Auditing events for watsonx.data

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to track how users and applications interact with the IBM® watsonx.data service in IBM Cloud.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the getting started tutorial for IBM Cloud Activity Tracker.

List of platform events

The following table lists the actions that generate an event:

Table 1. Actions that generate platform events
Action	Description
`lakehouse.lakehouse.create`	An event is generated when you provision a service instance.
`lakehouse.presto.create`	An event is generated when you provision a Presto (Java) group.
`lakehouse.hms.create`	An event is generated when you provision a metastore.
`lakehouse.lakehouse.delete`	An event is generated when a service instance is deleted.
`lakehouse.presto.delete`	An event is generated when a when a Presto (Java) group is deleted.
`lakehouse.hms.delete`	An event is generated when a metastore is deleted.

Events for engines

Table 2. Lists of engine events
Action	Description
`lakehouse.engines.create`	An event is generated when you create an engine.
`lakehouse.engines.get`	An event is generated when you get engines.
`lakehouse.engines.update`	An event is generated when you update an engine.
`lakehouse.engines.delete`	An event is generated when you delete an engine.
`lakehouse.engines.pause`	An event is generated when you pause an engine.
`lakehouse.engines.resume`	An event is generated when you resume an engine.

Events for buckets

Table 3. Lists of bucket events
Action	Description
`lakehouse.buckets.create`	An event is generated when you create a bucket.
`lakehouse.buckets.get`	An event is generated when you get buckets.
`lakehouse.buckets.update`	An event is generated when you update a bucket.
`lakehouse.buckets.delete`	An event is generated when you delete a bucket.
`lakehouse.buckets.activate`	An event is generated when you activate a bucket.

Events for catalogs

Table 1. Lists of catalog events
Action	Description
`lakehouse.catalogs.create`	An event is generated when you create a catalog.
`lakehouse.catalogs.get`	An event is generated when you get catalogs.
`lakehouse.catalogs.update`	An event is generated when you update a catalog.
`lakehouse.catalogs.delete`	An event is generated when you delete a catalog.

Events for databases

Table 4. Lists of database events
Action	Description
`lakehouse.databases.create`	An event is generated when you create a database.
`lakehouse.databases.get`	An event is generated when you get databases.
`lakehouse.databases.update`	An event is generated when you update a database.
`lakehouse.databases.delete`	An event is generated when you delete a database.

Events for authentication

Table 5. Lists of events for authentication
Action	Description
`lakehouse.authtoken.create`	An event is generated when a user logs in.
`lakehouse.authtoken.delete`	An event is generated when a user logs out.

Events for engine users

Table 6. Lists of engine user events
Action	Description
`lakehouse.engineusers.create`	An event is generated when you create an engine user.
`lakehouse.engineusers.update`	An event is generated when you update an engine user.
`lakehouse.engineusers.delete`	An event is generated when you delete an engine user.

Events for bucket users

Table 7. Lists of bucket user events
Action	Description
`lakehouse.bucketusers.create`	An event is generated when you create a bucket user.
`lakehouse.bucketusers.update`	An event is generated when you update a bucket user.
`lakehouse.bucketusers.delete`	An event is generated when you delete a bucket user.

Events for catalog users

Table 8. Lists of catalog user events
Action	Description
`lakehouse.catalogusers.create`	An event is generated when you create a catalog user.
`lakehouse.catalogusers.update`	An event is generated when you update a catalog user.
`lakehouse.catalogusers.delete`	An event is generated when you delete a catalog user.

Events for database connection users

Table 9. Lists of database connection user events
Action	Description
`lakehouse.dbconnusers.create`	An event is generated when you create a database connection user.
`lakehouse.dbconnusers.update`	An event is generated when you update a database connection user.
`lakehouse.dbconnusers.delete`	An event is generated when you delete a database connection user.

Events for metastore users

Table 10. Lists of metastore user events
Action	Description
`lakehouse.metastoreusers.create`	An event is generated when you create a metastore user.
`lakehouse.metastoreusers.update`	An event is generated when you update a metastore user.
`lakehouse.metastoreusers.delete`	An event is generated when you delete a metastore user.

Events for data policy

Table 11. Lists of data policy events
Action	Description
`lakehouse.datapolicy.create`	An event is generated when you create a data policy.
`lakehouse.datapolicy.update`	An event is generated when you update a data policy.
`lakehouse.datapolicy.delete`	An event is generated when you delete a data policy.

Events for Spark

Table 11. Lists of data policy events
Action	Description
`lakehouse.spark_engine.list`	An event that is generated when you list Spark engines.
`lakehouse.spark_engine.create`	An event that is generated when you create a Spark engine.
`lakehouse.spark_engine.update`	An event that is generated when you update the details of a Spark engine.
`lakehouse.spark_engine.delete`	An event that is generated when you delete a Spark engine.
`lakehouse.spark_engine_application.list`	An event that is generated when you list the Spark applications under a Spark engine.
`lakehouse.spark_engine_application.get`	An event that is generated when you get the details of a Spark application.
`lakehouse.spark_engine_application.create`	An event that is generated when you run a Spark application.
`lakehouse.spark_engine_application.delete`	An event that is generated when your stop a running Spark application.
`lakehouse_spark_engine_application.ui`	An event that is generated when you access the Spark UI of an application.
`lakehouse.spark_engine_history_server.get`	An event that is generated when you get the Spark history server details.
`lakehouse.spark_engine_history_server.start`	An event that is generated when you start the Spark history server.
`lakehouse.spark_engine_history_server.stop`	An event that is generated when you stop the Spark history server.
`lakehouse.spark_engine_history_server.ui`	An event that is generated when you access Spark history UI.
`lakehouse.spark_engine_catalog.list`	An event that is generated when you list Spark engine associated catalogs.
`lakehouse.spark_engine_catalog.add`	An event that is generated when catalogs are associated with a Spark engine.
`lakehouse.spark_engine_catalog.remove`	An event that is generated when catalogs are dissociated from a Spark engine.
`lakehouse.spark_engine_catalog.get`	An event that is generated when you get the details of a Spark engine catalog.
`lakehouse.spark_engine_cluster.list`	An event that is generated when you list Spark lab clusters.
`lakehouse.spark_engine_cluster.create`	An event that is generated when you create a Spark lab cluster.
`lakehouse.spark_engine_cluster.get`	An event that is generated when you get the details of a Spark lab cluster.
`lakehouse.spark_engine_cluster.delete`	An event that is generated when you delete a Spark lab cluster.
`lakehouse.spark_engine_cluster.connect`	An event that is generated when you connect with a Spark lab cluster.
`lakehouse.spark_engine.pause`	An event that is generated when you pause a Spark engine.
`lakehouse.spark_engine.resume`	An event that is generated when you resume a Spark engine.
`lakehouse.spark_engine.scale`	An event that is generated when you scale a Spark engine.