Activity tracking events for Sandbox

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.

Account administrators can use IBM Cloud Activity Tracker Event Routing, a platform service, to route auditing events in the account to destinations of their choice by configuring targets and routes that define where activity tracking events are sent. For more information, see About IBM Cloud Activity Tracker Event Routing.

Account administrators can use IBM Cloud Logs to visualize and alert on events that are generated in the account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

Users with trusted profiles may not have access to view Activity Tracker or Logs data. Contact your account administrator for access to auditing information.

Locations where activity tracking events are generated

IBM Cloud Sandbox sends activity tracking events by IBM Cloud Activity Tracker Event Routing in the regions that are indicated in the following table.

Regions where activity tracking events are sent in Americas locations
Dallas ( `us-south` )	Washington ( `us-east` )	Toronto ( `ca-tor` )	Montreal ( `ca-mon` )	Sao Paulo ( `br-sao` )
No	Yes	No	No	No

Regions where activity tracking events are sent in Asia Pacific locations
Tokyo ( `jp-tok` )	Sydney ( `au-syd` )	Osaka ( `jp-osa` )	Chennai ( `in-che` )
No	No	No	No

Regions where activity tracking events are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)
Yes	No	No

Enabling activity tracking events for IBM Cloud Sandbox

No special steps are required. Activity tracking events for IBM Cloud Sandbox are automatically enabled and forwarded to IBM Cloud Logs via IBM Cloud Activity Tracker Event Routing.

Viewing activity tracking events for IBM Cloud Sandbox

Account administrators can use IBM Cloud Logs to visualize and alert on events that are generated in the account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

Users with trusted profiles typically do not have permissions to access IBM Cloud Logs or IBM Cloud Activity Tracker Event Routing data. If you need to view activity tracking events, contact your account administrator.

Launching IBM Cloud Logs

For information on launching the IBM Cloud Logs UI, see Launching the UI in the IBM Cloud Logs documentation.

List of management events

The following table lists the management actions that generate activity tracking events in Sandbox.

Actions that generate management events
Action	Description
`sandbox.invite.create`	Generated when a user submits a request to create a sandbox invitation.
`sandbox.resource.create`	Generated when sandbox resources are provisioned for an approved invite. This is an asynchronous operation.
`sandbox.invite.update`	Generated when a user extends the sandbox trial period for an existing invite.
`sandbox.invite.delete`	Generated when a sandbox invitation is deleted.
`sandbox.configuration.export`	Generated when a user exports the Terraform configuration for a sandbox.
`sandbox.user.create`	Generated when bulk user data is added or updated.

Analyzing IBM Cloud Sandbox activity tracking events

Use the following fields in the CADF event to filter and correlate sandbox events:

Field	Description
`action`	The AT action string (for example, `sandbox.invite.create`). Use this field to filter events by operation type.
`target.id`	The CRN of the sandbox resource on which the action was performed.
`outcome`	The result of the operation: `success`, `failure`, or `pending`. Search for `failure` to identify problems.
`severity`	The criticality of the action: `normal`, `warning`, or `critical`. Search for `critical` to surface security-relevant events such as authorization failures and deletions.
`initiator.id`	The IBMid or Service ID of the entity that initiated the action.
`correlationId`	Links related events together — especially the initial `pending` and final completion events for asynchronous provisioning operations (`sandbox.resource.create`).
`reason.reasonCode`	The HTTP status code of the operation.
`reason.reasonType`	A human-readable reason for the outcome, populated for all `failure` events. Includes detailed IBM IAM authorization deny reasons.