Ensure that events are collected and processed to identify anomalies or abnormal events

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Use the following checklist to ensure that events are collected and processed to identify anomalies or abnormal events: This checklist assumes that you have a different IBM Cloud account for development, staging, Q&A, and production. When you separate accounts by domain (for example, production versus development), you isolate events for each domain and location. You use IAM to define permissions to view and manage events in an instance. Note: When a user gets read permissions to see events in an IBM Cloud Logs instance, the user gets visibility of all events in the region. Therefore, separate domains by account to avoid exposing production logs to non-authorized users. Checklist The checklist must be applied to each environment independently. 1. Ensure that events from core IBM Cloud core platform services, such as IAM are collected and available in the Cloud Logs instance where 'global' events have been routed to. Check that each core service has one or more custom views to analyze the data. o Check that you see provisioning events o Check that you see IAM identity login events o Check that you see IAM access group and policy events. 2. Ensure that events from enabled IBM Clou...

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

UI instructions that you can use to create custom views when one or more are missing in the account: 1. Log in to your IBM Cloud account at https://cloud.ibm.com. 2. Go to the Menu icon. Then, select Observability to access the Observability dashboard. 3. Click Logging. By default Instances are displayed. 4. Click the Cloud Logs tab. 5. The list of instances that are available on IBM Cloud is displayed. If the instances are not displayed, click Instances, Cloud Logs to display the list of logging instances. 6. Click Open dashboard for your selected instance. 7. In the left navigation, click the Explore logs icon, Logs. 8. The last view you had opened will be displayed. If no view was previously open, all views will be displayed. 9. Select the fields to be included in the view. By default you can select Applications, Subsystems, and log Severities. 10. (Optional) Add additional filters click + Add Filter and select and configure additional field and filter values. 11. Select if you want you view to only include Priority Logs (those in the Priority insights pipeline) or All Logs, that is, logs that are stored in IBM Cloud Object Storage. Logs in IBM Cloud Object Storage includes l...