vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To view events, you must access the web UI of the Activity Tracker service in the same location where your service instance is available. For more information, see [Launching the web UI through the IBM Cloud UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).





 Analyzing events 

Activity Tracker events contain fields that describe the action that occurred. Values in the requestData and responseData fields are specific to IBM Cloud Shell, and the other fields are common to all Activity Tracker events. For a more information about common fields, see [Event fields](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-event).

When a user opens, configures, or closes a Cloud Shell session, the event that is triggered has an action field set to cloudshell.server.create, cloudshell.server.configure, or cloudshell.server.delete. The event includes the following fields:



* The initiator.name field includes information about the user who interacted with the session.
* The initiator.id field shows the IBMid of the user who interacted with the session.
* The target.id field includes the Cloud Resource Name (CRN) of the Cloud Shell account and server where the session was modified, in the format crn:v1:bluemix:public:cloudshell:<REGION>:a/<ACCOUNT_ID>:<CLOUD_SHELL_SERVER_ID>::



When a session is successfully opened, configured, or closed, the corresponding event that is generated has an outcome that is set to success with a 200 reason.reasonCode. Otherwise, the event has an outcome of failure with the appropriate HTTP status code in reason.reasonCode, and the responseData field contains details about the error.

When an account owner or Cloud Shell administrator updates the Cloud Shell settings, the event that is triggered has an action field set to cloudshell.account-settings.update.
--------------------



 Auditing events for IBM Log Analysis 

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with the IBM Log Analysis service in IBM Cloud®.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

IBM Log Analysis automatically generates events so that you can track activity on your service instance.



 Management events 



 Account settings 



Table 1. Events for account settings actions

 Action Description 

 logdna.account.update This event is generated when an administrator turns on or off a feature for a logging instance. 



The following table lists custom fields that are included in these events:



Table 2. Custom fields for account settings actions

 Custom fields Valid values Description 

 requestData.owneremail xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx@logdna.ibm.com Defines a logging account. 
 requestData.type meta.addrawline Defines a logging administrative feature. 
 requestData.value false <br>true When is set to true, the feature specified in the field requestData.type is enabled. 
 responseData.logdnaId Sample 3a941d8ert Defines the logging ID that is associated with the IBM Log Analysis instance. 







 Archiving 



Table 3. Events for archiving actions

 Action Description 

 logdna.account-archive-setting.configure This event is generated when an administrator turns off archiving for a logging instance. 
 logdna.archive-configuration.update This event is generated when an administrator turns on archiving for a logging instance.
Audit and Accountability (AU) [AU-14 Session Audit](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-14) 
 Identification and Authentication (IA) [IA-2 (1) Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2.1) 







 8. Capture audit events and forward to a SIEM 

Requirement: Capture audit events for actions performed on the components of your service, including IBM Cloud services as well as any software components you install within your deployment. Audit logs should be securely stored, and they should also be forwarded to a security information and event management (SIEM) system.

Purpose & value: It is important to have audit logs to be able to investigate abnormal activity as well to comply with regulatory audit requirements. With a proper audit logging system, you can be automatically alerted to potential problems. This allows you to be proactive and check into potential security issues shortly after they've occurred.

Your software components (whether written by you or a third-party) should be enabled to emit critical management and data events. Many examples are listed in the AU-2 control from the IBM Cloud Framework for Financial Services, including:



* Access, downloading, revisions to confidential information
* Access to or update to any financial transaction data
* Any changes to consumer accounts
* Login/logoff event successes and failures
* etc.



Implementation guidance:



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)



Most Relevant Controls:



Table 8. Related controls for audit logs

 Family Control
vmware-solutions.kmip-key-attributes.retrieve A KMIP key's attributes are retrieved. 
 vmware-solutions.kmip-key.activate A KMIP key is activated. 
 vmware-solutions.kmip-key.revoke A KMIP key is revoked. 
 vmware-solutions.kmip-key.destroy A KMIP key is destroyed. 







 Viewing events 

VMware Shared and vCenter Server events are global events. The KMIP for VMware events are location-based events that are automatically forwarded to the IBM Cloud Activity Tracker service instance that is available in the same location as the KMIP for VMware instance. For more information, see [Monitoring global and location-based events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-monitor_eventsmon_def_event_type).

IBM Cloud Activity Tracker can have only one instance per location. To view events, you must access the web UI of the IBM Cloud Activity Tracker service in the same location where your service instance is available. For more information, see [Navigating to the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launchlaunch).





 Related links 



* [Provisioning an instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-provision)
* [Navigating to the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launchlaunch)
* [KMIP for VMware overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations)
--------------------



 Auditing events for Activity Tracker 

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with the Activity Tracker service in IBM Cloud®.

Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

Activity Tracker automatically generates events so that you can track activity on your service instance.



 Management events 



 Account settings 



Table 6. Events for account settings actions

 Action Description 

 logdnaat.account.update This event is generated when an administrator turns on or off a feature for an auditing instance. 



The following table lists custom fields that are included in these events:



Table 7. Custom fields for account settings actions

 Custom fields Valid values Description 

 requestData.owneremail xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx@logdna.ibm.com Defines an Activity Tracker account. 
 requestData.type meta.addrawline Defines an Activity Tracker administrative feature. 
 requestData.value false <br>true When is set to true, the feature specified in the field requestData.type is enabled. 
 responseData.logdnaId Sample 3a941d8ert Defines the Activity Tracker ID that is associated with the Activity Tracker instance. 







 Archiving 



Table 8. Events for archiving actions

 Action Description 

 logdnaat.account-archive-setting.configure This event is generated when an administrator configures archiving for an auditing instance. 



The following table lists custom fields that are included in these events:



Table 9. Custom fields for archiving actions

 Custom fields Valid values Description
* As a security officer, auditor, or manager, you can use the IBM Cloud Activity Tracker service to monitor the status of your instance and how administrators, users, and applications interact with Hyper Protect Crypto Services. To enable IBM Cloud Activity Tracker for your Hyper Protect Crypto Services instance, you need to provision an instance of IBM Cloud Activity Tracker in the same region where your Hyper Protect Crypto Services instance is located. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).
* Initialize your service instance with the [IBM Hyper Protect Crypto Services Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities) or the [IBM Cloud TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm) so that Hyper Protect Crypto Services can provide key management and data management functions.
* To find out more about programmatically managing your keys, check out the [Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto) or [Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko).
* To find out more about encrypting your data by using the cloud HSM function of Hyper Protect Crypto Services, check out the

[PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref) and [GREP11 API reference doc](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref).
* If you need to delete your service instance, see [Deleting service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instance) for instructions.
The following table outlines the predefined dashboards that you can use to monitor Activity Tracker instances and Log Analysis instances that have the archiving feature configured to an IBM Cloud Object Storage bucket:



Table 5. Predefined dashboard

 Dashboard name Description 

 Archiving bucket Monitor archiving for 1 Activity Tracker hosted event search instance in an account. 
 Archiving overview Monitor archiving across the account. 
 Failures to archive Monitors scenarios where archiving fails. 



To use these dashboards, you must customize them by entering the bucket name and the service ID that is used to authenticate and work with the bucket.

The Archiving bucket dashboard includes graphs that show the log in requests to the bucket, the upload requests, and the partial upload requests. You can drill down into the data and look into the subplots that are defined to get more detailed information.

The Archiving overview dashboard offers different graphs where you can see the buckets that are configured, the Cloud Object Storage instances where buckets are available, and the accounts where buckets are defined. You can drill down into the data and look into the subplots that are defined to get more detailed information.

The Failures to archive dashboard monitors when a credential to upload objects is deleted, and when unauthorized access prevents archiving due to lack of permissions or a request coming from an unauthorized IP address.

If you select a peak in a graph and select Show logs, a view opens and filters out the data to show you the auditing events that match that search criteria as defined in the dashboard.





 Predefined screens 

The following table outlines the predefined screens that you can use to monitor Activity Tracker instances and Log Analysis instances that have the archiving feature configured to an IBM Cloud Object Storage bucket:



Table 6. Predefined screens

 Screen name Description 

 Bucket <BUCKETNAME> View statistics about a single bucket. 
 Archiving overview View statistics about archiving across multiple instances in your account or Enterprise account. 
 Failures to archive View statistics about archiving failures and the errors that cause the failure. 



To use these screens, you must customize them by entering the bucket name and the service ID that is used to authenticate and work with the bucket.
Activity Tracker events 

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with the Discovery service in IBM Cloud®.

IBM Cloud

This information applies only to managed deployments.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).



 List of events 

The following table lists the Discovery actions that generate an event.



Table 1. Actions that generate events

 Action Description 

 discovery.analyze-api.read Process text by using the Analyze API. 
 discovery.autocompletion.read Suggest complete queries based on documents. 
 discovery.collection-notices.read Get notices for a collection. 
 discovery.collection-training-status.read Get the training status of a single-collection training. 
 discovery.collections.read Read collection annotations. 
 discovery.content-miner-csv.create Import a CSV file to a Content Mining project. 
 discovery.content-miner-csv.delete Delete a CSV file from a Content Mining project. 
 discovery.content-miner-csv.read Get a CSV file from a Content Mining project. 
 discovery.content-miner-export.create Create a set of exported documents from a Content Mining project. 
 discovery.content-miner-export.download Download exported documents from a Content Mining project. 
 discovery.content-miner-export.search List sets of exported documents from a Content Mining project. 
 discovery.content-miner-report.create Create a report from a Content Mining project. 
 discovery.content-miner-report.delete Delete a report from a Content Mining project. 
 discovery.content-miner-report.read Get report content from a Content Mining project.
[IBM Blockchain Platform integrations](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/integrations-updated.png)

Figure 2.IBM Cloud Integrations

Access control



* Securely authenticate users and control access to all cloud resources using [IBM Cloud Identity and Access Management (IAM)](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-work_iam).



Monitoring



* Use [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-startedgetting-started) service to troubleshoot logs in real-time, diagnose issues, and identify problems in your Kubernetes cluster on IBM Cloud.
* Use [IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-startedgetting-started) to monitor the activity and the health of services and applications in the Kubernetes cluster on IBM Cloud.
* See this tutorial on how to [Analyze logs and monitor application health with IBM Log Analysis and IBM Cloud Monitoring](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-application-log-analysis).
* The IBM Blockchain Platform peers and orderers are automatically configured to expose a /metrics endpoint that Prometheus can use to scrape a wide variety of blockchain metric data. Read more about using [Prometheus in IBM Cloud](https://cloud.ibm.com/docs/compare-and-comply?topic=compare-and-comply-alerts).



Storage



* Utilize IBM Cloud [File](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-getting-started) or [Block](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-getting-started) storage when blockchain nodes are provisioned.
For more information, see [AnyDB - Microsoft SQL Server](https://cloud.ibm.com/docs/sap?topic=sap-anydb-ms-sql-server) and [Infrastructure certified for SAP](https://cloud.ibm.com/docs/sap?topic=sap-iaas-offerings).
* Primary application server instance (PAS instance) - The global directories of the ASCS instance can be used as the global file system. That means that the host with the ASCS instance is the SAP global host. However, you can also separately install the global directories on any host of your SAP system landscape. You can also use the SAP transport host or the host with the global file system (SAP global host) as your primary application server instance host. Optionally, you can install one or more additional application server instances.
* Additional Application Server (AAS) - You can install one or more additional application server instances for an existing SAP system. Additional application server instances are optional and can be installed on separate hosts.

An additional application server instance can run on:



* The host of any instance of the existing SAP system
* On a dedicated host



* SAP Dialog Instance (DI) / Additional Application Instance (AAS) - Dialog Instance (DI) is an additional application instance on top of the Central Instance (CI). Normally the DI is set up on a different host.

Dialog instance consists of Gateway (GW), Internet Communication Manager (ICM), and Dispatcher Process (Disp) only. The DI has no Message Server and Enqueue Work Process.

DI always starts after the CI starts because the DI depends on CI as the main instance where message server and enqueue server exist. DI is used to balance the load and handle more workload rather than use only the Central Instance. The new name for DI is Additional Application Server (AAS).

Structure:

DI/AAS = GW + ICM + Disp

For more information about configuring and adding a AAS instance in heterogeneous SAP environment, see [SAP Note 680617 - INST: Appl.
Deployment of SAP AnyDB on IBM Cloud is similar to deployments with infrastructure with on-premises data centers. Therefore, use the information that is provided from SAP and the RDBMS providers. For more information, see [SAP AnyDB - SAP ASE](https://cloud.ibm.com/docs/sap?topic=sap-anydb-sap-ase) and [Infrastructure certified for SAP](https://cloud.ibm.com/docs/sap?topic=sap-iaas-offerings).
* Primary application server instance (PAS instance) - The global directories of the ASCS instance can be used as the global file system. That means that the host with the ASCS instance is the SAP global host. However, you can also separately install the global directories on any host of your SAP system landscape. You can also use the SAP transport host or the host with the global file system (SAP global host) as your primary application server instance host. Optionally, you can install one or more additional application server instances.
* Additional Application Server (AAS) - You can install one or more additional application server instances for an existing SAP system. Additional application server instances are optional and can be installed on separate hosts.

An additional application server instance can run on:



* The host of any instance of the existing SAP system
* On a dedicated host



* SAP Dialog Instance (DI) / Additional Application Instance (AAS) - Dialog Instance (DI) is an additional application instance on top of the Central Instance (CI). Normally the DI is set up on a different host.

Dialog instance consists of Gateway (GW), Internet Communication Manager (ICM), and Dispatcher Process (Disp) only. The DI has no Message Server and Enqueue Work Process.

DI always starts after the CI starts because the DI depends on CI as the main instance where message server and enqueue server exist. DI is used to balance the load and handle more workload rather than use only the Central Instance. The new name for DI is Additional Application Server (AAS).

Structure:

DI/AAS = GW + ICM + Disp
About dedicated virtual servers 

The IBM Cloud® infrastructure dedicated host offering is a virtualized, single-tenant, dedicated server. It provides you with maximum control over workload placement and flexible post-provisioning options. You can decide which pre-determined IBM Cloud data center your virtual servers are placed in and can be assured capacity by allocating your hosts directly to your account.

The offering includes the following features:



* Affinity and anti-affinity. You can specify host-to-virtual server and virtual server-to-virtual server relationships that need to remain, which are known as affinity and anti-affinity rules. These rules help you make sure that your workloads are placed based on your workload requirements.
* Post-deployment management. You can migrate virtual servers between dedicated hosts based on your workload requirements.
* Workload visibility. You can view resource consumption—core, RAM, and local storage—for each host, giving you maximum control over your workload management.



You have the choice of two deployment models: dedicated hosts and dedicated instances. Dedicated hosts help with control over workload placement and dedicated instances offer single-tenant isolation.

Dedicated instances do not provide some of the control features offered by dedicated hosts. See the following table for more details.



This table has row and column headers. The row headers identify the control feature. The column headers identify whether the offering offers the control feature. To understand whether the offering offers the control feature, navigate to the row in the table, and find the offering that you are interested in.

 Dedicated virtual server feature Dedicated hosts instances Dedicated instances 

 Single-tenant isolation ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/009f5721283adef7a1874103d11c5b438182c4d7/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/009f5721283adef7a1874103d11c5b438182c4d7/icons/checkmark-icon.svg) 
 Virtual server placement control !