vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[VMware image protection and vSAN encryption with KYOK](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/byok-vm.svg)

Figure 2. VMware image protection with KYOK







 Using Unified Key Orchestrator for multicloud key orchestration 

You can use Unified Key Orchestrator to securely create and manage your keys and internal keystores across multiple clouds.

Zoom

![Connecting to Unified Key Orchestrator](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/unified-key-orchestrator-v2.svg)

Figure 3. Connecting to Unified Key Orchestrator

The following is a few use cases on how you can use Unified Key Orchestrator to manage your keys.



 Identity and Access Management (IAM) 

With IAM, you can grant and control access to the vault, and therefore the keys and keystores that are assigned to the vault.





 Manage your keys through one user experience 

You can create, manage, and delete your cryptographic keys from one point of control, without dealing with different user interfaces. When you activate a managed key in multiple keystores in a vault, the system keeps the activations in sync. This ensures an efficient and fully audited key lifecycle management.





 Connect to external keystores 

You can connect to external keystores to manage keys in other service instances, such as Microsoft Azure Key Vault, AWS Key Management Service, or Google Cloud Key Management Service.



* To watch a use case video on using Unified Key Orchestrator to manage Azure Key Vault, see [Managing compliance of a Microsoft Office 365 environment using Hyper Protect Crypto Services with Unified Key Orchestrator](https://mediacenter.ibm.com/media/1_1pzzhrb8).
expiration_date The expiration date that you want to assign to the secret. The date format follows [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339). 
 labels[] Labels that you can use to filter for secrets in your instance. Up to 30 labels can be added. 





 Example requests 

Create an arbitrary secret in the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-arbitrary-secret",
"description": "Extended description for my secret.",
"payload": "secret-data",
"labels": [
"dev",
"us-south"
],
"expiration_date": "2030-04-01T09:30:00Z"
}'

Create an arbitrary secret in an existing secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/groups/{group_id}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-arbitrary-secret-in-group",
"description": "Extended description for my secret.",
"payload": "secret-data",
"labels": [
"dev",
"us-south"
],
"expiration_date": "2030-04-01T09:30:00Z"
}'

Create IAM credentials in the default secret group.

curl -X POST "https://{instance_id}.
[Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Events that are generated when you manage IAM policies](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_policies) 
 [Log in to the IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-iamoverviewiamoverview) ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Events that are generated when a user or app logs in to the IBM Cloud](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_login) 
 [Managing platform API keys](https://cloud.ibm.com/docs/account?topic=account-manapikeymanapikey) ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Events that are generated when you manage Platform API keys](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_apikeys) 
 [Managing service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceidsserviceids) !
iam-identity.serviceid-apikey.login An event is generated when an initiator logs in to the IBM Cloud by using an API key that is associated with a service ID. 
 iam-identity.user-identitycookie.login This is an event that is generated when an initiator requests an identity cookie to run an action. 
 iam-identity.user-refreshtoken.login This is an event that is generated when the initiator logs in to IBM Cloud, or when an initiator that is already logged in requests a new refresh token to run an action. 
 iam-identity.user-passcode.loginiam-identity.trustedprofile-apikey.login This is an event that is generated when the initiator logs in to IBM Cloud by applying a trusted profile, or when an initiator that is already logged in by applying a trusted profile requests a new refresh token to run an action. 
 iam-identity.user.logout This is an event that is generated when the initiator logs out of the IBM Cloud. 







 Viewing events 

Events are available in the Frankfurt (eu-de) region.

To view these events, you must [provision an instance](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-provisionprovision) of the IBM Cloud Activity Tracker service in the Frankfurt (eu-de) region. Then, you must [open the IBM Cloud Activity Tracker UI](https://cloud.ibm.com/docs/atracker?topic=atracker-launchlaunch_cloud_ui).





 Analyzing events 



 Login events 

In the IBM Cloud, an administrator, or a user that has the correct access in your account, has different options to manage a user's login settings. For example, an administrator can order external authentication options, enable a one-time passcode to be used during login, enable the use of security questions at login, or set a password expiration time period. For more information, see [Types of multifactor authentication](https://cloud.ibm.com/docs/account?topic=account-types).
The following table shows the IAM event that is generated in each of the log in cases:



Table 1. User login actions

 Type Action Description 

 Service iam-identity.serviceid-apikey.login An event is generated when a service logs in to the IBM Cloud by using an API key that is associated with a service ID. 
 User iam-identity.user-apikey.login An event is generated when a user logs in to the IBM Cloud by using an API key. 
 User iam-identity.user-identitycookie.login An event is generated when a user requests an identity cookie to run an action. 
 User iam-identity.user-refreshtoken.login An event is generated when a user logs in to the IBM Cloud, or when an initiator that has already logged in to the IBM Cloud requests a new refresh token to run an action. 



[Learn more about analyzing IAM events](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-at_events_iamat_events_iam_analyze).
IBM Cloud Activity Tracker events 

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to track how users and applications interact with IBM® Key Protect for IBM Cloud®.

IBM Cloud Activity Tracker records service and user initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

For more information regarding the IBM Cloud Activity Tracker service, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

To determine which Key Protect API requests correlate to the actions below, see [Key Protect API reference doc](https://cloud.ibm.com/apidocs/key-protect).



 Historical information regarding events 



Table 1. Historical reference mapping of event names

 Reference Current event names 

 kms.governance.configread kms.governance-config.read 
 kms.importtoken.create kms.import-token.create 
 kms.importtoken.read kms.import-token.read 
 kms.importtoken.default kms.import-token.request 
 kms.instance.readallowedipport kms.instance-allowed-ip-port.read 
 kms.instance.readipwhitelistport kms.instance-ip-allowlist-port.read 
 kms.instancepolicies.write kms.instance-policies.write 
 kms.instancepolicies.read kms.instance-policies.read 
 kms.instancepolicies.default kms.instance-policies.request 
 kms.keyrings.create kms.key-rings.create 
 kms.keyrings.delete kms.key-rings.delete 
 kms.keyrings.list kms.key-rings.list 
 kms.keyrings.default kms.key-rings.request
Actions that generate service credentials events

 Action Description 

 service_name.key.create An event is generated when an API key is created for a service instance through the Service credentials section of the service instance UI. 
 service_name.key.delete An event is generated when an API key that is associated with a service instance is deleted from the Service credentials section of the service instance UI. 







 Viewing events 

Events are available in the Frankfurt (eu-de) region.

To view these events, you must [provision an instance](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-provisionprovision) of the IBM Cloud Activity Tracker service in the Frankfurt (eu-de) region. Then, you must [open the IBM Cloud Activity Tracker UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launchlaunch_cloud_ui).
Actions that generate service credentials events

 Action Description 

 service_name.key.create An event is generated when an API key is created for a service instance through the Service credentials section of the service instance UI. 
 service_name.key.delete An event is generated when an API key that is associated with a service instance is deleted from the Service credentials section of the service instance UI. 







 Viewing events 

Events are available in the Frankfurt (eu-de) region.

To view these events, you must [provision an instance](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-provisionprovision) of the IBM Cloud Activity Tracker service in the Frankfurt (eu-de) region. Then, you must [open the IBM Cloud Activity Tracker UI](https://cloud.ibm.com/docs/atracker?topic=atracker-launchlaunch_cloud_ui).
Auditing events for Planning Analytics as a Service 

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to track how users and applications interact with the Planning Analytics as a Service service in IBM Cloud.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).



 List of platform events 

The following table lists the actions that generate an event:



Table 1. Actions that generate platform events

 Action Description 

 planning-analytics.instance.create An event is generated when you provision a service instance. 
 planning-analytics.instance.update An event is generated when you rename a service instance or when you change the service plan. 
 planning-analytics.instance.delete An event is generated when a service instance is deleted. 
 planning-analytics.instance.schedule_reclaim An event is generated when a service instance is pending_reclamation. 
 planning-analytics.instance.restore An event is generated when a service instance is restored. 



The following table lists the actions that generate an event for managing service credentials that are associated to a service instance:



Table 2. Actions that generate service credentials events

 Action Description 

 planning-analytics.key.create An event is generated when an API key is created for a service instance through the Service credentials section of the service instance UI. 
 planning-analytics.key.delete An event is generated when an API key that is associated with a service instance is deleted from the Service credentials section of the service instance UI. 







 List of service events 

The following table lists the Planning Analytics as a Service actions that generate an event:



Table 3. Actions that generate service events

 Action Description 

 planning-analytics.user.login An event is generated when a user logs into the Planning Analytics Workspace instance.
planning-analytics.key.delete An event is generated when an API key that is associated with a service instance is deleted from the Service credentials section of the service instance UI. 







 List of service events 

The following table lists the Planning Analytics as a Service actions that generate an event:



Table 3. Actions that generate service events

 Action Description 

 planning-analytics.user.login An event is generated when a user logs into the Planning Analytics Workspace instance. 
 planning-analytics.user.logout An event is generated when a user logs out of the Planning Analytics Workspace instance. 
 planning-analytics.user-environment.switch An event is generated when a user switches to a different Planning Analytics Workspace environment. 







 Viewing events 

Events that are generated by an instance of the Planning Analytics as a Service service are automatically forwarded to the IBM Cloud Activity Tracker service instance that is available in the same location.

IBM Cloud Activity Tracker can have only one instance per location. To view events, you must access the web UI of the IBM Cloud Activity Tracker service in the same location where your service instance is available. For more information, see [Launching the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
Auditing events for service instances 

As a security officer, auditor, or manager, you can use the IBM Cloud Activity Tracker service to track how users and applications interact with the IBM Cloud services.

The IBM Cloud Activity Tracker service records user-initiated activities that change the state of a service in IBM Cloud. To get started monitoring your user's actions, see [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-getting-startedgetting-started).



 Events for provisioning and managing service instances 

The following table lists the actions that generate an event:



Table 1. Actions that generate events

 Action Description 

 service_name.instance.create An event is generated when you provision a service instance. 
 service_name.instance.update An event is generated when you rename a service instance or when you change the service plan. 
 service_name.instance.delete An event is generated when a service instance is deleted. 
 service_name.instance.schedule_reclaim An event is generated when a service instance is pending_reclamation. 
 service_name.instance.restore An event is generated when a service instance is restored. 







 Events for managing aliases that are associated to a service instance 

An alias is a connection between your IAM-managed service within a resource group and an application within an org or a space.

The following table lists the actions that generate an event:



Table 2. Actions that generate events

 Action Description 

 service_name.alias.create An event is generated when an alias for an instance is created. 
 service_name.alias.update An event is generated when an alias for an instance is updated. 
 service_name.alias.delete An event is generated when an alias for an instance is deleted. 







 Events for managing service credentials that are associated to a service instance 

A service credential provides the necessary information to connect an application to a service instance.

The following table lists the actions that generate an event:



Table 3. Actions that generate events

 Action Description 

 service_name.key.create An event is generated when an API key is created for a service instance through the Service credentials section of the service instance UI.
Improve the visibility into user and resource activity in your account by easily identifying the initiator who requested an action, the object on which the action was requested, and the time when the action took place.
* Adhere to standards

Events comply with the Cloud Auditing Data Federation (CADF) standard. Use simple to use keyword-based search to search across your events instead of using custom query languages. Apply the same keyword search to instantly build time series graphs.



Zoom

![Core features offered by the IBM Cloud Activity Tracker service](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/features.png)

Activity Tracker hosted event search UI functionality

For example, you can use the IBM Cloud Activity Tracker events to identify the following information:



* The users who made API calls to cloud services
* The time-stamp when the API calls were made
* The status of the API call
* The criticality of the action
toolchain.pipeline-run.delete Delete the delivery pipeline when a pipeline job run is deleted by the Continuous Delivery service. The delivery pipeline retains a limited number of runs. 







 Viewing events 

Events that are generated by an instance of the Continuous Delivery service are automatically forwarded to the IBM Cloud Activity Tracker service instance that is available in the same location.

IBM Cloud Activity Tracker can have only one instance per location. To view events, you must access the web UI of the IBM Cloud Activity Tracker service in the same location where your service instance is available. For more information, see [Launching the web UI through the IBM Cloud UI](https://cloud.ibm.com/docs/Activity-Tracker-with-LogDNA?topic=Activity-Tracker-with-LogDNA-launch).





 Analyzing events 

When user emails are added to or removed from the authorized users list of a Continuous Delivery service instance in a resource group, Continuous Delivery sends events to IBM Cloud Activity Tracker when either of the following methods are used.



* An administrator manually adds or removes a user email from the Manage tab of the Continuous Delivery service.
* The system automatically adds one or more user emails in response to user-initiated or service-initiated actions with Continuous Delivery toolchains.



The following authorized user events are displayed in IBM Cloud Activity Tracker:



* Continuous Delivery: create auth-user [service name] (auth-user(s): [EMAILS])
* Continuous Delivery: delete auth-user [service name] (auth-user(s): [EMAILS])
* Continuous Delivery: create auth-user [service name] (auth-user(s): [EMAILS]; root-action: [ACTION]; root-action-service-instance: [CRN])
* Continuous Delivery: delete auth-user [service name] (auth-user(s): [EMAILS]; root-action: [ACTION]; root-action-service-instance: [CRN])



Where:



* [EMAILS] is a comma-separated list of the user email IDs that are added to or removed from the list of authorized users.
* [ACTION] identifies the action that prompted the automatic addition or removal of user emails from the list of authorized users.
Auditing events for Continuous Delivery 

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with the IBM Cloud® Continuous Delivery service and toolchain instances in IBM Cloud®.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

Continuous Delivery automatically generates events for specific actions and forwards these event logs to IBM Cloud Activity Tracker. To access these logs, you must [provision an instance of IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-provision).



 Events for Continuous Delivery 

The following table lists the actions that generate Continuous Delivery data events:



Table 1. Actions that generate Continuous Delivery data events

 Action Description 

 continuous-delivery.auth-user.create Manually or automatically add authorized users. For more information about automatically adding authorized users, see [How are users counted for instances of Continuous Delivery in resource groups?](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-limitations_usagehow-are-users-counted-for-instances-of-continuous-delivery-in-resource-groups-) 
 continuous-delivery.auth-user.read View the list of authorized users from the Manage tab of a Continuous Delivery service instance 
 continuous-delivery.auth-user.delete Delete authorized users from the Continuous Delivery service instance 







 Events for toolchains 

The following table lists the actions that generate toolchain management events:



Table 2. Actions that generate toolchain management events

 Action Description 

 toolchain.instance.create Create a toolchain 
 toolchain.instance.update Rename a toolchain.
You can choose from granting permissions for a specific region or for the entire account.

Users with regional scope will be limited to access targets in their authorized region.



Table 2. Required IAM roles

 IAM action IAM Policy scope IAM Roles Description 

 atracker.target.read Region Administrator <br>Editor <br>Viewer <br>Operator Read (view) information about a target 
 atracker.target.create Region Administrator <br>Editor Create a target 
 atracker.target.update Region Administrator <br>Editor Update a target 
 atracker.target.delete Region Administrator <br>Editor Delete a target 
 atracker.target.list Account Administrator <br>Editor <br>Viewer <br>Operator List all targets 







 Authentication options 

To route events to a target, check the options that you can use to authenticate for that target type.



Table 3. Authentication options by target type

 Target Service to Service (S2S) authentication API key 

 cloud_object_storage ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 logdna ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 event_streams ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 







 Validating targets