--- name: monitoring-provision title: Provisioning an instance description: Before you can monitor and manage metrics, you must provision an instance of the service in IBM Cloud. You can optionally connect an IBM Cloud Security and Compliance Center Workload Protection instance to your IBM Cloud Monitoring instance. last-updated: 2026-06-30 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/monitoring?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Provisioning an instance {: #provision} Before you can monitor and manage metrics, you must provision an instance of the service in IBM Cloud. You can optionally connect an IBM Cloud Security and Compliance Center Workload Protection instance to your IBM Cloud Monitoring instance. {: shortdesc} ## Provisioning an instance from the catalog {: #provision_ui} Provision an IBM Cloud Monitoring instance from the IBM Cloud catalog by completing the following steps: 1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login){: external}. 2. Click **Catalog**. The list of the services that are available on IBM Cloud opens. 3. Filter the list of services by selecting the **Logging and Monitoring** category. 4. Click the **IBM Cloud Monitoring** tile. 5. Select **Create**. 6. Select the location where the IBM Cloud Monitoring is to be created. 7. Select a service plan. By default, the **Lite** plan is set. To provision an instance with the full monitoring funnctionality, select the **Graduated Tier** plan. For more information about the service plans, see [Service plans](https://cloud.ibm.com/docs/monitoring?topic=monitoring-pricing_plans&format=markdown#pricing_plans). 8. In **Configure resource details** enter a name for your instance. 9. Select a resource group. By default, the **Default** resource group is set. 10. Optionally specify any desired [tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui&format=markdown) or [access management tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial&format=markdown). 11. You can have one IBM Cloud Monitoring instance in a region configured to receive [platform metrics](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling&format=markdown). To configure the instance to receive platform metric, set the **Enable platform metrics** switch to on. 12. (Optional) Connect an IBM Cloud Security and Compliance Center Workload Protection instance to your IBM Cloud Monitoring instance. An IBM Cloud Security and Compliance Center Workload Protection instance can be linked to your IBM Cloud Monitoring instance so that a single agent can collect both metrics and security data both provisioned services. To link an IBM Cloud Security and Compliance Center Workload Protection instance to your IBM Cloud Monitoring instance: 1. Set the **Connect a Workload Protection instance** switch to on. 2. If you have an existing IBM Cloud Security and Compliance Center Workload Protection instance you can connect to the existing instance or create a new instance. * To create a new instance: 1. Select **Connect new instance**. 2. To change any of the default details for the new IBM Cloud Security and Compliance Center Workload Protection instance, click **Edit**, make any required changes and click **Save** to save your changes. * To use an existing instance, select **Connect existing instance**. 1. Select **Connect existing instance**. 2. Select the instance to be connected from the list. 13. Confirm that you have read and agreed to the license agreements. 14. Click **Create**. After you provision an instance: * The details for the IBM Cloud Monitoring instance are displayed along with whether or not an IBM Cloud Security and Compliance Center Workload Protection instance is connected. * A service ID is automatically created. You can use this service ID to get the access key for your instance. The name of the service ID has the following format: `{InstanceName}-key-Administrator`. Next, configure a metric source by adding an agent. This agent is responsible for collecting and forwarding metrics to the monitoring instance. ## Provisioning an instance through the CLI {: #provision_cli} To provision an instance through the command line, complete the following steps: 1. [Pre-requisite] [Installation of the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli&format=markdown). If the CLI is installed, continue with the next step. 2. Log in to the region in the IBM Cloud where you want to provision the instance. Run the following command: [ibmcloud login](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli&format=markdown#ibmcloud_login) 3. Set the resource group where you want to provision the instance. Run the following command: [ibmcloud target](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli&format=markdown#ibmcloud_target) By default, the `default` resource group is set. 4. Create the instance. Run the [ibmcloud resource service-instance-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource&format=markdown#ibmcloud_resource_service_instance_create) command: ```text ibmcloud resource service-instance-create NAME sysdig-monitor SERVICE_PLAN_NAME LOCATION -p '{"default_receiver": false,"external_api_auth": "API_AUTH", "workload_protection_connected_instance": "WP_CRN"}' ``` {: pre} Where `NAME` is the name of the instance. `service-name` is the name of the IBM Cloud Monitoring service name in the IBM Cloud. `SERVICE_PLAN_NAME` is the type of plan. See [Service plans](https://cloud.ibm.com/docs/monitoring?topic=monitoring-pricing_plans&format=markdown) to get the plan name. `LOCATION` is the region where the instance is created. `default_receiver` is set to `false` by default. Set to `true` to collect platform metrics automatically through this instance in a region. `API_AUTH` is set to the authorization model that is enabled to authenticate with the IBM Cloud Monitoring service when you use Python scripts or the REST API. Valid values are: `ANY`, and `IAM_ONLY`. `workload_protection_connected_instance` (optional) connects an existing IBM Cloud Security and Compliance Center Workload Protection instance to the IBM Cloud Monitoring instance being created. For more information on connecting instances, see [Can IBM Cloud Monitoring and IBM Cloud Security and Compliance Center Workload Protection be used together?](https://cloud.ibm.com/docs/monitoring?topic=monitoring-faq&format=markdown#faq_4) `WP_CRN`(required when specifying `workload_protection_connected_instance`) the CRN of the IBM Cloud Security and Compliance Center Workload Protection instance to be connected. For example, to provision an instance with the paid plan, run the following command: ```text ibmcloud resource service-instance-create monitoring-instance-01 service-name graduated-tier us-south -p '{"default_receiver": false}' ``` {: pre} To provision an instance with the paid plan that only allows IAM tokens, run the following command: ```text ibmcloud resource service-instance-create monitoring-instance-01 service-name graduated-tier us-south -p '{"default_receiver": false,"external_api_auth": "IAM_ONLY"}' ``` {: pre} 5. Create the service key that connects to the instance [ibmcloud resource service-key-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource&format=markdown#ibmcloud_resource_service_key_create) ```text ibmcloud resource service-key-create NAME ROLE_NAME --instance-name SERVICE_INSTANCE_NAME ``` {: pre} Where `NAME` is the name of your new service key `ROLE_NAME` is either `Administrator`, `Manager`, `Writer`, or `Reader` `SERVICE_INSTANCE_NAME` is the name of the instance you created This will gain you access to the instance's access key.