Auditing events for App ID

Monitoring administrative activity

1. Log in to your IBM Cloud account.
2. From the catalog, provision an instance of the Activity Tracker service in the same account and region as your App ID instance.
3. From the Observability > Activity Tracker tab, verify the information for the instance that you created.
4. Click View Open Dashboard and make sure you're on the Everything dashboard. Any events that meet the qualifications for your Activity Tracker payment plan are visible. You can filter your results by tags, sources, apps, or levels. You can also search for specific events or jump to a specific timeframe.

Monitoring runtime activity

1. Log in to your IBM Cloud account.
2. From the catalog, provision an instance of the Activity Tracker service in the same account as your App ID instance.
3. In the App ID dashboard, click Manage authentication > Authentication settings.
4. Scroll to the Runtime Activity panel and toggle the switch to enable tracking of runtime authentication activity. A message displays that notifies you that the feature is enabled and that you are charged differently. For more information, see How does App ID calculate pricing.
5. From the Observability > Activity Tracker tab in the console navigation, verify the information for the instance that you created.
6. Click Open Dashboard. When the dashboard loads, you see an overall view of all the activity in your account. You can use the search operators to filter your results by tags, sources, apps, or levels. You can also search for specific events or jump to a specific timeframe.
7. From the All Apps drop-down, select the instance of App ID that you want to track events for.

Extracting user information from the GUID

An event in the Activity Tracker console contains the following fields.

To find the user information that aligns with the event GUID, use the following steps.

1. In the Credentials tab of the App ID dashboard, copy, and save the information in the apiKey and tenantID fields. The tenant ID should match the ID of the event. If no credentials exist, create a set.

2. Obtain an IAM token for the apiKey by inserting the key into the following command:

   curl -k -X POST \
      --header "Content-Type: application/x-www-form-urlencoded" \
      --header "Accept: application/json" \
      --data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" \
      --data-urlencode "apikey=<apiKey>" \
      "https://iam.cloud.ibm.com/identity/token"
   

3. Copy the IAM token from the access_token field in the response.

4. Select a region. Learn more about the available regions.

5. Insert the IAM token, the tenant ID, and the user ID, into the following command to obtain the user information.

   curl -X GET
   --header 'Accept: application/json'
   --header 'Authorization: Bearer <IAMToken>' \
   'https://<region>.appid.cloud.ibm.com/<tenantID>/cloud_directory/Users/<userID>'
   

   You can also run this command by using the management APIs. Your output would look similar to the following JSON object:

      {
      "displayName": "test test",
      "active": true,
      "userName": "test0001",
      "mfaContext": {},
      "emails": [
      {
         "value": "mytest@yahoo.com",
         "primary": true
      }
      ],
      "meta": {
      "lastLogin": "2018-12-10T16:05:36.665Z",
      "created": "2018-08-21T08:55:50.643Z",
      "location": "/v1/cb967e0d-43c1-454a-968d-0efa24766846/Users/34e1ea6d-cc02-4941-9462-7e9c5a40b360",
      "lastModified": "2018-12-10T16:05:36.675Z",
      "resourceType": "User"
      },
      "schemas": [
      "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "name": {
      "givenName": "test",
      "familyName": "test",
      "formatted": "test test"
      },
      "id": "34e1ea6d-cc02-4941-9462-7e9c5a40b360"
   }
   

Finding user-related events

You can track the events of specific Cloud Directory users in Activity Tracker by using their email. Before you can begin tracking, the email must be mapped to a Cloud Directory GUID.

1. Obtain an IAM token, a tenant ID, and a region as described in the previous section.

2. Insert the IAM token, the tenant ID, and the email into the following command to obtain the user information.

   curl -X GET
   --header 'Accept: application/json'
   --header 'Authorization: Bearer <IAMToken>'
   'https://<region>.appid.cloud.ibm.com/<tenantID>/users?email=<emailAddress>'
   

   The email address must be escaped. For example, myTest%40yahoo.com instead of myTest@yahoo.com.

   Alternatively, you can use the Management APIs. Your output would look similar to the following JSON object:

   {
      "users": [
      {
         "idp": "cloud_directory",
         "id": "1e123399-3499-4a5c-b5a9-93843a91dc80"
      },
      {
         "idp": "cloud_directory",
         "id": "2a7abbe5-0fce-402e-9ddf-265246b415c8"
      }
      ]
   }
   

3. Search for a cloud_directory:id value in the target.name_str field in the Activity Tracker console.