vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam).

Restrict user access to archived files in the bucket.





 EU supported account 

When you archive logs from the Frankfurt auditing instance to an IBM Cloud Object Storage (COS) bucket, consider the following information:



* When you provision an instance of the COS service, this instance is a global one in your account. It is not region bound.
* You must configure a bucket that complies with the EU-supported and GDPR regulations. For the list of COS EU-supported endpoints, see [EU-supported endpoints](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-eu-managed).

For example, consider the following scenarios:



* For a bucket with regional resiliency, you can create the bucket in the EU-DE location to keep the data in Frankfurt.
* For a bucket with cross region resiliency, you can create the bucket in the eu-geo location. Data is kept within the EU geography across datacenters that are located in Milan, Amsterdam, and Frankfurt.



* You must restrict user access to manage archived log files in these buckets.
* Users are responsible for downloading files to EU-supported locations.







 Monitor archiving through Activity Tracker 

You can use the IBM Cloud® Activity Tracker service to monitor the activity of your IBM Cloud account. You can use this service to investigate for abnormal activity and critical actions, and comply with regulatory audit requirements. In addition, you can be alerted on actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

In COS, you can track management and data events.



* By default, these events are not enabled.
* Management events report actions that change the state of resource configurations, bucket properties, and object properties.
* Data events report actions on buckets, objects, and multi-part objects such as creation, deletion, and access.
* You must configure each bucket to enable management events, or management and data events.
* UI
* CLI
* API







 Managing service keys 

In an IBM Cloud Activity Tracker instance you can create, delete, and view auditing service keys by using the UI. You can also create and view auditing service keys by using the CLI and API.

A service key is a unique code that is passed in an API request to identify the calling application or user.

You must use an auditing service key to complete any of the following tasks:



* Export data programmatically
* Manage views and alerts programmatically by using the Configuration API or Terraform.
* Configure resources such as groups, archiving, keys by using the Configuration API or Terraform.



You can enable a maximum of 20 auditing service keys for each auditing instance.



 Prereqs. Check your IAM permissions to manage service keys 

To generate a new service key or get an existing service key, you need the following roles on the IBM Cloud Activity Tracker:



* Platform role operator, editor or administrator
* Service role Manager



To restrict access to a service key, you need the following role on the IAM Identity Service service:



* Platform role Administrator







 Managing service keys by using the UI 

You can create, delete, and view service keys by using the UI.



 Creating a service key by using the UI 

You must have the manager role for the IBM Cloud Activity Tracker service to complete this step.

For more information, see [service roles](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iamservice).

Complete the following steps to create a service key:



1. [Launch the IBM Cloud Activity Tracker web UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
2. Select the Configuration icon ![Configuration icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/admin.png).
3.
IBM Cloud Activity Tracker events 

IBM® Cloud Foundry is deprecated and no longer supported as of 1 June 2023. For more information, see the [deprecation details](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-deprecationdep_details).

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to track how users and apps interact with IBM® Cloud Foundry.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

The following IBM Cloud Activity Tracker service is available in the IBM Cloud catalog. IBM Cloud Foundry sends events to this service that can be used to monitor IBM Cloud Foundry activity in IBM Cloud.

For more information, see:



* [IBM Cloud® Activity Tracker](https://cloud.ibm.com/docs/Activity-Tracker-with-LogDNA?topic=Activity-Tracker-with-LogDNA-getting-startedgetting-started)





 List of events 

The events that are generated by Cloud Foundry apps to IBM Cloud Activity Tracker are listed in the response area of the GET /v2/events, under the body section. The Type field lists all actions that generate an event. For more information, see [Events API](https://apidocs.cloudfoundry.org/11.2.0/events/list_all_events.html).





 Viewing events 

You can view the IBM Cloud Activity Tracker events that are associated with your Cloud Foundry app by using [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/Activity-Tracker-with-LogDNA?topic=Activity-Tracker-with-LogDNA-getting-startedgetting-started).



 Using IBM Cloud Activity Tracker 

Events that are generated by a Cloud Foundry app are automatically forwarded to the IBM Cloud Activity Tracker service instance that is available in the same location.
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/checkmark-icon.svg) 
 You can define an instance of the Activity Tracker Event Routing Event Search offering as a target. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/checkmark-icon.svg) 
 You can use an API Key to write auditing events into a bucket. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/checkmark-icon.svg) 
 You can configure service to service authorization to write auditing events to a bucket. The bucket can be in the same account where events are generated or in a different account. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/checkmark-icon.svg)
[Logging integration](https://cloud.ibm.com/docs/schematics?topic=schematics-logging-integrationlogging-integration)



* [Launching logging](https://cloud.ibm.com/docs/schematics?topic=schematics-logging-integrationlogging-ui)



[Monitoring integration](https://cloud.ibm.com/docs/schematics?topic=schematics-monitoring-integrationmonitoring-integration)



* [Launching monitoring](https://cloud.ibm.com/docs/schematics?topic=schematics-monitoring-integrationmonitoring-ui)



[Activity tracking integration](https://cloud.ibm.com/docs/schematics?topic=schematics-at-integrationat-integration)



* [Launching activity tracking](https://cloud.ibm.com/docs/schematics?topic=schematics-at-integrationaudit-ui)



[KMS integration for BYOK or KYOK](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integrationkms-integration)



* [Launching key management](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integrationkey-mgt-ui)



* [Prerequisites](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integrationkms-key-prerequisites)
* [Enabling IBM Key Protect through UI](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integrationintegrate-byok-ui)
* [Enabling IBM Key Protect through CLI](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integrationintegrate-byok-cli)









 Managing Agent Beta-1
Maximo Application Suite as a Service (MAS-SaaS)



* 10 minutes
* 2023-06-06



Logging and monitoring[Getting started with Activity Tracker hosted event search offerings](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started-search)Getting started with Activity Tracker hosted event search offerings

Use the IBM Cloud® Activity Tracker service to monitor the activity of your IBM Cloud account. You can use this service to investigate abnormal activity and critical actions, and comply with regulatory audit requirements. In addition, you can be alerted on actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

Activity Tracker hosted event search



* 1 hour
* 2023-01-05



[Enforcing private endpoints to configure Activity Tracker Event Routing resources](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-mng-endpoints)Enforcing private endpoints to configure Activity Tracker Event Routing resources

Use this tutorial to learn how to enforce the use of private endpoints to configure Activity Tracker Event Routing resources in your account.

Activity Tracker hosted event search Activity Tracker Event Routing



* 1 hour
* 2022-05-16



[Configuring Activity Tracker Event Routing by using the V1 API](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-routing)Configuring Activity Tracker Event Routing by using the V1 API

Use Activity Tracker Event Routing to collect auditing events that are generated by services in your IBM Cloud account. The events comply with the Cloud Auditing Data Federation (CADF) standard.

Activity Tracker hosted event search Activity Tracker Event Routing



* 1 hour
* 2022-05-16



[Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellite)Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 







 IBM Cloud service roles 

Use the following table to identify the service roles that you can grant a user to run any of the following service actions when you use Activity Tracker hosted event search offerings:



Table 13. IAM service roles and actions for Activity Tracker hosted event search offerings

 Actions Manager Standard-Member Reader 

 Create and delete ingestion keys ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 
 Create and delete service keys !
You must enable write data events to monitor upload of objects to the bucket.

You must enable read data events to monitor download of objects from the bucket.
* You must have access to view the bucket CRN.
* You must have access to view the service ID CRN value that is associated with the service credential that is used to configure archiving in Activity Tracker.









 Configure an alert to monitor archiving 



 Step 1. Get the service ID 

Complete the following steps to get the service ID that is used to configure archiving in Activity Tracker:



1. From the Navigation menu, select Resource List > Storage.
2. Select the IBM Cloud Object Storage instance where the bucket is available.
3. Select Service credentials.
4. For the service ID that you used to configure archiving, open the details for the Key name. You will see information that is related to the key.
5. Copy the service ID value. This is the last section of the CRN value that is set for the field iam_serviceid_crn.

For example, an iam_serviceid_crn is similar to the following:

"iam_serviceid_crn": "crn:v1:bluemix:public:iam-identity::a/xxxxxxxxx::serviceid:ServiceId-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"

You must copy the section: ServiceId-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx
6. Select Buckets.
7. Select the bucket you are using for archiving.
8. Click the Configuration tab.
9. Copy the Bucket Instance CRN.
10. In the Activity Tracker section make sure the selected service instance is the one you are using. Also make sure Data events is set to read & write.







 Step 2. Define a view to filter the events that report the usage of that service ID 

Complete the following steps to define a view:



1.
globalcatalog-collection.enterprise-settings.list An event is generated when you get a list of the enterprises in an account and their corresponding settings. 







 Events for managing software licenses and entitlements 

The following table lists the actions that generate an event:



Table 8. Actions that generate events related to licenses and entitlements

 Action Description 

 entitlement.entitlement.create An event is generated when an initiator binds a license to an account. 
 entitlement.entitlement.delete An event is generated when an initiator deletes an entitlement. 
 entitlement.entitlement.delete_purge An event is generated when an initiator purges an entitlement. 
 entitlement.entitlement.update An event is generated when an initiator updates an entitlement. 
 entitlement.entitlement.check An event is generated when an initiator uses an entitlement to pull an image from the governed IBM Container Registry. 
 entitlement.entitlement.invalidate An event is generated when an entitlement's license is not valid anymore. 









 Events for managing IAM account settings 

Change to Activity Tracker events that report IAM account setting changes : With immediate effect, you can track changes to IAM account settings by monitoring the iam-identity.accountsettings.update event. This event is now generated by the IAM Identity service. Next time you change an IAM configuration setting, you will get an event with action iam-identity.accountsettings.migrate that informs you that IAM account settings are reported by the IAM Identity service in your account. If you monitor changes to IAM account settings, you might need to migrate your resources to monitor iam-identity.accountsettings.update events.

The following table lists the actions that are generated when an account setting that is controlled from the Manage > Access IAM > Settings dashboard is modified:



Table 9. Actions that generate events when the account settings are changed

 Action Description
Auditing events for Hyper Protect Crypto Services with Unified Key Orchestrator 

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to monitor how users and applications interact with IBM Cloud with Unified Key Orchestrator.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

To enable IBM Cloud Activity Tracker for your Hyper Protect Crypto Services instance, you need to provision an instance of the IBM Cloud Activity Tracker service in the same region where your Hyper Protect Crypto Services instance is located. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

To see which requests correlate to the following actions, check out the [Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko) and [TKE CLI reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugintke-cli-plugin).



 Supported events 



 Key events 

The following table lists the key actions that generate an event.



Table 1. Managed key actions

 Action Description 

 hs-crypto.managed-keys.write Create or update a managed key. 
 hs-crypto.managed-keys.list Get a list of managed keys. 
 hs-crypto.managed-keys.read Retrieve information about a managed key. 
 hs-crypto.managed-keys.delete Delete a managed key. 







 Keystore events 

The following table lists the key actions that generate an event.



Table 2. Target keystore actions

 Action Description 

 hs-crypto.target-keystores.write Create or update a target keystore.
You must enable write data events to monitor upload of objects to the bucket.

You must enable read data events to monitor download of objects from the bucket.
* You must have access to view the bucket CRN.
* You must have access to view the service ID CRN value that is associated with the service credential that is used to configure archiving in Log Analysis.









 Configure an alert to monitor archiving 



 Step 1. Get the service ID 

Complete the following steps to get the service ID that is used to configure archiving in Log Analysis:



1. From the Navigation menu, select Resource List > Storage.
2. Select the IBM Cloud Object Storage instance where the bucket is available.
3. Select Service credentials.
4. For the service ID that you used to configure archiving, open the details for the Key name. You will see information that is related to the key.
5. Copy the service ID value. This is the last section of the CRN value that is set for the field iam_serviceid_crn.

For example, an iam_serviceid_crn is similar to the following:

"iam_serviceid_crn": "crn:v1:bluemix:public:iam-identity::a/xxxxxxxxx::serviceid:ServiceId-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"

You must copy the section: ServiceId-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx
6. Select Buckets.
7. Select the bucket you are using for archiving.
8. Click the Configuration tab.
9. Copy the Bucket Instance CRN.
10. In the Activity Tracker section make sure the selected service instance is the one you are using. Also make sure Data events is set to read & write.







 Step 2. Define a view to filter the events that report the usage of that service ID 

Complete the following steps to define a view:



1.
The following table lists the import token actions that generate an event:



Table 5. Import token actions

 Action Description 

 kms.import-token.create Create an import token 
 kms.import-token.read Retrieve an import token 
 kms.import-token.request Invalid import token request event 







 Registration events 

The corresponding actions to both list registration for any key, or list registration for a specific key generate this event.

The following table lists the registration actions that generate an event:



Table 6. Registration actions

 Action Description 

 kms.registrations.list List registrations for any key 
 kms.registrations.default Invalid registration request event 







 Viewing events 

Events that are generated by an instance of Key Protect are automatically forwarded to the IBM Cloud Activity Tracker instance that is available in the same location.

IBM Cloud Activity Tracker can have only one instance per location. To view events, you must access the web UI of the IBM Cloud Activity Tracker service in the same location where your Key Protect instance is available. For more information, see [Launching the web UI through the IBM Cloud UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-startedgs_step4).



Table 7. IBM Cloud Activity Tracker regions

 Deployment Region IBM Cloud Activity Tracker Region 

 au-syd au-syd 
 br-sao br-sao 
 ca-tor ca-tor 
 eu-de eu-de 
 eu-gb eu-gb 
 jp-osa jp-osa 
 jp-tok jp-tok 
 us-east us-east 
 us-south us-south 







 Analyzing successful events 

Most successful requests have unique requestData and responseData associated with each related event. The following sections describe the data of each Key Protect service action event.

Fields are not guaranteed to appear unless the request is successful.



 Common Fields 

There are some common fields that Key Protect uses outside of the CADF event model to provide more insight into your data.



Table 8. Describes the common fields in IBM Cloud Activity Tracker events for Key Protect service actions.

 Field Description
[Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam).

You will want to restrict user access to archived files in the bucket.





 EU supported account 

When you archive logs from the Frankfurt logging instance to an IBM Cloud Object Storage (COS) bucket, consider the following information:



* When you provision an instance of the COS service, this instance is a global one in your account. It is not region bound.
* You must configure a bucket that complies with the EU-Supported and GDPR regulations. For the list of COS EU-supported endpoints, see [EU-supported endpoints](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-eu-managed).

For example, consider the following scenarios:



* For a bucket with regional resiliency, you can create the bucket in the EU-DE location to keep the data in Frankfurt.
* For a bucket with cross region resiliency, you can create the bucket in the eu-geo location. Data is kept within the EU geography across datacenters that are located in Milan, Amsterdam, and Frankfurt.



* You must restrict user access to manage archived log files in these buckets.
* Users are responsible for downloading files to EU-supported locations.







 Monitor archiving through Activity Tracker 

You can use the IBM Cloud® Activity Tracker service to monitor the activity of your IBM Cloud account. You can use this service to investigate for abnormal activity and critical actions, and comply with regulatory audit requirements. In addition, you can be alerted on actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

In COS, you can track management and data events.



* By default, these events are not enabled.
* Management events report actions that change the state of resource configurations, bucket properties, and object properties.
* Data events report actions on buckets, objects, and multi-part objects such as creation, deletion, and access.
vmware.directorsite-iam.read An event is generated when the OIDC for a VMware Cloud Director site is checked. Monitoring is not enabled yet. 







 Viewing events 

VMware as a Service events are global events. For more information, see [Monitoring global and location-based events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-monitor_eventsmon_def_event_type).

IBM Cloud Activity Tracker can have only one instance per location. To view events, you must access the web UI of the IBM Cloud Activity Tracker service in the same location where your service instance is available. For more information, see [Navigating to the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launchlaunch).