ID events 

The following table lists the actions that generate an event:



Table 7. Events that are generated for service IDs actions

 Action Description 

 iam-identity.account-serviceid.create An event is generated when an initiator creates a service ID. 
 iam-identity.account-serviceid.update An event is generated when an initiator renames a service ID or modifies its description. 
 iam-identity.account-serviceid.delete An event is generated when an initiator deletes a service ID. 







 API key events 

The following table lists the actions that generate an event:



Table 8. Events that are generated for API keys actions

 Action Description 

 iam-identity.user-apikey.create An event is generated when an initiator creates an API key.
[Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Global events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_acc_mgtat_events_acc_mgt_users) 
 [Provisioning](https://cloud.ibm.com/docs/account?topic=account-manage_resource) provisioning ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Global events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_rcat_events_rc) 
 [IBM Cloud® Identity and Access Management](https://cloud.ibm.com/docs/account?topic=account-iamoverview) iam-identity <br>iam-groups <br>iam-am ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Global events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iam) 
 [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started) compliance <br>security-advisor !
service_name.alias.delete An event is generated when an alias for an instance is deleted. 







 Events for managing service credentials that are associated to a service instance 

A service credential provides the necessary information to connect an application to a service instance.

The following table lists the actions that generate an event:



Table 3. Actions that generate events

 Action Description 

 service_name.key.create An event is generated when an API key is created for a service instance through the Service credentials section of the service instance UI. 
 service_name.key.delete An event is generated when an API key that is associated with a service instance is deleted from the Service credentials section of the service instance UI. 







 Events for binding and unbinding a service instance to an app 

The following table lists the actions that generate an event:



Table 4. Actions that generate events

 Action Description 

 service_name.binding.create An event is generated when you bind a service instance to an application. 
 service_name.binding.delete An event is generated when you unbind a service instance from an application. 







 Where to look for the events 

Events are available in the Frankfurt (eu-de) region.

To view these events, you must [provision an instance](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-provisionprovision) of the IBM Cloud Activity Tracker service in the Frankfurt (eu-de) region. Then, you must [open the IBM Cloud Activity Tracker UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launchlaunch_cloud_ui).





 Analyzing events 



 Action service_name.instance.delete 

When a service instance is deleted, consider the following information:



* Other actions are automatically triggered to clean up IAM permissions. These actions remove policies that are configured for users and service IDs in the account to work with the service instance.
* The initiator of these actions is an IBM service ID.
Auditing events for IBM Cloud Shell 

As a security officer, auditor, or manager, you can use the IBM Cloud Activity Tracker service to track how users interact with IBM® Cloud Shell. Cloud Shell automatically generates events that you can analyze in the Activity Tracker service.

Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).



 List of events 

The following table lists actions in IBM Cloud Shell that generate an event.



Table 1. Actions that generate events

 Action Description 

 cloudshell.server.create An event is generated when a new session is created. 
 cloudshell.server.configure An event is generated when a session is configured. This event is generated for configuring new sessions and reconfiguring an existing session. 
 cloudshell.server.delete An event is generated when a session is deleted. 
 cloudshell.account-settings.update An event is generated when Cloud Shell settings are updated for an account. 







 Viewing events 

Events that are generated by Cloud Shell are automatically forwarded to the Activity Tracker service instance that is available in the same location.

Activity Tracker can have only one instance per location. To view events, you must access the web UI of the Activity Tracker service in the same location where your service instance is available. For more information, see [Launching the web UI through the IBM Cloud UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).





 Analyzing events 

Activity Tracker events contain fields that describe the action that occurred. Values in the requestData and responseData fields are specific to IBM Cloud Shell, and the other fields are common to all Activity Tracker events.
To restore a deleted policy, see [Restoring deleted policies by using the API](https://cloud.ibm.com/docs/account?topic=account-iam-audit-policies&interface=apiiam-audit-policies-restore).





 Exporting user access policy reports 

You can export an access policy report for each user in your account if you are the account owner, have the Editor role or higher on the User Management service, or have the Editor role or higher on the IAM Access Management service. The access policy report lists all of the access policies that the user has, including the policies that are associated with access groups that the user is a member of.

Auditing user's access policies ensures that you're using the principle of least privilege. Use the report to determine whether the user is assigned to the appropriate access policies, and take the needed action to reduce the number of access policies.

To export the report, complete the following steps:



1. In the IBM Cloud console, go to Manage > Access(IAM), and select Users.
2. Determine the user that you want to audit and click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Access report.
3. Click Download JSON or Download CSV.







 Listing policies with last permit information by using the API 

List all account policies including last permit information that is sorted by count or last used. The policy metadata can be retrieved by using the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-managementpolicy-data-enrichment).



* Curl
* Java
* Python
* Go
* Node
For more information, see [Assign access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).

When you define a policy, you can indicate the scope of the permissions. You can choose from granting permissions for a specific region or for the entire account.

Users with regional scope will be limited to access targets in their authorized region.



Table 1. IAM actions and the IAM roles that include them.

 IAM action IAM Policy scope IAM Roles Description 

 atracker.target.read Region Administrator <br>Editor <br>Viewer <br>Operator Read (view) information about a target 
 atracker.target.create Region Administrator <br>Editor Create a target 
 atracker.target.update Region Administrator <br>Editor Update a target 
 atracker.target.delete Region Administrator <br>Editor Delete a target 
 atracker.target.list Account Administrator <br>Editor <br>Viewer <br>Operator List all targets 







 Authentication options 

When writing to a COS target you can use the following options to authenticate to an IBM Cloud Object Storage (COS) bucket.



* By configuring service-to-service (S2S) authorization (recommended).
* By providing an API key when configuring the target.



You can configure service-to-service authorization to your COS bucket so you do not need to pass an [API key](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_cos&interface=clicos_apikey) when writing your encrypted data to the COS bucket.





 CLI prerequisites 

Before you use the CLI to manage targets, complete the following steps:



1. [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2.
For more details about token authentication, refer to [Working with token authentication](https://cloud.ibm.com/docs/CDN?topic=CDN-working-with-token-authentication).





 Viewing events 

Activity Tracker events that are generated by an instance of the CDN service are automatically forwarded to the Activity Tracker service instance that is available in the same location. Currently, the Activity Tracker Events for IBM Cloud® CDN service are available only on IBM Cloud - EU-DE(Frankfurt) Region.

[Provision an Activity Tracker instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-provision) if you don't have one. Activity Tracker can have only one instance per location.

To view events, access the web UI of the Activity Tracker service in the same location where your service instance is available. For more information, see [Launching the web UI through the IBM Cloud UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launchlaunch_cloud_ui).

You can apply search and filtering criteria to define the events that are displayed through a [custom view](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-views).
For more information, see [Assign access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).

When you define a policy, you can indicate the scope of the permissions. You can choose from granting permissions for a specific region or for the entire account.

Users with regional scope will be limited to access targets in their authorized region.



Table 1. IAM actions and the IAM roles that include them.

 IAM action IAM Policy scope IAM Roles Description 

 atracker.target.read Region Administrator <br>Editor <br>Viewer <br>Operator Read (view) information about a target 
 atracker.target.create Region Administrator <br>Editor Create a target 
 atracker.target.update Region Administrator <br>Editor Update a target 
 atracker.target.delete Region Administrator <br>Editor Delete a target 
 atracker.target.list Account Administrator <br>Editor <br>Viewer <br>Operator List all targets 







 Authentication options 

When writing to a COS target you can use the following options to authenticate to an IBM Cloud Object Storage (COS) bucket.



* By configuring service-to-service (S2S) authorization (recommended).
* By providing an API key when configuring the target.



You can configure service-to-service authorization to your COS bucket so you do not need to pass an [API key](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_coscos_apikey) when writing your encrypted data to the COS bucket.





 CLI prerequisites 

Before you use the CLI to manage targets, complete the following steps:



1. [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2.
Navigating to the UI 

After you provision an instance of the IBM Cloud Activity Tracker service in the IBM Cloud, you can view, monitor, and manage events through the IBM Cloud Activity Tracker web UI. You can launch the UI from the IBM Cloud UI or directly from a browser.



 Granting IAM policies to a user to launch the web UI 

Note: You must be an administrator of the IBM Cloud Activity Tracker service, an administrator of an IBM Cloud Activity Tracker instance, or have account IAM permissions to grant other users policies.

The following table lists the minimum policy that a user must have to be able to launch the web UI, and view data through the IBM Cloud Activity Tracker web UI:



Table 1. IAM policies

 Role Permission granted 

 Platform role: Viewer Allows the user to view the list of service instances in the Observability dashboard. 
 Service role: Reader Allows the user to view events through the web UI. 



For more information, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iam_view_eventsiam_view_events).





 Launching the UI through the IBM Cloud UI 

You can launch the UI within the context of an IBM Cloud Activity Tracker instance, from the IBM Cloud UI.

Complete the following steps to launch the web UI:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).

After you log in with your user ID and password, the IBM Cloud dashboard opens.
2. Click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/icon_hamburger.svg) > Observability.
3. Select Activity Tracker.

The list of IBM Cloud Activity Tracker instances is displayed.

There is 1 instance per region.
4. Select the instance in the region where you want to view events. Then, click Open Dashboard.
Considerations for using Qiskit Runtime in an organization 

You should understand the following considerations when setting up your environment.



 Auditability 

Activity tracker logs significant actions performed on Qiskit Runtime service instances. Create an instance of Activity Tracker in the region of your Qiskit Runtime instances to get an audit trail of events. Refer to the Qiskit Runtime [Activity Tracker page](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-at_events) for details about the events logged.

This audit log contains the fields initiator_authnName and initiator_authnId, which match the name shown in [Manage → Access (IAM) → Users](https://cloud.ibm.com/iam/users). To view this field, click on the user name, then Details in the IAM ID field.

Zoom

![Example of an Activity Tracker event](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-audit-example.png)

Figure 12. Example of an Activity Tracker event

To capture App ID events, open your App ID instance, then navigate to Manage Authentication -> Authentication settings and enable Runtime Activity.





 Define more fine grained roles 

The actions in the custom roles can be used for more fine grained access control. For example, some users might need full access to work on service instances, while others might only need Read access to service instances, programs, and jobs.

To achieve that, define two different custom roles such as MLreader and MLwriter. Remove all cancel, delete, and update roles from the MLreader custom role, and include all actions in the MLwriter custom role. Next, add the roles to two different access groups accordingly.

When using dynamic rules, that is, when the IDP administrator manages access through custom IDP user attributes, do not use IDP custom user attributes that are substrings of each other.
[Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Global events](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-at_events) 



For example, the following table lists core security actions that send events to IBM Cloud Activity Tracker:



Table 12. List of core security platform services

 Service Activity Tracker hosted event search offering Events 

 [Managing access groups](https://cloud.ibm.com/docs/account?topic=account-groupsgroups) ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Events that are generated when you manage access groups](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_access) 
 [Managing policies](https://cloud.ibm.com/docs/account?topic=account-userrolesuserroles) ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Events that are generated when you manage IAM policies](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_policies) 
 [Log in to the IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-iamoverviewiamoverview) !
<br><br> * Configure streaming of IBM Cloud Monitoring<br><br><br> You can use IBM Cloud Monitoring to push a set of selected metrics to a Kafka service such as IBM® Event Streams for IBM Cloud®. For more information, see [Streaming metrics to a Kafka service](https://cloud.ibm.com/docs/monitoring?topic=monitoring-data_streaming). 







 Streamline access management with identities, groups, and policies 

Use the following checklist to create user and service identities in your accounts. Then, create access and resource groups for organizing users and resources to streamline the access management process. Account owners or users with the administrator role on all [IAM account management services](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uiconsole-iam-services), which includes services such as the user management, access groups, identity service, and more can complete these tasks.



Table 7. Getting started tasks for streamlining access management with identities, groups, and policies

 Task Description 

 <br><br> * Create access groups<br><br><br> Access groups are used to organize a set of users and service IDs into a single entity to enable the assignment of policies to the group instead of assigning the same access multiple times per individual user or service ID. A logical way to assign access to resource groups is by creating one access group per required level of access. Then, each access group is mapped to the needed resource groups. Examples of access groups that you should consider would be Admin and Developer. Check out the [What makes a good access group strategy](https://cloud.ibm.com/docs/account?topic=account-account_setupaccessgroup_strategy) best practices documentation. 
 <br><br> * Configure access groups for Activity Tracker and Log Analysis<br><br><br> You can configure, control, and manage events and logging data that is available to users by configuring groups in the logging instance.
Then, save it in a version control tool.

The report includes a list of users, access groups, and service IDs that have access to the selected resource. You must have the Administrator role on the selected resource to view the report.

You can download the report as CSV or as JSON.

Generate an access report everytime permissions to work with auditing instances change in the account.

You can use terraform to manage IAM permissions. Consider keeping the terraform script up to date with details of all the IAM resources so that you can recover faster in the event of a DR. For more information on using terraform to provision a auditing instance, see [IBM Cloud Provider - Identity and Access Management (IAM)](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs).





* To get the list of instances including all the details, run the following command:

ibmcloud resource service-instances --all-resource-groups --output JSON > instances.json

Get current details everytime a change or a new auditing instance is created in the account. Then, save the file (instances.json) in a version control tool.

Once the export file is generated, do not modify it. Any change to that file will corrupt the file and you will not be able to import it. For more information, see [Export the configuration of resources in a auditing instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-reuse_resource_definitionsrrd_export_config).

You can use terraform to provision auditing instances. Consider keeping the terraform script up to date with details of all the instances so that you can recover faster in the event of a DR. For more information on using terraform to provision a auditing instance, see [Provisioning an instance by using Terraforms](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-terraform-setup).







 Steps to recover a regional disaster 

Complete the following steps to recover IBM Cloud Activity Tracker from a regional disaster:



1. Decide the region where you plan to recover activity.
[Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Events that are generated when you manage Platform API keys](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_apikeys) 
 [Managing service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceidsserviceids) ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Events that are generated when you manage service IDs](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_serviceids) 







 Security services 

The following table lists security Cloud services that send auditing events:



Table 13. List of security services

 Service CRN service name Activity Tracker hosted event search offering Events 

 [IBM Cloud® App ID](https://cloud.ibm.com/docs/appid?topic=appid-getting-started) appid ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Location-based events](https://cloud.ibm.com/docs/appid?topic=appid-at-events)