vania-janet/multiturn-rag-retrieval-data huggingface dataset:
IBM CIS usually accelerates API traffic by removing connection overhead. However, the default security stance can interfere with many API calls. It is recommended that you take a few actions to prevent interference with your API traffic after proxying is active.



* Turn security features off selectively, using the Page Rules features.



* Create a Page Rule with the URL pattern of your API, such as api.example.com
* Add the following rule behaviors:



* Select Security Level to Essentially off
* Select TLS to Off
* Select Browser Integrity Check to Off



* Select Provision Resource



* Alternatively, you can turn off Web Application Firewall globally from the Security page.





 What does the Browser Integrity Check do? 

The browser integrity check looks for HTTP headers that are commonly abused by spammers. It denies traffic with those headers access to your page. It also blocks visitors that do not have a user agent, or who add a non-standard user agent (this tactic is commonly used by abuse bots, crawlers, or APIs).







 Best practice 4: Configure your security settings as strictly as possible 

CIS provides some options for encrypting your traffic. As a reverse proxy the TLS connection is terminated at Cloudflare and a new TLS connection is opened to your origin servers. For your termination with CIS, you can upload a custom certificate from your account, you can use a wildcard certificate provisioned for you by CIS, or both.



 Upload a custom certificate 

You can upload your public and private key when you create an Enterprise domain. If you upload your own certificate, you gain immediate compatibility with encrypted traffic, and you maintain control over your certificate (for example, an Extended Validation (EV) certificate). Remember that you'll be responsible for managing your certificate if you upload a custom certificate. For example, IBM CIS won't track the certificate expiration dates.





 Alternatively, use a certificate provisioned by CIS 

IBM CIS has partnered with several Certificate Authorities (CAs) to provide domain wildcard certificates for our customers, by default. Manual verification could be required for setting up these certificates, and your support team can help you perform these additional steps.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in systemd (CVE-2022-3821)](https://www.ibm.com/support/pages/node/6967663)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in Gnome libxml2 (CVE-2022-40303)](https://www.ibm.com/support/pages/node/6967667)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in Gnome libxml2 (CVE-2022-40304)](https://www.ibm.com/support/pages/node/6967669)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python Charmers Future (CVE-2022-40899)](https://www.ibm.com/support/pages/node/6967679)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Golang Go (CVE-2022-41716)](https://www.ibm.com/support/pages/node/6967671)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41717)](https://www.ibm.com/support/pages/node/6967677)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42010)](https://www.ibm.com/support/pages/node/6967691)
The link is set to expire after 5 minutes.



Authenticated users have their own spaces to store files. While they can not see each other files, they can generate pre-signed URLs to grant temporary access to a specific file.

You can find more details about the application in the [source code repository](https://github.com/IBM-Cloud/secure-file-storage).





 Step 4: Review Security Events 

Now that the application and its services have been successfully deployed, you can review the security events generated by that process. All the events are centrally available in Activity Tracker instance.



1. From the [Observability](https://cloud.ibm.com/observe/activitytracker) dashboard, locate the Activity Tracker instance for the region where your application is deployed and click Open Dashboard.
2. Review all logs sent to the service as you were provisioning and interacting with resources.







 Step 5: Optional: Use a custom domain and encrypt network traffic 

By default, the application is accessible on a generic subdomain of containers.appdomain.cloud. However, it is also possible to use a custom domain with the deployed app. For continued support of https, access with encrypted network traffic, either a certificate for the desired hostname or a wildcard certificate needs to be provided. There are various combinations of services that can be used to manage DNS names and TLS certificates for integration into a kubernetes application. This tutorial will use the following services:



* DNS subdomain, secure-file-storage, of a DNS domain, example.com, that is managed by IBM Cloud Internet Services (CIS) service.
* [Let's Encrypt](https://letsencrypt.org/) to generate the TLS certificates.
* IBM Cloud Secrets Manager to integrate with Let's Encrypt to generate the TLS certificate for secure-file-storage.example.com and securely store.
* Kubernetes [External Secrets Operator](https://external-secrets.io/v0.7.0/) to pull the secret TLS certificate directly from Secrets Manager





 Provision a CIS and Secrets Manager instance
It's important that the Assistant be configured with an Action or webhook that can handle this scenario.



The phone integration supports disaster recovery by providing the ability to do a fast failover to another region instead of routing the call to a live agent when a service outage occurs. This is accomplished by sending a SIP 503 response to the upstream SIP trunking provider, instead of auto referring the call to a live agent when failures happen during the setup of a call. This 503 response can then be used by the SIP trunking provider to reroute the call to another region. If you want to take advantage of this capability, open a service ticket against the Watson Assistant service instance that requires disaster recovery.





 Secure the phone connection 

You can add security to the phone connection by going to the Advanced options tab in the phone integration settings, and selecting one or both of the following options:



* Force secure trunking: Select this option to use Secure Real-Time Transfer Protocol (SRTP) to secure the audio that is transmitted over the phone. For more information about RTP, see [Call routing details](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-phone-configdeploy-phone-config-route).
* Enable SIP authentication: Select this option if you want to require SIP digest authentication.

When SIP authentication is required, all inbound traffic (meaning requests from the SIP provider to your assistant) is authenticated using SIP digest authentication, and must be sent using Transport Layer Security (TLS). If this option is selected, the SIP digest user name and password must be configured, and the SIP trunk being used to connect to Assistant must be configured to use only TLS.

If you use Twilio as your SIP trunk provider, you cannot enable SIP authentication for outbound SIP trunks to Watson Assistant.







 Applying advanced SIP trunk configuration settings 

To configure how your assistant interacts with a SIP trunk from an external provider, go to the SIP trunk tab in the phone integration settings, and update the following options in the SIP trunking integration section:



* SIP INVITE headers to extract: List the headers that you want your assistant to use.
Before you can forward alerts to GitHub and Slack, you need a delivery channel that can receive and process your incoming notification data. Event Notifications supports delivery to webhooks. With a webhook, you can build simple workflows that help you to receive and process HTTP requests between different sets of APIs. For example, a webhook can receive the contents of a Secrets Manager event notification, which you can then consume programmatically and pass to the GitHub and Slack APIs.

In this tutorial, you use [Webhook.site](https://webhook.site) to quickly create a webhook URL that you can use to test your notification flow.

Webhook.site is an open source tool that is not maintained by IBM. For more information about this tool or to troubleshoot any issues, refer to the [Webhook.site documentation](https://docs.webhook.site/).



1. In a new browser tab, go to [Webhook.site](https://webhook.site).
2. Copy your unique URL and keep the browser tab open. You'll use your webhook URL in a later step.







 Step 4: Update your Event Notifications settings 

After you connect the services and create a test webhook URL, update your Event Notifications settings so the service can understand how to route any incoming events from Secrets Manager. You'll need to create a topic, destination, and subscription in Event Notifications to make sure that the events that are generated by Secrets Manager are forwarded to your test webhook URL.



1. In the IBM Cloud console, go to your Event Notifications instance.
2. [Create a topic](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-topic) that filters for Secrets Manager events.



1. From the navigation, click Topics > Create.
2. In the Topic details section, provide a name for your topic. For example, Secrets about to expire.
3.
It also also available for the en-WW_Medical_Telephony model when US English audio is recognized. 
 WebSocket Parameter of JSON start message 
 Synchronous HTTP Query parameter of POST /v1/recognize method 
 Asynchronous HTTP Query parameter of POST /v1/recognitions method 







 speaker_labels 

An optional boolean that indicates whether the service identifies which individuals spoke which words in a multi-participant exchange. If you set the speaker_labels parameter to true, the service automatically forces the timestamps parameter to be true. By default (false), speaker labels are not returned. For more information, see [Speaker labels](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-speaker-labels).



Table 24. The speaker_labels parameter

 Availability and usage Description 

 Previous-generation models Beta for US English, Australian English, German, Japanese, Korean, and Spanish (broadband and narrowband models) and UK English (narrowband model only). 
 Next-generation models Beta for Czech, English (Australian, Indian, UK, and US), German, Japanese, Korean, and Spanish. 
 WebSocket Parameter of JSON start message 
 Synchronous HTTP Query parameter of POST /v1/recognize method 
 Asynchronous HTTP Query parameter of POST /v1/recognitions method 







 speech_detector_sensitivity 

An optional float between 0.0 and 1.0 that indicates the sensitivity of speech recognition to non-speech events in the input audio. The default is 0.5, which provides a reasonable level of sensitivity to non-speech events. For more information, see [Speech detector sensitivity](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-detectiondetection-parameters-sensitivity).



Table 25. The speech_detector_sensitivity parameter

 Availability and usage Description 

 Previous-generation models Generally available for all language models except for ar-MS_BroadbandModel, pt-BR_BroadbandModel, zh-CN_BroadbandModel, zh-CN_NarrowbandModel, and de-DE_BroadbandModel.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by improper input validation with Spring Framework (CVE-2022-22950)](https://www.ibm.com/support/pages/node/6593865)







 1 May 2022 (Version 1.2.x) 

Important: End of service for Speech to Text version 1.2.x on IBM Cloud Pak for Data version 3.5
: Important: Speech to Text version 1.2.x on IBM Cloud Pak for Data version 3.5 is out of service as of 1 May 2022. Speech to Text version 1.2.x is no longer supported, available, or documented. For more information about End of Service for Speech to Text, which is part of the Watson API Kit, see [Software support discontinuance: IBM Watson API Kit for IBM Cloud Pak for Data 1.2.x](https://www.ibm.com/common/ssi/cgi-bin/ssialias?subtype=ca&infotype=an&appname=iSource&supplier=897<=tternum=ENUS922-038).





 27 April 2022 (Version 4.0.8) 

Version 4.0.8 is now available
: Speech to Text for IBM Cloud Pak for Data version 4.0.8 is now available. This version supports IBM Cloud Pak for Data version 4.x and Red Hat OpenShift versions 4.6 and 4.8. For more information about installing and managing the service, see [Installing Watson Speech to Text](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=text-installing-watson-speech).

New environment variables used in IBM Cloud Pak for Data documentation
: Most commands in the Speech to Text for IBM Cloud Pak for Data documentation have been updated to use a common set of environment variables. The documentation provides a script to automatically export the environment variables before you run installation, upgrade, and administration commands. After you source the script, you can copy most commands from the documentation and run them without making any changes.

The environment variables that the script defines include the following:
It could be any TLS 1.2 cipher specification, as the server end was set to accept ANY_TLS12_OR_HIGHER.<-- </section "id="section-alter-the-client-channel-definition-table-ccdt" "> --><-- <section "id="section-export-the-necessary-environment-variables" "> --> Export the necessary environment variables <-- <ol> -->1. Open command line interface and navigate to MQ C Samples directory.
<-- <ul> -->

* The location of this will depend on your operating system - it would be /var/mqm/Tools/Samples/C (Linux), C:Program FilesIBMMQToolscSamples (Windows), or on Mac, where you have installed the toolkit, for example /mytoolkit/IBM-MQ-Toolkit-Mac-x64-9.1.2.0/samp/bin.

<-- </ul> -->

2. Set the MQSSLKEYR environment variable, this is the full path from the system root to the key store file. Note that the filename requires no suffix - so for a key store named key.kdb, specify just "key".
<-- <ul> -->

* For Windows, run set MQSSLKEYR=c:mystorekey
* For Mac or Linux, export MQSSLKEYR=/Users/you/store/key

<-- </ul> -->

3. The path to the CCDT file can be set in one of two ways:
<-- <ol> -->

1. Set the environment variable MQCCDTURL, this is file path from the system root to the ccdt file to which you added the cipherSpecification earlier.

<-- <ul> -->

* For Windows, run set MQCCDTURL=c:mydefinitionsconnection_info_ccdt.json
This field is valid only when mode is simulate or ban.

<-- <ul> -->

* content_type: The content-type of the body, which must be one of the following: text/plain, text/xml, application/json.
* body: The body to return. The content here must conform to the content_type. Max length is 10240.

<-- </ul> -->

<-- </ul> -->

<-- </ul> -->

* The optional fields are id, disabled, description, correlate and bypass:

<-- <ul> -->

* id: Identifier of the rate limiting rule.
* disabled: Whether this rate limiting rule is currently disabled.
* description: A note that you can use to describe the reason for a rate limiting rule.
* correlate: Whether to enable NAT based rate limiting.

<-- <ul> -->

* by: Valid values: nat.

<-- </ul> -->

* bypass: Criteria that allows the rate limit to be bypassed. For example, to express that you shouldn’t apply a rate limit to a given set of URLs.

<-- <ul> -->

* name: Valid values is url.
* value: The url to bypass.

<-- </ul> -->

<-- </ul> -->

<-- </ul> -->

Sample JSON data: {
"id": "92f17202ed8bd63d69a66b86a49a8f6b",
"disabled": false,
"description": "Prevent multiple login failures to mitigate brute force attacks",
"bypass":
{
"name": "url",
"value": "api.example.com/"
}
],
"threshold": 60,
"period": 900,
"correlate": {
"by": "nat"
},
Starting with the 4.7 release, you can secure traffic that is sent between the Windows Agent service and its crawler by enabling support for the transport layer security (TLS) protocol.





 Prerequisite steps 



* If you want to enable document-level security, you must take some steps to set it up. For more information, see [Supporting document-level security](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collection-typesconfiguredls).

To configure document-level security, you need to collect the following information:

LDAP server URL
: The LDAP server URL to connect to. For example, ldap://<ldap_server>:<port>.

LDAP binding username
: The username to use to bind to the directory service.

In most cases, this username is a distinguished name (DN). An Active Directory username might work, but, unlike the general Windows logon, it is case sensitive.

LDAP binding user password
: The password that is associated with the binding username.

LDAP base DN
: The starting point for searching user entries in LDAP. For example, CN=Users,DC=example,DC=com.

LDAP user filter
: The user filter to search user entries in LDAP. If empty, the default value is (userPrincipalName={0}).
* Before you configure a Windows File System collection, you must install the IBM Watson Discovery Agent for Windows File Systems on a remote Windows file server or on a remote Windows server. The agent is a Windows service that retrieves data from data source servers and sends it to Discovery. The agent can crawl remote Windows file systems, drives that are local to the agent, and shared network folders.

If you install the agent on a remote Windows server, the remote Windows server must be able to mount one or more file servers so that the agent can crawl the remote Windows file systems.

To install and configure the agent, complete the following tasks:
function mockLogin() {
const payload = {
/
* Even if this is an unauthenticated user, add a userID in the sub claim that can be used
* for billing purposes.
* This ID will help us keep track "unique users". For unauthenticated users, drop a
* cookie in the browser so you can make sure the user is counted uniquely across visits.
/
sub: 'some-user-id', // Required
iss: 'yourdomain.com' // Required
};
// The "expiresIn" option adds an "exp" claim to the payload.
return jwt.sign(payload, process.env.YOUR_PRIVATE_RSA_KEY, { algorithm: 'RS256', expiresIn: '10000ms' });
}
Show more



To enable security, complete the following steps:



1. From the web chat integration page in Watson Assistant, set the Secure your web chat switch to On.
2. Add your public key to the Your public key field.

The public key that you add is used to verify that data which claims to come from your web chat instance is coming from your web chat instance.
3. To prove that a message is coming from your website, each message that is submitted from your web chat implementation must include the JSON Web Token (JWT) that you created earlier.

Add the token to the web chat code snippet that you embed in your website page. Specify the token in the identityToken property.

For example:

<script>
window.watsonAssistantChatOptions = {
integrationID: 'YOUR_INTEGRATION_ID',
region: 'YOUR_REGION',
serviceInstanceID: 'YOUR_SERVICE_INSTANCE',
identityToken: 'YOUR_JWT',
onLoad: function(instance) {
instance.render();
}
};
setTimeout(function(){
const t=document.createElement('script');
Modify your server.xml to enable the appSecurity-2.0 feature:

<featureManager>
<feature>appSecurity-2.0</feature>
</featureManager>

Modify your web.xml file to include the following security constraint:

<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

This makes your app force all connections to use HTTPS automatically and will not allow any HTTP connections.





 Secure starter app contents 

The secure starter app contains BadServlet.java. This app shows an example of insecure code that developers might write if care is not taken.

The secure starter app also contains GoodServlet.java, which includes a number of good secure coding practices such as input validation, output encoding, secure HTTP Header settings, and Content Security Policy. These practices are key countermeasures against XSS. Applying them can also mitigate other vulnerabilities such as some injection and directory traversal.





 XSS cheat sheet 

See the [XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to learn more about XSS and its countermeasures.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in cURL libcurl (CVE-2022-32206)](https://www.ibm.com/support/pages/node/6967687)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl (CVE-2022-32208)](https://www.ibm.com/support/pages/node/6967655)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to spoofing attacks in GnuPG (CVE-2022-34903)](https://www.ibm.com/support/pages/node/6967657)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in SQLite (CVE-2022-35737)](https://www.ibm.com/support/pages/node/6967659)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in zlib (CVE-2022-37434)](https://www.ibm.com/support/pages/node/6967661)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in systemd (CVE-2022-3821)](https://www.ibm.com/support/pages/node/6967663)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in Gnome libxml2 (CVE-2022-40303)](https://www.ibm.com/support/pages/node/6967667)