Supported regions and endpoints for Workload Protection
A list of supported regions and endpoints for the IBM Cloud Security and Compliance Center Workload Protection service.
Regions
The IBM Cloud Security and Compliance Center Workload Protection service is available in the following regions:
This image is an artistic representation and does not reflect actual political or geographic boundaries.
You can create IBM Cloud Security and Compliance Center Workload Protection resources in one of the supported IBM Cloud locations, which represent the geographic area where your IBM Cloud Security and Compliance Center Workload Protection requests are handled and processed.
The following table lists the locations where the service is available:
| Geography | Region | EU-Supported | HA Status |
|---|---|---|---|
Asia Pacific |
Sydney (au-syd) |
N/A |
MZR |
Asia Pacific |
Osaka (jp-osa) |
N/A |
N/A |
Asia Pacific |
Tokyo (jp-tok) |
N/A |
MZR |
Europe |
Frankfurt (eu-de) (*) |
YES |
MZR |
Europe |
London (eu-gb) |
NO |
MZR |
North America |
Dallas (us-south) |
N/A |
MZR |
North America |
Washington (us-east) |
N/A |
MZR |
North America |
Toronto (ca-tor) |
N/A |
MZR |
South America |
Sao Paulo (br-sao) |
N/A |
MZR |
- Geography
- A geographic area or larger political body that contains one or more regions.
- Region
- A defined geographic territory. A region might be a specific postal code area, a town, a city, a state, a group of states, or even a group of countries.
- N/A
- Feature that is not applicable to that geography.
(*) For more information, see Enabling EU support for your account.
Endpoints
A list of supported public and private endpoints for the IBM Cloud Security and Compliance Center Workload Protection service.
Web UI endpoints
To access the IBM Cloud Security and Compliance Center Workload Protection web UI, you might need to define a firewall rule in your host.
(*) Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses
in the allowlist as well. A notification will be sent before the current IP addresses are deprecated.
The following table lists the endpoints that are available for each region:
| Region | Web UI endpoint | Public IP addresses | Ports |
|---|---|---|---|
Dallas (US-South) |
https://us-south.security-compliance-secure.cloud.ibm.com |
169.60.151.174 169.46.0.70 169.48.214.70 67.18.89.114 (*)52.116.136.3 (*) |
https (TLS) 443 |
Frankfurt (EU-DE) |
https://eu-de.security-compliance-secure.cloud.ibm.com |
149.81.77.78 161.156.102.206 159.122.102.38 149.81.37.2 (*)161.156.163.158 (*) |
https (TLS) 443 |
London (EU-GB) |
https://eu-gb.security-compliance-secure.cloud.ibm.com |
158.175.98.206 141.125.73.118 159.122.210.174 141.125.160.111 (*)158.176.193.118 (*) |
https (TLS) 443 |
Madrid (EU-ES) |
https://eu-es.security-compliance-secure.cloud.ibm.com |
13.120.68.187 13.121.68.91 13.122.68.140 13.120.91.150 (*)13.122.87.103 (*) |
https (TLS) 443 |
Osaka (JP-OSA) |
https://jp-osa.security-compliance-secure.cloud.ibm.com |
163.68.67.98 163.69.66.170 163.73.67.180 163.69.80.155 (*)163.73.94.97 (*) |
https (TLS) 443 |
Sao Paulo (BR-SAO) |
https://br-sao.security-compliance-secure.cloud.ibm.com |
163.107.66.98 163.109.67.242 169.57.141.43 163.107.86.152 (*)13.116.91.147 (*) |
https (TLS) 443 |
Sydney (AU-SYD) |
https://au-syd.security-compliance-secure.cloud.ibm.com |
135.90.73.100 130.198.80.155 168.1.213.78 130.198.13.211 (*)135.90.142.144 (*) |
https (TLS) 443 |
Tokyo (JP-TOK) |
https://jp-tok.security-compliance-secure.cloud.ibm.com |
165.192.84.14 128.168.75.14 169.56.51.238 128.168.129.91 (*)162.133.138.52 (*) |
https (TLS) 443 |
Toronto (CA-TOR) |
https://ca-tor.security-compliance-secure.cloud.ibm.com |
163.74.69.186 158.85.94.130 163.75.65.237 163.74.85.210 (*)163.75.89.127 (*) |
https (TLS) 443 |
Washington (US-East) |
https://us-east.security-compliance-secure.cloud.ibm.com |
169.60.112.74 169.55.109.114 169.62.3.82 169.63.183.79 (*)52.117.125.244 (*) |
https (TLS) 443 |
REST API endpoints
To make API calls, you might need to define a firewall rule in your host.
(*) Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses
in the allowlist as well. A notification will be sent before the current IP addresses are deprecated.
Private REST API endpoints
The following table lists the private REST API endpoints that are available for each region:
| Region | Private REST API endpoint | Private IP addresses |
|---|---|---|
Dallas (US-South) |
https://private.us-south.security-compliance-secure.cloud.ibm.com/api |
166.9.228.45 166.9.229.45 166.9.230.44 166.9.228.235 (*)166.9.229.31 (*)166.9.251.30 (*) |
Frankfurt (EU-DE) |
https://private.eu-de.security-compliance-secure.cloud.ibm.com/api |
166.9.248.88 166.9.248.120 166.9.248.152 166.9.209.205 (*)166.9.209.227 (*)166.9.210.13 (*) |
London (EU-GB) |
https://private.eu-gb.security-compliance-secure.cloud.ibm.com/api |
166.9.244.29 166.9.244.59 166.9.245.189 (*)166.9.245.221 (*)166.9.245.253 (*) |
Madrid (EU-ES) |
https://private.eu-es.security-compliance-secure.cloud.ibm.com/api |
166.9.226.17 166.9.227.16 166.9.225.16 166.9.226.56 (*)166.9.227.143 (*)166.9.225.35 (*) |
Osaka (JP-OSA) |
https://private.jp-osa.security-compliance-secure.cloud.ibm.com/api |
166.9.247.44 166.9.247.77 166.9.247.109 166.9.247.59 (*)166.9.247.89 (*)166.9.247.123 (*) |
Sao Paulo (BR-SAO) |
https://private.br-sao.security-compliance-secure.cloud.ibm.com/api |
166.9.246.77 166.9.246.108 166.9.246.133 166.9.246.87 (*)166.9.246.120 (*)166.9.246.144 (*) |
Sydney (AU-SYD) |
https://private.au-syd.security-compliance-secure.cloud.ibm.com/api |
166.9.244.114 166.9.244.144 166.9.244.177 166.9.244.121 (*)166.9.244.153 (*)166.9.244.185 (*) |
Tokyo (JP-TOK) |
https://private.jp-tok.security-compliance-secure.cloud.ibm.com/api |
166.9.249.112 166.9.249.141 166.9.249.177 166.9.212.4 (*)166.9.214.5 (*)166.9.216.14 (*) |
Toronto (CA-TOR) |
https://private.ca-tor.security-compliance-secure.cloud.ibm.com/api |
166.9.247.153 166.9.247.185 166.9.247.205 166.9.209.13 (*)166.9.209.42 (*)166.9.209.72 (*) |
Washington (US-East) |
https://private.us-east.security-compliance-secure.cloud.ibm.com/api |
166.9.231.240 166.9.232.28 166.9.233.17 166.9.231.19 (*)166.9.232.40 (*)166.9.233.36 (*) |
Public REST API endpoints
The following table lists the public REST API endpoints that are available for each region:
| Region | Public REST API endpoint |
|---|---|
Dallas (US-South) |
https://us-south.security-compliance-secure.cloud.ibm.com/api |
Frankfurt (EU-DE) |
https://eu-de.security-compliance-secure.cloud.ibm.com/api |
London (EU-GB) |
https://eu-gb.security-compliance-secure.cloud.ibm.com/api |
Madrid (EU-ES) |
https://eu-es.security-compliance-secure.cloud.ibm.com/api |
Osaka (JP-OSA) |
https://jp-osa.security-compliance-secure.cloud.ibm.com/api |
Sao Paulo (BR-SAO) |
https://br-sao.security-compliance-secure.cloud.ibm.com/api |
Sydney (AU-SYD) |
https://au-syd.security-compliance-secure.cloud.ibm.com/api |
Tokyo (JP-TOK) |
https://jp-tok.security-compliance-secure.cloud.ibm.com/api |
Toronto (CA-TOR) |
https://ca-tor.security-compliance-secure.cloud.ibm.com/api |
Washington (US-East) |
https://us-east.security-compliance-secure.cloud.ibm.com/api |
Collector endpoints
Collector endpoints are ingestion endpoints that you can use to send data.
Private Collector endpoints
To send metrics by using a private endpoint, you must enable virtual routing and forwarding (VRF) for your account.
The following table lists the Private Collector endpoints that are available for each region:
(*) Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses
in the allowlist as well. A notification will be sent before the current IP addresses are deprecated.
To successfully connect your infrastructure to your Workload Protection instance, ensure that it has network connectivity to the Workload Protection region IPs on ports 6443 and 443.
| Region | Private ingestion endpoint | Private IP addresses | Workload Protection agent collector ports |
Workload Protection agent api ports |
|---|---|---|---|---|
Dallas (US-South) |
ingest.private.us-south.security-compliance-secure.cloud.ibm.com |
166.9.14.170 166.9.48.41 166.9.17.11 166.9.228.45 |
TCP 6443 | TCP 443 |
Frankfurt (EU-DE) |
ingest.private.eu-de.security-compliance-secure.cloud.ibm.com |
166.9.32.51 166.9.30.53 166.9.28.71 166.9.248.88 |
TCP 6443 | TCP 443 |
London (EU-GB) |
ingest.private.eu-gb.security-compliance-secure.cloud.ibm.com |
166.9.34.56 166.9.36.71 166.9.244.29 |
TCP 6443 | TCP 443 |
Madrid (EU-ES) |
ingest.private.eu-es.security-compliance-secure.cloud.ibm.com |
166.9.96.31 166.9.95.31 166.9.94.31 166.9.226.17 |
TCP 6443 | TCP 443 |
Osaka (JP-OSA) |
ingest.private.jp-osa.security-compliance-secure.cloud.ibm.com |
166.9.72.14 166.9.71.15 166.9.70.14 166.9.247.44 |
TCP 6443 | TCP 443 |
Sao Paulo (BR-SAO) |
ingest.private.br-sao.security-compliance-secure.cloud.ibm.com |
166.9.84.19 166.9.83.18 166.9.82.19 166.9.246.77 |
TCP 6443 | TCP 443 |
Sydney (AU-SYD) |
ingest.private.au-syd.security-compliance-secure.cloud.ibm.com |
166.9.56.32 166.9.52.27 166.9.54.27 166.9.244.114 |
TCP 6443 | TCP 443 |
Tokyo (JP-TOK) |
ingest.private.jp-tok.security-compliance-secure.cloud.ibm.com |
166.9.44.38 166.9.40.35 166.9.42.48 166.9.249.112 |
TCP 6443 | TCP 443 |
Toronto (CA-TOR) |
ingest.private.ca-tor.security-compliance-secure.cloud.ibm.com |
166.9.77.20 166.9.76.23 166.9.78.21 166.9.247.153 |
TCP 6443 | TCP 443 |
Washington (US-East) |
ingest.private.us-east.security-compliance-secure.cloud.ibm.com |
166.9.22.50 166.9.24.43 166.9.20.53 166.9.231.240 |
TCP 6443 | TCP 443 |
Public Collector endpoints
The following table lists the public collector endpoints that are available for each region.
(*) Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses
in the allowlist as well. A notification will be sent before the current IP addresses are deprecated.
| Region | Public ingestion endpoint | Public IP addresses | IBM Cloud Security and Compliance Center Workload Protection agent ports |
|---|---|---|---|
Dallas (US-South) |
ingest.us-south.security-compliance-secure.cloud.ibm.com |
169.60.151.174 169.46.0.70 169.48.214.70 52.118.209.119 (*)67.18.94.56 (*)52.116.135.250 (*) |
TCP 6443 |
Frankfurt (EU-DE) |
ingest.eu-de.security-compliance-secure.cloud.ibm.com |
149.81.77.78 161.156.102.206 159.122.102.38 158.177.2.4 (*)161.156.87.239 (*)149.81.238.82 (*) |
TCP 6443 |
London (EU-GB) |
ingest.eu-gb.security-compliance-secure.cloud.ibm.com |
158.175.98.206 141.125.73.118 159.122.210.174 141.125.105.98 (*)161.156.203.133 (*)158.176.179.72 (*) |
TCP 6443 |
Madrid (EU-ES) |
ingest.eu-es.security-compliance-secure.cloud.ibm.com |
13.122.68.140 13.120.68.187 13.121.68.91 13.121.91.87 (*)13.122.87.104 (*)13.120.91.152 (*) |
TCP 6443 |
Sao Paulo (BR-SAO) |
ingest.br-sao.security-compliance-secure.cloud.ibm.com |
163.107.66.98 163.109.67.242 169.57.141.43 13.116.92.185 (*)163.107.92.212 (*)163.109.84.195 (*) |
TCP 6443 |
Sydney (AU-SYD) |
ingest.au-syd.security-compliance-secure.cloud.ibm.com |
135.90.73.100 130.198.80.155 168.1.213.78 130.198.10.95 (*)135.90.130.246 (*)159.23.97.190 (*) |
TCP 6443 |
Osaka (JP-OSA) |
ingest.jp-osa.security-compliance-secure.cloud.ibm.com |
163.68.67.98 163.69.66.170 163.73.67.180 163.68.83.196 (*)163.73.82.218 (*)163.69.86.15 (*) |
TCP 6443 |
Toronto (CA-TOR) |
ingest.ca-tor.security-compliance-secure.cloud.ibm.com |
163.74.69.186 158.85.94.130 163.75.65.237 163.66.86.89 (*)163.75.81.213 (*)163.74.95.149 (*) |
TCP 6443 |
Tokyo (JP-TOK) |
ingest.jp-tok.security-compliance-secure.cloud.ibm.com |
165.192.84.14 128.168.75.14 169.56.51.238 162.133.138.54 (*)128.168.143.56 (*)165.192.128.220 (*) |
TCP 6443 |
Washington (US-East) |
ingest.us-east.security-compliance-secure.cloud.ibm.com |
169.60.112.74 169.55.109.114 169.62.3.82 169.62.20.11 (*)169.63.183.86 (*)150.239.110.137 (*) |
TCP 6443 |
Subnets for webhook notifications
To receive alert notifications by using webhooks from the IBM Cloud Security and Compliance Center Workload Protection service, you might need to define firewall rules for the subnets that are invoking your webhooks.
(*) Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses in
the allowlist as well. A notification will be sent before the current IP addresses are deprecated.
| Region | Alert notification source Subnets |
|---|---|
Dallas (US-SOUTH) |
150.239.180.0/25 169.46.0.64/29 169.46.39.48/28 169.46.58.24/29 169.47.115.192/28 169.47.71.24/29 169.48.214.64/29 169.48.235.16/28 169.60.151.168/29 169.62.221.32/28 174.36.68.96/27 50.22.148.64/26 52.116.222.192/27 52.117.187.192/27 52.118.158.0/25 52.118.7.64/26 67.228.207.64/26 67.228.219.0/25 52.118.147.1 (*)52.118.250.131 (*)67.18.90.54 (*) |
Frankfurt (EU-DE) |
149.81.151.128/27 149.81.201.192/26 149.81.77.72/29 149.81.99.192/28 158.177.44.192/26 159.122.102.32/29 161.156.1.224/27 161.156.102.200/29 161.156.69.144/28 161.156.77.64/26 169.50.36.64/27 169.50.9.0/28 149.81.10.225 (*)161.156.83.162 (*)149.81.238.81 (*) |
London (EU-GB) |
141.125.136.32/27 141.125.73.112/29 141.125.73.80/28 158.175.124.224/27 158.175.98.200/29 159.122.210.168/29 159.8.144.168/29 159.8.149.208/28 159.8.162.0/26 161.156.209.192/26 5.10.120.32/27 161.156.201.6 (*)141.125.157.52 (*)158.176.191.3 (*) |
Madrid (EU-ES) |
13.120.68.192/28 13.120.68.224/27 13.121.68.96/28 13.122.68.160/28 13.120.91.148 (*)13.121.80.147 (*)13.122.87.98 (*) |
Osaka (JP-OSA) |
163.68.67.128/28 163.68.67.96/29 163.68.79.32/27 163.69.66.168/29 163.69.67.112/28 163.69.70.64/27 163.73.67.176/29 163.73.67.192/28 163.73.69.96/27 163.68.91.237 (*)163.69.80.154 (*)163.73.86.222 (*) |
Sao Paulo (BR-SAO) |
163.107.66.96/29 163.107.68.128/28 163.107.71.32/27 163.109.67.240/29 163.109.73.128/27 169.57.141.40/29 169.57.186.0/27 169.57.195.0/28 13.116.91.143 (*)163.107.86.146 (*)163.109.84.191 (*) |
Sydney (AU-SYD) |
130.198.66.144/28 130.198.80.152/29 135.90.73.96/29 135.90.78.192/28 135.90.94.96/27 168.1.115.192/27 168.1.213.32/27 168.1.213.72/29 168.1.41.96/28 159.23.99.159 (*)130.198.18.13 (*)135.90.142.230 (*) |
Tokyo (JP-TOK) |
128.168.75.32/28 128.168.75.8/29 128.168.98.0/27 161.202.255.64/27 165.192.84.8/29 165.192.97.96/27 169.56.11.208/28 169.56.51.232/29 162.133.130.143 (*)128.168.137.83 (*)165.192.128.217 (*) |
Toronto (CA-TOR) |
158.85.78.224/27 158.85.94.128/29 163.74.67.192/28 163.74.69.184/29 163.74.71.96/27 163.75.65.232/29 163.75.72.192/27 169.55.129.208/28 163.66.81.182 (*)163.74.95.147 (*)163.75.86.200 (*) |
Washington (US-EAST) |
169.47.20.160/27 169.55.109.112/29 169.55.122.192/28 169.59.131.160/27 169.59.146.192/26 169.60.112.72/29 169.60.82.240/28 169.62.28.160/28 169.62.3.80/29 169.62.46.192/27 52.116.95.64/26 52.117.71.128/26 150.239.82.158 (*)169.63.176.251 (*)169.62.18.195 (*) |