Ensure auditing is configured in the IBM Cloud account

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

To check that you are collecting audit events from IBM Cloud resources so that you can monitor activity in your IBM Cloud account, you can use the following check list to ensure that auditing is configured in an IBM Cloud account: 1. Ensure that routes and/or targets are defined for audit events in IBM Cloud® Activity Tracker Event Routing. Be sure to include Global events, as well as for each region that you operate within. 2. Use the validate function within IBM Cloud® Activity Tracker Event Routing, which ensures the configured route or target are working and are able to authenticate to the specified destination. To check if routes and/or targets are defined for audit events in IBM Cloud® Activity Tracker Event Routing, complete the following steps: Note: To complete these steps, your IBM Cloud user ID (IBMid) must have the following roles: - A platform role with viewer role for the IBM Cloud® Activity Tracker Event Routing service for the account - A service role with reader role for the IBM Cloud® Activity Tracker Event Routing service for the account - Identity and Access Management (IAM) permissions to read and list targets and routes in the account, including the followi...

How it is fixed

Fix method: Guidance or infrastructure patch

1. If a route is not configured within IBM Cloud® Activity Tracker Event Routing for each of the locations where you operate in IBM Cloud (including global), you must create or update a route. To create a route, choose any of the following options: o Creating a route using the CONSOLE. o Creating a route using the CLI. o Creating a route using the API. 2. If a target is not configured within IBM Cloud® Activity Tracker Event Routing for each of the locations where you which to receive your audit events, you must create or update a target. To create a target, choose any of the following options: o Creating a IBM Cloud Logs target using the CONSOLE. o Creating a IBM Cloud Logs target using the CLI. o Creating a IBM Cloud Logs target using the API. 3. If any of the targets have a status or write status of ERROR, you must update the configured target to resolve the authentication issue with the destination. To update a target, choose any of the following options: o Updating a IBM Cloud Logs target using the CONSOLE. o Updating a IBM Cloud Logs target using the CLI. o Updating a IBM Cloud Logs target using the API.