Launching IBM Cloud Logs from the Observability page

For information on launching the IBM Cloud Logs UI, see Launching the console in the IBM Cloud Logs documentation.

Extracting user information from the GUID

An event in the IBM Cloud Activity Tracker Event Routing console contains the following fields.

To find the user information that aligns with the event GUID, use the following steps.

1. In the Credentials tab of the App ID dashboard, copy, and save the information in the apiKey and tenantID fields. The tenant ID should match the ID of the event. If no credentials exist, create a set.

2. Obtain an IAM token for the apiKey by inserting the key into the following command:

   curl -k -X POST \
      --header "Content-Type: application/x-www-form-urlencoded" \
      --header "Accept: application/json" \
      --data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" \
      --data-urlencode "apikey=<apiKey>" \
      "https://iam.cloud.ibm.com/identity/token"
   

3. Copy the IAM token from the access_token field in the response.

4. Select a region. Learn more about the available regions.

5. Insert the IAM token, the tenant ID, and the user ID, into the following command to obtain the user information.

   curl -X GET
   --header 'Accept: application/json'
   --header 'Authorization: Bearer <IAMToken>' \
   'https://<region>.appid.cloud.ibm.com/<tenantID>/cloud_directory/Users/<userID>'
   

   You can also run this command by using the management APIs. Your output would look similar to the following JSON object:

      {
      "displayName": "test test",
      "active": true,
      "userName": "test0001",
      "mfaContext": {},
      "emails": [
      {
         "value": "mytest@yahoo.com",
         "primary": true
      }
      ],
      "meta": {
      "lastLogin": "2018-12-10T16:05:36.665Z",
      "created": "2018-08-21T08:55:50.643Z",
      "location": "/v1/cb967e0d-43c1-454a-968d-0efa24766846/Users/34e1ea6d-cc02-4941-9462-7e9c5a40b360",
      "lastModified": "2018-12-10T16:05:36.675Z",
      "resourceType": "User"
      },
      "schemas": [
      "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "name": {
      "givenName": "test",
      "familyName": "test",
      "formatted": "test test"
      },
      "id": "34e1ea6d-cc02-4941-9462-7e9c5a40b360"
   }
   

Finding user-related events

You can track the events of specific Cloud Directory users in IBM Cloud Activity Tracker Event Routing by using their email. Before you can begin tracking, the email must be mapped to a Cloud Directory GUID.

1. Obtain an IAM token, a tenant ID, and a region as described in the previous section.

2. Insert the IAM token, the tenant ID, and the email into the following command to obtain the user information.

   curl -X GET
   --header 'Accept: application/json'
   --header 'Authorization: Bearer <IAMToken>'
   'https://<region>.appid.cloud.ibm.com/<tenantID>/users?email=<emailAddress>'
   

   The email address must be escaped. For example, myTest%40yahoo.com instead of myTest@yahoo.com.

   Alternatively, you can use the Management APIs. Your output would look similar to the following JSON object:

   {
      "users": [
      {
         "idp": "cloud_directory",
         "id": "1e123399-3499-4a5c-b5a9-93843a91dc80"
      },
      {
         "idp": "cloud_directory",
         "id": "2a7abbe5-0fce-402e-9ddf-265246b415c8"
      }
      ]
   }
   

3. Search for a cloud_directory:id value in the target.name_str field in the IBM Cloud Activity Tracker Event Routing console.