---
name: secrets-manager-at-events
title: Activity tracking events for Secrets Manager
description: IBM Cloud services, such as IBM Cloud® Secrets Manager, generate activity tracking events.
last-updated: 2026-07-02
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/secrets-manager?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Activity tracking events for Secrets Manager
{: #at_events}

IBM Cloud services, such as IBM Cloud® Secrets Manager, generate activity tracking events. 
{: shortdesc}

Audit devices that you can enable with Vault, such as the [`syslog` audit device](https://developer.hashicorp.com/vault/docs/audit/syslog){: external}, are not supported by Secrets Manager.
{: note}

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.

You can use IBM Cloud Logs, a platform service, to route auditing events in your account to destinations of your choice by configuring targets and routes that define where activity tracking events are sent. For more information, see [About IBM Cloud Logs](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-about-cl&format=markdown).

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed to an IBM Cloud Logs instance.

## Locations where activity tracking events are generated
{: #at-locations}

Secrets Manager sends activity tracking events to IBM Cloud Logs in the regions that are indicated in the following tables.

| Dallas (`us-south`) | Washington (`us-east`)  | Toronto (`ca-tor`) | Montreal (`ca-mon`) | Sao Paulo (`br-sao`) |
|---------------------|-------------------------|-------------------|----------------------|----------------------|
| [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} |
{: caption="Regions where activity tracking events are sent in Americas locations" caption-side="top"}
{: #logs-table-1}
{: tab-title="Americas"}
{: tab-group="logs"}
{: class="simple-tab-table"}
{: row-headers}

| Tokyo (`jp-tok`)    | Sydney (`au-syd`) |  Osaka (`jp-osa`) | Chennai - Airtel (`in-che`) | Mumbai - Airtel (`in-mum`) |
|---------------------|------------------|------------------|--------------------|-------------------|
| [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} |
{: caption="Regions where activity tracking events are sent in Asia Pacific locations" caption-side="top"}
{: #logs-table-2}
{: tab-title="Asia Pacific"}
{: tab-group="logs"}
{: class="simple-tab-table"}
{: row-headers}

| Frankfurt (`eu-de`)  | London (`eu-gb`) | Madrid (`eu-es`) |
|---------------------------------------------------------------|---------------------|------------------|
| [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} |
{: caption="Regions where activity tracking events are sent in Europe locations" caption-side="top"}
{: #atracker-table-3}
{: tab-title="Europe"}
{: tab-group="logs"}
{: class="simple-tab-table"}
{: row-headers}

## Viewing activity tracking events for Secrets Manager
{: #at-viewing}

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed to an IBM Cloud Logs instance.

### Launching IBM Cloud Logs from the Observability page
{: #log-launch-standalone}

For information on launching the IBM Cloud Logs UI, see [Launching the UI in the IBM Cloud Logs documentation.](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-instance-launch&format=markdown)

## Analyzing events
{: #at-analyze}

Successful events that are generated by an instance of the Secrets Manager service contain various fields that can help you to identify the initiator, the target resource, and the outcome of each completed action in your instance.

Due to the sensitivity of secrets, when an event is generated because an API call to the Secrets Manager service, the generated event does not include the actual contents of a secret. Sensitive data, such as an API key or password, is replaced with identifying information about the secret only, or it is omitted from generated events altogether.
{: note}

You can create views and alerts from all your Secrets Manager instances, or from a specific instance.  
To target a specific instance, replace `host:secrets-manager` with `app:{INSTANCE_CRN}`.

### Query for finding all create secret actions:
{: #query-all-at}

Run the following query to find all create secret actions.

```sh
host:secrets-manager action:secrets-manager.secret.create
```
{: codeblock}

The action value can be replaced with any other applicable action.
{: note}


### Query for finding unauthorized access attempts
{: #query-specific-at}

To see unauthorized access attempts, run the following query.

```sh
host:secrets-manager reason.reasonType:Unauthorized
```
{: codeblock}

## Understanding generated events
{: #gen-events}

The following events are generated for each category.

### Secrets events
{: #at-actions-secrets}

The following table lists the secret actions that generate an event.

| Action                                           | Description                                                    |
| ------------------------------------------------ | -------------------------------------------------------------- |
| `secrets-manager.secret.create`                  | Create a secret.                                               |
| `secrets-manager.secrets.list`                   | List secrets.                                                  |
| `secrets-manager.secret.read`                    | Get a secret.                                                  |
| `secrets-manager.secret.delete`                  | Delete a secret.                                               |
| `secrets-manager.secret-metadata.read`           | View the metadata of a secret.                                 |
| `secrets-manager.secret-metadata.update`         | Update the metadata of a secret.                               |
| `secrets-manager.secret-action.create`	         | Create a secret action                                         |
| `secrets-manager.secret-versions.list`           | List versions of a secret                                      |
| `secrets-manager.secret-version.create`	         | Create a new secret version                                    |
| `secrets-manager.secret-version.read`	           | Get a secret version                                           |
| `secrets-manager.secret-version-metadata.update` |	Update the metadata of a secret version                       |
| `secrets-manager.secret-version-metadata.read`   |	Get the metadata of a secret version                          |
| `secrets-manager.secret-version-data.delete`     |	Delete the data of a secret version                           |
| `secrets-manager.secret-version-action.create`   |	Create a version action                                       |
{: caption="List of secret events" caption-side="top"}

### Secret groups events
{: #at-actions-secret-groups}

The following table lists the secret group actions that generate an event.

| Action                                | Description                         |
| ------------------------------------- | ----------------------------------- |
| `secrets-manager.secret-group.create` | Create a secret group.              |
| `secrets-manager.secret-groups.list`  | List secret groups.                 |
| `secrets-manager.secret-group.read`   | View the details of a secret group. |
| `secrets-manager.secret-group.update` | Update a secret group.              |
| `secrets-manager.secret-group.delete` | Delete a secret group.              |
{: caption="List of secret group events" caption-side="top"}

### Secret locks events
{: #at-actions-secret-locks}

The following table lists the secret lock actions that generate an event.

| Action                                         | Description                         |
| ---------------------------------------------- | ----------------------------------- |
| `secrets-manager.secret-locks.create`          | Create a secret lock.               |
| `secrets-manager.secret-locks.list`            | List secrets and their locks        |
| `secrets-manager.secret-locks.delete`          | Delete a secret lock.               |
| `secrets-manager.secrets-locks.list`           | List secret locks.                  |
| `secrets-manager.secret-version-locks.create`  | Create secret version locks.        |
| `secrets-manager.secret-version-locks.list`    | List secret version locks.          |
| `secrets-manager.secret-version-locks.delete`  | Delete secret version locks.        |
{: caption="List of secret lock events" caption-side="top"}

### Instance operations events
{: #at-configuration-instance-operations}

The following table lists the instance operation actions that generate an event.

| Action                                     | Description                      |
| ------------------------------------------ | -------------------------------- |
| `secrets-manager.instance.login`           | Log in to Vault.                 |
| `secrets-manager.configuration.create` | Create a new configuration. |
| `secrets-manager.configuration-action.create` | Create a new configuration action. |
| `secrets-manager.configurations.list` | List configurations. |
| `secrets-manager.configuration.read` | View the details of a configuration. |
| `secrets-manager.configuration.update` | Update a configuration. |
| `secrets-manager.configuration.delete` | Delete a configuration. |
| `secrets-manager.endpoints.view`            | Get service instance endpoints.  |
| `secrets-manager.notifications-registration.create` | Create a registration with Event Notifications. | Manager |
| `secrets-manager.notifications-registration.read` | Get Event Notifications registration details. | Reader, SecretsReader, Writer, Manager |
| `secrets-manager.notifications-registration.delete` | Delete an Event Notifications registration. | Manager |
| `secrets-manager.notifications-registration.test` | Send a test event. | Reader, SecretsReader, Writer, Manager |
{: caption="List of instance operation events" caption-side="top"}