Auditing events

Security officers, auditors, or managers can use the IBM Cloud Activity Tracker service to track how users and applications interact with the App Configuration service in IBM Cloud.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the getting started tutorial for IBM Cloud Activity Tracker.

List of events

The following list of App Configuration events is sent to IBM Cloud Activity Tracker.

Table 1. Overview of App Configuration actions that generate IBM Cloud Activity Tracker events
Action	Description
`apprapp.segments.create`	Created a segment or failed to create
`apprapp.segments.update`	Updated a segment or failed to update
`apprapp.segments.delete`	Deleted a segment or failed to delete
`apprapp.segments.list`	Called the list of segments or failed to list
`apprapp.segments.read`	Retrieved segment details or failed to retrieve
`apprapp.environments.create`	Created an environment or failed to create
`apprapp.environments.update`	Updated an environment or failed to update
`apprapp.environments.delete`	Deleted an environment or failed to delete
`apprapp.environments.list`	Called the list of environments or failed to list
`apprapp.environments.read`	Retrieved environment details or failed to retrieve environment details
`apprapp.features.create`	Created feature or failed to create
`apprapp.features.update`	Updated feature or failed to update
`apprapp.features.updatevalues`	Updated feature details or failed to update details
`apprapp.features.delete`	Deleted feature or failed to delete
`apprapp.features.list`	Called the list of features or failed to list
`apprapp.features.read`	Retrieved feature details or failed to retrieve the details
`apprapp.features.evaluate`	Evaluated feature at the SDK or failed to evaluate
`apprapp.features.toggle`	Toggled feature or failed to toggle
`apprapp.properties.create`	Created a property or failed to create
`apprapp.properties.update`	Updated property or failed to update
`apprapp.properties.updatevalues`	Updated property details or failed to update
`apprapp.properties.delete`	Deleted property or failed to delete
`apprapp.properties.list`	Called the list of properties or failed to list
`apprapp.properties.read`	Retrieved details of property or failed to retrieve property details
`apprapp.properties.evaluate`	Evaluated property at the SDK or failed to evaluate
`apprapp.collections.create`	Created a collection or failed to create
`apprapp.collections.update`	Updated a collection or failed to update
`apprapp.collections.delete`	Deleted a collection or failed to update
`apprapp.collections.list`	Called the list of collections or failed to list
`apprapp.collections.read`	Retrieved collection details or failed to retrieve collection details
`apprapp.snapshots.create`	Created a snapshot configuration or failed to create
`apprapp.snapshots.update`	Updated a snapshot configuration or failed to update
`apprapp.snapshots.delete`	Deleted a snapshot configuration or failed to delete
`apprapp.snapshots.list`	Called the list of snapshot configuration or failed to list
`apprapp.snapshots.read`	Retrieved snapshot configuration details or failed to retrieve snapshot configuration details
`apprapp.snapshots.promote`	Created or updated the chosen configuration to GitHub based on the snapshots configuration.
`apprapp.snapshots.restore`	Writes or updates the chosen snapshot configuration from the GitHub to App Configuration instance.
`apprapp.originconfigs.update`	Updated the allowlist of origins or failed to update
`apprapp.originconfigs.list`	Called the allowlist of origins or failed to list
`apprapp.workflowconfigs.list`	Get the workflow configurations or failed to list
`apprapp.workflowconfigs.create`	Create a workflow configuration or failed to create
`apprapp.workflowconfigs.update`	Update a workflow configuration or failed to update
`apprapp.workflowconfigs.delete`	Delete a workflow configuration or failed to delete
`apprapp.changerequest.create`	Creates the Change Request for workflow integration or failed to create
`apprapp.changerequest.update`	Captures the change of events in the Change Request of Service Now for workflow or failed to update
`apprapp.config.import`	Import a instance configuration.
`apprapp.config.export`	Export instance configuration.
`apprapp.config.action`	Promotes or Restores a Snapshot configuration to or from GitHub respectively.

If an unauthorized request is made for any of the actions in table 1, a management event with reason code 403 is emitted.

Viewing events

Events that are generated by App Configuration are automatically forwarded to the IBM Cloud Activity Tracker service instance available in the same location.

IBM Cloud Activity Tracker can have only one instance per location. To view events, you must access the web UI of the IBM Cloud Activity Tracker service in the same location where your service instance is available.

Create a service instance of IBM Cloud Activity Tracker.
Start the IBM Cloud Activity Tracker web console to access your events.