Activity tracking events for enterprise management

IBM Cloud services, such as enterprise management, generate activity tracking events.

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.

You can use IBM Cloud Activity Tracker Event Routing, a platform service, to route auditing events in your account to destinations of your choice by configuring targets and routes that define where activity tracking events are sent. For more information, see About IBM Cloud Activity Tracker Event Routing.

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

Locations where activity tracking events are sent by IBM Cloud Activity Tracker Event Routing

Enterprise management sends activity tracking events by IBM Cloud Activity Tracker Event Routing in the regions that are indicated in the following table.

Regions where activity tracking events are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
No	No	No	No

Regions where activity tracking events are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
No	No	No	No

Regions where activity tracking events are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)
Yes	No	No

Launching IBM Cloud Logs from the Observability page

For information on launching the IBM Cloud Logs UI, see Launching the UI in the IBM Cloud Logs documentation.

Events for managing enterprises

The following table lists the actions that generate enterprise management events:

Actions that generate enterprise management events
Action	Description
`enterprise.enterprise.create`	An event is generated when a user creates an enterprise.
`enterprise.enterprise.update`	An event is generated when a user updates information about the enterprise.
`enterprise.enterprise.import`	An event is generated when a user imports an existing stand-alone account to the enterprise hierarchy.
`enterprise.account-group.create`	An event is generated when a user creates an account group within an enterprise.
`enterprise.account-group.update`	An event is generated when a user updates the account group information within an enterprise.
`enterprise.account-group.delete`	An event is generated when a user deletes an account group within an enterprise.
`enterprise.account.create`	An event is generated when a user creates an account within an enterprise.
`enterprise.account.move`	An event is generated when a user moves an account within an enterprise, for example, moves the account from a child account group into its parent account group.
`enterprise.account.update`	An event is generated when a user updates the account information within an enterprise.
`enterprise.account.delete`	An event is generated when a user deletes an account from an enterprise.

Events for managing enterprise usage reports

The following table lists the actions that generate an event:

Actions that generate enterprise usage report management events
Action	Description
`billing.enterprise-usage-report.read`	An event is generated when a user views the enterprise account level summary usage page that is displayed by default.
`billing.enterprise-usage-report.download`	An event is generated when a user requests a summary export of the data in csv format from the enterprise account level summary usage page.
`billing.enterprise-instances-usage-report.download`	An event is generated when a user requests an instances export of the data in csv format from the enterprise account level summary usage page.

Analyzing enterprise billing activity tracking events

requestData fields

The following table lists the fields that are available through the requestData field in the events with actions billing.enterprise-usage-report.read and billing.enterprise-usage-report.download:

Enterprise usage requestData fields
Field	Type	Description	Status
`month`	String	Indicates the month that the user selects to view usage data.	Included always in the event
`children`	Boolean	Indicates whether the usage is aggregated at account level.	Included always in the event
`enterprise_id`	String	Indicates the ID of the enterprise.	Included always in the event
`account_id`	String	Indicates the sub-account ID that is requested in the report.	Optional
`account_group_id`	String	Indicates the account group when a user selects one.	Optional Included if the user filters data by selecting 1 account group.

The following table lists the fields that are available through the requestData field in the events with actions billing.enterprise-instances-usage-report.download:

Enterprise instances usage requestData fields
Field	Type	Description	Status
`month`	String	Indicates the month that the user selects to view usage data.	Included always in the event
`enterprise_id`	String	Indicates the ID of the enterprise.	Included always in the event
`account_id`	String	Indicates the sub-account IDs that are requested in the report.	Optional
`account_group_id`	String	Indicates the account group when a user selects one.	Optional Included if the user filters data by selecting 1 account group.