Security Monitoring, Logging, and Incident Response
Audit versus operational data
Activity Tracker Event Routing captures account-level audit events for IAM-enabled services: who did what, to which target, with which outcome, from which address. It is regional and routes to targets such as IBM Cloud Logs, Object Storage, or Event Streams. IBM Cloud Monitoring carries metrics and time-series health data. Security and Compliance Center Workload Protection adds runtime threat detection. Keep the three distinct: an audit event is not a metric.
Detection design
Route audit events to a central Logs instance in a dedicated security account or region, build saved queries for privileged actions (policy creation, key deletion, root key disable, public bucket creation), and alert on outcome=failure patterns such as repeated failed logins.
Incident response
Preserve evidence before remediation: export relevant events to Object Storage. Then rotate or delete API keys, remove or disable service IDs, revoke access group memberships, disable compromised root keys, and tighten context-based restrictions. Record the timeline from audit events, since that is the defensible artifact.
Worked example
Suspected leaked API key. Query Activity Tracker for the key's initiator over the last days, export results, delete the key, confirm no service ID retains equivalent access, check for new IAM policies or public endpoints created during the window, then re-issue a scoped key.
Traps that cost marks
Activity Tracker is regional, so events from another region are not in the same stream unless routed. Logs retention is finite; evidence must be exported. Deleting a compromised identity before capturing its event history destroys the investigation. Metrics gaps are not proof of inactivity.