TMA-IBMCLOUD-ACTIVITY-TRACKER-ROUTE

Ensure Activity Tracker event routing is configured

AltaNivel 1Automatizadaibmcloud

Descripción

Activity Tracker Event Routing sends account audit events to a durable target (Cloud Logs, COS, Event Streams). At least one route with target_ids must exist (requires the atracker plugin). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(ibmcloud atracker route ls --output json 2>/dev/null) || exit 1
n=$(printf '%s\n' "$out" | grep -c '"target_ids"' || true)
[ "$n" -gt 0 ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

ibmcloud atracker target create --name <t> --type cloud_object_storage|cloud_logs ... then ibmcloud atracker route create --name <r> --rules '[{"locations":["*","global"],"target_ids":["<target-id>"]}]'.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ibmcloudlogging
Referencia: CIS IBM Cloud Foundations Benchmark v2.0.0 - Logging and Monitoring - Activity Tracker event routing (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target ibmcloud