---
name: sandbox-at-events
title: Activity tracking events for Sandbox
description: Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.
last-updated: 2026-05-04
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/sandbox?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Activity tracking events for Sandbox
{: #at_events}

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.
{: shortdesc}

Account administrators can use IBM Cloud Activity Tracker Event Routing, a platform service, to route auditing events in the account to destinations of their choice by configuring targets and routes that define where activity tracking events are sent. For more information, see [About IBM Cloud Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-about&format=markdown).

Account administrators can use IBM Cloud Logs to visualize and alert on events that are generated in the account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

Users with trusted profiles may not have access to view Activity Tracker or Logs data. Contact your account administrator for access to auditing information.
{: note}

## Locations where activity tracking events are generated
{: #at-locations}

IBM Cloud Sandbox sends activity tracking events by IBM Cloud Activity Tracker Event Routing in the regions that are indicated in the following table.

| Dallas ( `us-south` ) | Washington ( `us-east` ) | Toronto ( `ca-tor` ) | Montreal ( `ca-mon` ) | Sao Paulo ( `br-sao` ) |
|---|---|---|---|---|
| [No]{: tag-red} | [Yes]{: tag-green} | [No]{: tag-red} | [No]{: tag-red} | [No]{: tag-red} |
{: caption="Regions where activity tracking events are sent in Americas locations" caption-side="top"}
{: #atracker-table-1}
{: tab-title="Americas"}
{: tab-group="atracker"}
{: class="simple-tab-table"}

| Tokyo ( `jp-tok` ) | Sydney ( `au-syd` ) | Osaka ( `jp-osa` ) | Chennai ( `in-che` ) |
|---|---|---|---|
| [No]{: tag-red} | [No]{: tag-red} | [No]{: tag-red} | [No]{: tag-red} |
{: caption="Regions where activity tracking events are sent in Asia Pacific locations" caption-side="top"}
{: #atracker-table-2}
{: tab-title="Asia Pacific"}
{: tab-group="atracker"}
{: class="simple-tab-table"}

| Frankfurt (`eu-de`) | London (`eu-gb`) | Madrid (`eu-es`) |
|---|---|---|
| [Yes]{: tag-green} | [No]{: tag-red} | [No]{: tag-red} |
{: caption="Regions where activity tracking events are sent in Europe locations" caption-side="top"}
{: #atracker-table-3}
{: tab-title="Europe"}
{: tab-group="atracker"}
{: class="simple-tab-table"}

## Enabling activity tracking events for IBM Cloud Sandbox
{: #at-enable}

No special steps are required. Activity tracking events for IBM Cloud Sandbox are automatically enabled and forwarded to IBM Cloud Logs via IBM Cloud Activity Tracker Event Routing.

## Viewing activity tracking events for IBM Cloud Sandbox
{: #at-viewing}

Account administrators can use IBM Cloud Logs to visualize and alert on events that are generated in the account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

Users with trusted profiles typically do not have permissions to access IBM Cloud Logs or IBM Cloud Activity Tracker Event Routing data. If you need to view activity tracking events, contact your account administrator.
{: important}

### Launching IBM Cloud Logs
{: #log-launch-standalone}

For information on launching the IBM Cloud Logs UI, see [Launching the UI in the IBM Cloud Logs documentation](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-instance-launch&format=markdown).

## List of management events
{: #at_actions}

The following table lists the management actions that generate activity tracking events in Sandbox.

| Action | Description |
|---|---|
| `sandbox.invite.create` | Generated when a user submits a request to create a sandbox invitation. |
| `sandbox.resource.create` | Generated when sandbox resources are provisioned for an approved invite. This is an asynchronous operation. |
| `sandbox.invite.update` | Generated when a user extends the sandbox trial period for an existing invite. |
| `sandbox.invite.delete` | Generated when a sandbox invitation is deleted. |
| `sandbox.configuration.export` | Generated when a user exports the Terraform configuration for a sandbox. |
| `sandbox.user.create` | Generated when bulk user data is added or updated. |
{: caption="Actions that generate management events" caption-side="bottom"}

## Analyzing IBM Cloud Sandbox activity tracking events
{: #at_events_iam_analyze}

Use the following fields in the CADF event to filter and correlate sandbox events:

| Field | Description |
|---|---|
| `action` | The AT action string (for example, `sandbox.invite.create`). Use this field to filter events by operation type. |
| `target.id` | The CRN of the sandbox resource on which the action was performed. |
| `outcome` | The result of the operation: `success`, `failure`, or `pending`. Search for `failure` to identify problems. |
| `severity` | The criticality of the action: `normal`, `warning`, or `critical`. Search for `critical` to surface security-relevant events such as authorization failures and deletions. |
| `initiator.id` | The IBMid or Service ID of the entity that initiated the action. |
| `correlationId` | Links related events together — especially the initial `pending` and final completion events for asynchronous provisioning operations (`sandbox.resource.create`). |
| `reason.reasonCode` | The HTTP status code of the operation. |
| `reason.reasonType` | A human-readable reason for the outcome, populated for all `failure` events. Includes detailed IBM IAM authorization deny reasons. |