---
name: secrets-manager-at-events
title: Activity tracking events for the Vault Dedicated plan
description: IBM Cloud services, such as IBM Cloud® Secrets Manager, generate activity tracking events. For the Vault Dedicated plan, these events are specific to instance management operations.
last-updated: 2026-09-01
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/secrets-manager?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

{:codeblock: .codeblock}
{:screen: .screen}
{:download: .download}
{:external: target="_blank" .external}
{:faq: data-hd-content-type='faq'}
{:gif: data-image-type='gif'}
{:important: .important}
{:note: .note}
{:pre: .pre}
{:tip: .tip}
{:preview: .preview}
{:deprecated: .deprecated}
{:beta: .beta}
{:term: .term}
{:shortdesc: .shortdesc}
{:script: data-hd-video='script'}
{:support: data-reuse='support'}
{:table: .aria-labeledby="caption"}
{:troubleshoot: data-hd-content-type='troubleshoot'}
{:help: data-hd-content-type='help'}
{:tsCauses: .tsCauses}
{:tsResolve: .tsResolve}
{:tsSymptoms: .tsSymptoms}
{:video: .video}
{:step: data-tutorial-type='step'}
{:tutorial: data-hd-content-type='tutorial'}
{:api: .ph data-hd-interface='api'}
{:cli: .ph data-hd-interface='cli'}
{:ui: .ph data-hd-interface='ui'}
{:terraform: .ph data-hd-interface="terraform"}
{:curl: .ph data-hd-programlang='curl'}
{:java: .ph data-hd-programlang='java'}
{:ruby: .ph data-hd-programlang='ruby'}
{:c#: .ph data-hd-programlang='c#'}
{:objectc: .ph data-hd-programlang='Objective C'}
{:python: .ph data-hd-programlang='python'}
{:javascript: .ph data-hd-programlang='javascript'}
{:php: .ph data-hd-programlang='PHP'}
{:swift: .ph data-hd-programlang='swift'}
{:curl: .ph data-hd-programlang='curl'}
{:dotnet-standard: .ph data-hd-programlang='dotnet-standard'}
{:go: .ph data-hd-programlang='go'}
{:unity: .ph data-hd-programlang='unity'}
{:release-note: data-hd-content-type='release-note'}


# Activity tracking events for the Vault Dedicated plan
{: #vault-dedicated-at-events}

IBM Cloud services, such as IBM Cloud® Secrets Manager, generate activity tracking events. For the Vault Dedicated plan, these events are specific to instance management operations.
{: shortdesc}

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.

You can use IBM Cloud Logs, a platform service, to route auditing events in your account to destinations of your choice by configuring targets and routes that define where activity tracking events are sent. For more information, see [About IBM Cloud Logs](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-about-cl&format=markdown).

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed to an IBM Cloud Logs instance.

## Locations where activity tracking events are generated
{: #at-locations}

Vault Dedicated sends activity tracking events to IBM Cloud Logs in the regions that are indicated in the following table.

| Dallas (`us-south`) | Frankfurt (`eu-de`) | Paris (`eu-fr2`) |
|---------------------|---------------------|------------------|
| [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} |
{: caption="Regions where activity tracking events are sent for Vault Dedicated plan" caption-side="bottom"} 

## Viewing activity tracking events for Vault Dedicated
{: #at-viewing}

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed to an IBM Cloud Logs instance.

### Launching IBM Cloud Logs from the Observability page
{: #log-launch-standalone}

For information on launching the IBM Cloud Logs UI, see [Launching the UI in the IBM Cloud Logs documentation.](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-instance-launch&format=markdown)

## Analyzing events
{: #at-analyze}

Successful events that are generated by an instance of the Vault Dedicated plan contain various fields that can help you to identify the initiator, the target resource, and the outcome of each completed action in your instance.

You can create views and alerts from all your Vault Dedicated instances, or from a specific instance.  
To target a specific instance, replace `host:secrets-manager` with `app:{INSTANCE_CRN}`.

### Query for finding all Vault Dedicated actions
{: #query-all-at}

Run the following query to find all Vault Dedicated instance management actions.

```sh
host:secrets-manager action:secrets-manager.instance.read OR action:secrets-manager.admin-token.create OR action:secrets-manager.admin-tokens.delete
```
{: codeblock}

The action value can be replaced with any other applicable action.
{: note}

### Query for finding unauthorized access attempts
{: #query-specific-at}

To see unauthorized access attempts, run the following query.

```sh
host:secrets-manager reason.reasonType:Unauthorized
```
{: codeblock}

## Understanding generated events
{: #gen-events}

The following events are generated for Vault Dedicated instance management operations.

### Instance operations events
{: #at-configuration-instance-operations}

The following table lists the instance operation actions that generate an event.

| Action                                     | Description                      |
| ------------------------------------------ | -------------------------------- |
| `secrets-manager.instance.read` | Read the details of a Vault Dedicated plan instance. |
| `secrets-manager.admin-token.create` | Generate an admin token for initial Vault access. |
| `secrets-manager.admin-tokens.delete` | Revoke active admin tokens for a Vault Dedicated plan instance. |
| `secrets-manager.destination.create` | Create a destination resource for the instance. |
| `secrets-manager.destinations.list` | List destination resources for the instance. |
| `secrets-manager.destination.read` | Read a destination resource for the instance. |
| `secrets-manager.destination.update` | Update a destination resource for the instance. |
| `secrets-manager.destination.delete` | Delete a destination resource for the instance. |
| `secrets-manager.destination.test` | Test reachability for an existing destination resource. |
{: caption="List of instance operation events for Vault Dedicated plan" caption-side="bottom"}