Auditing events for account management

Modify the status of a user

When you modify the status of a user by selecting a user, clicking Edit in the Details section, and changing the User status, you get the following event:

• Event with action user-management.user.update that reports a request in the account to modify the user's properties.

For example, see the action field for the event user-management.user.update:

"action": "user-management.user.update",
"message": "User management service: update user"
"initiator": {
    "id": "IBMid-12345",
    "typeURI": "service/security/account/user",
    "name": "example@ibm.com",
    "host": {
      "agent": "",
      "address": "...",
      "addressType": "IPv4"
    },
    "credential": {
      "type": "token"
    }
  },
  "target": {
    "id": "crn:v1:bluemix:public:user-management:global:a/account1234:::",
    "typeURI": "user-management/user",
    "name": "IBMid-12345",
    "host": {
      "address": "user-management.cloud.ibm.com"
    }
}

Restrict IP addresses

When you configure IP address restrictions from the IP address restrictions section, you get 1 event with action user-management.user-setting.update.

For example, see the requestData field for the event user-management.user-setting.update:

{
    "action": "user-management.user-setting.update",
    "message": "IAM User Management: update user-setting user@company.com",
    "requestData": {
        "totalNumberChanges": 1,
        "update": [
            {
                "ips_added": [
                    {
                        "address": "241.211.116.250",
                        "addressType": "IPv4"
                    },
                    {
                        "address": "89.78.194.127",
                        "addressType": "IPv4"
                    },
                    {
                        "address": "40.190.11.111",
                        "addressType": "IPv4"
                    },
                    {
                        "address": "246.140.117.83",
                        "addressType": "IPv4"
                    },
                ],
                "updateType": "allowed_ip_addresses changes"
            }
        ]

Manage user's login

When you modify information about a user's login from the Manage > Access IAM > Users > User Details section, you get 1 event with action user-management.user-setting.update.

See the sample of the requestData field when the User-managed login property is disabled:

{
    "action": "user-management.user-setting.update",
    "message": "IAM User Management: update user-setting user@company.com",
    "requestData": {
        "totalNumberChanges": 1,
        "update": [
            {
                "initialValue": true,
                "newValue": false,
                "updateType": "self_manage update"
            }
        ]
    }

See the sample of the requestData field when the User one-time passcode authentication property is enabled. The requestData.2FA field is set to true.

{
    "action": "user-management.user-setting.update",
    "message": "IAM User Management: update user-setting user@company.com",
    "requestData": {
        "totalNumberChanges": 1,
        "update": [
            {
                "initialValue": false,
                "newValue": true,
                "updateType": "2FA update"
            },
        ]
    }

See the sample of the requestData field when the Require MFA security questions at login: property is enabled. The requestData.security_questions_setup field is set to true.

{
    "action": "user-management.user-setting.update",
    "message": "IAM User Management: update user-setting user@company.com",
    "requestData": {
        "totalNumberChanges": 1,
        "update": [
            {
                "initialValue": false,
                "newValue": true,
                "updateType": "security_questions_setup update"
            }
        ]
    }

User accepts an account invitation

When a user accepts an account invitation, you get the following event:

• Event with action user-management.user-invitation.accept that reports which user accepted the account invitation.

See the sample of the responseData field when the user accepts the invitation:

    "action": "user-management.user-invitation.accept",
    "message": "IBM User Management: accept user invitation to account Joe Test's Account",
    "responseData": {
        "update": [
            {
                "initialValue": "BSS-3f6af42016b440e087025542cbd9cb91",
                "newValue": "IBMid-663003Z105",
                "updateType": "IAM ID Update during Accept"
            }
        ]
    }

requestData fields

The following table lists requestData fields that you can find in events that are generated when user details are modified from the Users dashboard:

requestData fields

The following table lists the fields that are available through the requestData field in the events with actions billing.account-summary.read, billing.account-summary.download, and billing.account-instances-usage-report.download:

The following table lists the fields that are available through the requestData field in the events with actions billing.account-usage-report.read:

The following table lists the fields that are available through the requestData field in the events with actions billing.enterprise-usage-report.read and billing.enterprise-usage-report.download:

The following table lists the fields that are available through the requestData field in the events with actions billing.enterprise-instances-usage-report.download:

Configuring MFA

When you set on MFA in your account by configuring the Account Login section in the Access (IAM) > Settings dashboard, you get 2 events:

• Event with action billing.account-traits.update that reports the type of MFA that is configured in the account in the requestData.mfa field.
• Event with action billing.account-mfa.set-on that indicates that MFA is enabled in the account.

When you set off MFA, you get the following 2 events:

• Event with action billing.account-traits.update that reports the type of MFA that is configured in the account in the requestData.mfa field.
• Event with action billing.account-mfa.set-off that indicates that MFA is disabled in the account.

For example, see the requestData field for the event billing.account-traits.update:

"action": "billing.account-traits.update",
"message": "Billing service: update account traits",
"requestData": {
    "mfa": "",
    "origin": "BSS"
}

Configuring user list visibility restriction

When you modify the User list visibility restriction IAM account setting in the Manage > Access (IAM) > Settings dashboard, you get 1 event with action billing.account-traits.update.

For example, see the requestData field for the event billing.account-traits.update:

"action": "billing.account-traits.update",
"message": "Billing service: update account traits",
"requestData": {
    "origin": "BSS",
    "team_directory_enabled": false
}

requestData fields

The following table lists requestData fields that you can find in events that are generated when the IAM account settings are modified from the Access (IAM) > Settings dashboard: