vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Working with notification channels 

Configure notification channels to be notified when an alert is triggered. You manage notification channels through the Settings panel in the web UI.



 Configuring a notification channel 

Complete the following steps to add a notification channel:



1. Launch the web UI. For more information on how to launch the Web UI, see [Navigating to the Web UI](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-launch).
2. Click the user icon. This is the icon with the initials of the logged on user. Then click Integrations.
3. Select Notification Channels.
4. Click Add Notification Channel.
5. Configure a notification channel:



1. Select the type of notification, for example, Webhook.
2. Enter the name of the channel.
3. Enable the Notify when Resolved condition to receive a notification when the alert is manually resolved by a user.
4. Enable the Notify when Acknowledged field to receive a notification when the alert is manually acknowledged by the user.
5. Configure the notification according to the selected notification type:



* For an Email notification channel, add the list of recipients, separated by commas.
* For a Slack notification channel, add the URL of the Slack channel.
* For Cloud Functions notification channel, specify the channel URL when you set up a IBM Cloud Function Channel. For more information, see [Configure IBM Cloud Function Channel](https://docs.sysdig.com/en/configure-ibm-cloud-functions-channel.html).
* For a Webhook notification channel, add the Webhook URL. Note: When an alert is triggered, the notification is sent as a POST in JSON format to your webhook endpoint. For more information, see [Configuring a Webhook channel](https://docs.sysdig.com/en/configure-a-webhook-channel.html).
[Create an Event Notifications subscription](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-subscription)Create an Event Notifications subscription

Create an Event Notifications subscription. Destinations subscribe to topics. Multiple destinations can subscribe to a single topic. An email subscription is a list of all emails IDs, and an SMS subscription is a list of all phone numbers that a notification is routed to. A webhook subscription links a webhook destination to a topic.

Event Notifications



* 10 minutes
* 2023-01-24



[Create an Event Notifications topic](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-topic)Create an Event Notifications topic

Create an Event Notifications topic. Topics are based on a publish and subscription model. You can send notifications or alerts to multiple destination types, (for example, email, SMS, and others that are subscribed to a particular topic. Configure topics as needed and Event Notifications handles the routing and delivering of alerts reliably to the right destinations.

Event Notifications



* 10 minutes
* 2022-10-26



[Push notifications](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destinations-push)Push notifications

Event Notifications provides a push notification service for sending transactional and informational event notifications to mobile devices.

Event Notifications



* 10 minutes
* 2023-03-03



[Create and send push notifications to iOS mobile using Event Notifications](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-push-apns)Create and send push notifications to iOS mobile using Event Notifications

Create an Event Notifications service, add a push destination for Apple Push Notification service (APNs), and send messages to iOS devices.

Event Notifications



* 10 minutes
* 2022-10-26
SI-5 - Security Alerts, Advisories, and Directives 



  Control requirements 

The organization:

SI-5 (a)
:   Receives information system security alerts, advisories, and directives from [IBM Assignment: to include IaaS/PaaS providers and additional organization-defined external organizations] on an ongoing basis;

SI-5 (b)
:   Generates internal security alerts, advisories, and directives as deemed necessary;

SI-5 (c)
:   Disseminates security alerts, advisories, and directives to: [IBM Assignment: to include system security personnel and administrators with configuration/patch-management responsibilities]; and

SI-5 (d)
:   Implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for SI-5 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID  Rules                                                                                                                                                         

 SI-5 (a)        <br><br> *  Check whether Event Notifications are configured for each of the supported Service<br><br><br> 







  NIST supplemental guidance 

The United States Computer Emergency Readiness Team (US-CERT) generates security alerts and advisories to maintain situational awareness across the federal government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance to security directives is essential due to the critical nature of many of these directives and the potential immediate adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner. External organizations include, for example, external mission/business partners, supply chain partners, external service providers, and other peer/supporting organizations.
You can use the following cURL command to delete an alert:

curl -X DELETE <REST_API_ENDPOINT>/api/alerts/<ALERT_ID> -H "Authorization: $AUTH_TOKEN" -H "IBMInstanceID: $GUID" -H "TeamID: $TEAM_ID" -H "content-type: application/json"

Where



* <REST_API_ENDPOINT> indicates the endpoint targetted by the REST API call. For more information, see [Monitoring REST API endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_rest_api). For example, the public endpoint for an instance that is available in us-south is the following: https://us-south.monitoring.cloud.ibm.com/api
* You can pass multiple headers by using -H.

Authorization and IBMInstanceID are headers that are required for authentication.

TeamID is optional. When you specify this header, you limit the request to the data and resources available for the team specified.

To get an AUTH_TOKEN and the GUID see, [Headers for IAM Tokens](https://cloud.ibm.com/docs/monitoring?topic=monitoring-mon-curlmon-curl-headers-iam).
* <ALERT_ID> defines the ID of the alert that you want to delete.







 Get all user alerts 

You can use the following cURL command to get information about all the alerts:

curl -X GET <REST_API_ENDPOINT>/api/alerts?from=<START_TIMESTAMP>&to=<END_TIMESTAMP> -H "Authorization: Bearer $AUTH_TOKEN" -H "IBMInstanceID: $GUID"

Where



* <REST_API_ENDPOINT> indicates the endpoint targetted by the REST API call. For more information, see [Monitoring REST API endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_rest_api).
5. Click Save view.







 Is IBM alerted for any of these logs? 

The IBM Cloud Monitoring component generates certain alerts for issues with your location setup and host infrastructure. To review the alerts that IBM monitors, see [IBM monitoring to resolve and report location alerts](https://cloud.ibm.com/docs/satellite?topic=satellite-monitormonitoring-default).







 R00XX error logs 

R00XX error logs report messages and more detailed information about issues with your location setup and host infrastructure. For more information about each R00XX error message, including troubleshooting steps, see [Location error messages](https://cloud.ibm.com/docs/satellite?topic=satellite-ts-locations-debug).

Example log

{"logSourceCRN":"crn:v1:bluemix:public:satellite:us-south:a/f601ad712b0dd981276cf3b995554afc:c1hk4ek107l5au5mq8hg::","saveServiceCopy":true,"Details":{"message":"R0025: The Satellite location has OpenShift clusters in critical health.","errorDetails":"Customer etcd cluster moved down to 1 or less available pods. Quorum broke. Manual recovery of cluster needed.","messageID":"R0025"}}



Pre-defined fields for R00XX error logs

 Log field Description 

 logSourceCRN The CRN of the Satellite location. To identify the CRN for a location, look for the location's ID at the end of the CRN. 
 saveServiceCopy Set to true so that a copy of the log record is sent to IBM for monitoring and alerts. 
 Details The detailed information for log. 
 Details.message The current error message for the location, including any troubleshooting steps or documentation links. 
 Details.errorDetails Other details for the current error, such as specific causes or issues with certain components.
Example grammars 

The following examples describe more complex uses for grammars with speech recognition. Most examples are provided in both ABNF (application/srgs) and XML (application/srgs+xml) formats. Use these examples to help you get started with grammars.

In a production rule for a grammar, including a (backslash) is a syntax error in ABNF and is interpreted as a literal value in XML.

For more information about the languages and models that support grammars and their level of support (generally available or beta), see [Language support for customization](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-custom-support).



 Confirmation grammars 

Confirmation grammars are useful for applications that expect a one-word answer in response to a question. The following grammars define a list of possible yes and no responses.



* ABNF - [confirm.abnf](https://watson-developer-cloud.github.io/doc-tutorial-downloads/speech-to-text/grammars/confirm.abnf)
* XML - [confirm.xml](https://watson-developer-cloud.github.io/doc-tutorial-downloads/speech-to-text/grammars/confirm.xml)







 List grammars 

List grammars are useful for applications that expect the user to select an option from a predefined set of strings. The set is sometimes called a flat list. It typically consists of a list of terminal elements and does not include a complicated rule structure.



* The following grammars define a list of phrases for digits:



* ABNF - [list-numbers.abnf](https://watson-developer-cloud.github.io/doc-tutorial-downloads/speech-to-text/grammars/list-numbers.abnf)
* XML - [list-numbers.xml](https://watson-developer-cloud.github.io/doc-tutorial-downloads/speech-to-text/grammars/list-numbers.xml)
0 Emergency System panic, or other condition, that causes the router to stop functioning. 
 1 Alert Conditions that require immediate correction, such as a corrupted system database. 
 2 Critical Critical conditions, such as hard errors. 
 3 Error Error conditions that generally have less serious consequences than errors at the emergency, alert, and critical levels. 
 4 Warning Conditions that warrant monitoring. 
 5 Notice Conditions that are not errors, but might warrant special handling. 
 6 Info Events or non-error conditions of interest. 
 7 Any All severity levels. 



The following is a sample vSRX syslog configuration for sending logs to a remote syslog server. Your actual settings depend on the configuration of the syslog server receiving the logs.

set system syslog user * any emergency
set system syslog host 1.1.1.1 any any
set system syslog host 1.1.1.1 match RT_FLOW_SESSION
set system syslog file messages any any
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands any





 Configuring system logging for a security device 

Junos OS supports the configuration and monitoring of system log (or syslog) messages. You can configure files to log system messages while also assigning attributes, such as severity levels, to messages. Reboot requests are recorded to the system log files, which you can view with the show log command.



 Control plane logs 

The control plane logs, also called system logs, include events that occur on the routing platform. The system sends control plane events to the event process on the routing engine, which then handles the events by using Junos OS policies and generating system log messages, or both. You can choose to send control plane logs to a file, user terminal, routing platform console, or remote machine. To generate control plane logs, use the syslog statement at the system hierarchy level.





 Data plane logs 

The data plane logs (also called security logs) primarily include security events that are handled inside the data plane. Security logs can be in text or binary format, and can be saved locally (event mode), or sent to an external server (stream mode).
If only a single preference is specified, the double-quotes can be omitted. Supported options are WIDE and JSON.

If JSON is specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.

WIDE returns additional details in the output.

--team <TEAM_NAME>
: The name of the IBM Cloud Monitoring team to be used for authorization. If no team is specified, the default team will be used.

--help | -h
: List options available for the command.





 Examples 

The following are examples using the ibmcloud monitoring alert update command.

Update an alert with ID 1234567 for the IBM Cloud Monitoring abc instance.

ibmcloud monitoring alert update --name "IBM Cloud Monitoring abc" --id 1234567 --file alert.json

Update an alert with ID 1234567 for the IBM Cloud Monitoring abc instance in the us-south region.

ibmcloud monitoring alert update --name "IBM Cloud Monitoring abc" --id 1234567 --file alert.json --region us-south







 ibmcloud monitoring alert delete 

Use this command to delete an alert.

ibmcloud monitoring alert delete --name NAME --id ALERT_ID [--region REGION] [--force] [--team TEAM_NAME]



 Command options 

--name <NAME> | --n <NAME>
: Name of the instance.

--id <ALERT_ID>
: ID of the alert.

--region <REGION> | -r <REGION>
: Name of the region, for example, us-south or eu-gb. If not specified, the region logged into or targeted will be used.

--force
: Supresses the prompt and deletes the alert from the instance that is specified by --name.

--team <TEAM_NAME>
: The name of the IBM Cloud Monitoring team to be used for authorization. If no team is specified, the default team will be used.

--help | -h
: List options available for the command.





 Examples
The following are examples of intent names:



* weather_conditions
* pay_bill
* escalate_to_agent





A number sign is prepended to the intent name automatically to help identify the term as an intent. You do not need to add it.

Keep the name as short as possible. It's easier to read in the "Try it out" pane and conversation logs if you keep the intent name short and concise.

Optionally add a description of the intent in the Description field.
4. Select Create intent to save your intent name.

![Screen capture that shows new intent definition](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/intent-create.png)
5. In the User example field, type the text of a user example for the intent. An example can be any string up to 1,024 characters in length. The following utterances might be examples for the pay_bill intent:



* I need to pay my bill.
* Pay my account balance
* make a payment



To learn about the impact of including references to entities in your user examples, see [How entity references are treated](https://cloud.ibm.com/docs/assistant?topic=assistant-intentsintents-entity-references).

Intent names and example text can be exposed in URLs when an application interacts with Watson Assistant. Do not include sensitive or personal information in these artifacts.
6. Click Add example to save the user example.

![Screen capture that shows adding a user example to an intent](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/intent-user-example.png)
7. Repeat the same process to add more examples.

Provide at least five examples for each intent.

!
Valid levels are: emergency, alert, critical, error, warning, notice, information, debug and none.

The values are listed from high priority to low priority.

For example, to filter out low severity events (notice, information, debug), you must set the log section event_priority to warning:

log:
event_priority: warning

To block collection of events, you must set the log section event_priority to none:

log:
event_priority: none





 Including and excluding metrics 

To filter custom metrics, you must customize the metrics_filter section in the dragent.yaml file. You can specify which metrics to include and which ones to filter out by configuring the include and exclude filtering parameters.

The filtering rule order is set as follows: the first rule that matches a metric is applied.

For example, if the metrics_filter section of a monitoring agent looks as follows:

metrics_filter:
- include: metricA.
- exclude: metricA.
- include: metricB.
- include: haproxy.backend.
- exclude: haproxy.
- exclude: metricC.



* You are configuring the monitoring agent to collect all data from metrics that start with metricA, metricB, and haproxy.backend.
* You are filtering out metrics that start with metricC and other metrics that start with haproxy.
* The entry exclude: metricA. is ignored.







 Changing the log level 

To configure the log level, you must customize the log section in the dragent.yaml file.

The monitoring agent generates log entries in /opt/draios/logs/draios.log.



* The log file rotates when it reaches 10MB in size.
* The 10 most recent log files are kept. The date-stamp that is appended to the filename is used to determine which files to keep.
* Valid log levels are: none, error, warning, info, debug, trace
For more information, see [Working with dashboards](https://cloud.ibm.com/docs/monitoring?topic=monitoring-dashboardsdashboards).
* Learn about alerts. For more information, see [Working with alerts](https://cloud.ibm.com/docs/monitoring?topic=monitoring-monitoringmonitoring_alerts).
* Learn how to manage logs from your cluster. See [Logging with Red Hat OpenShift clusters](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-kube).
* Learn about the IBM Cloud Monitoring Workload Protection functionality to find and prioritize software vulnerabilities, detect and respond to threats, and manage configurations, permissions and compliance from source to run. See [Getting started with IBM Cloud® Security and Compliance Center Workload Protection](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started).
"id": "crn:v1:staging:public:logdna:us-south:a/9bb3ea01633c4d828080de16ce34ea70:d8ba830f-b0e0-4c42-9345-8981d4a94b31:streaming-logs:",
"typeURI": "logdna/account/streaming-notification"



 Query to monitor failures 

In Log Analysis, you can create a view with the following query to filter for event stream failure notifications:

action:logdnaat.streaming-logs.send reason.reasonCode:500 severity:critical target.typeURI:"logdna/account/streaming-notification"

You can define a presence alert on this view to notify you as soon as 1 event reporting failure comes in.

In addition, you can create views for each type of notification. For example, to monitor for a failure to authenticate with Event Streams, you can use the following query:

action:logdnaat.streaming-logs.send reason.reasonCode:500 severity:critical target.typeURI:"logdna/account/streaming-notification" requestData.notificationType:"authentication_failure"
You can also monitor alarms from the [RabbitMQ HTTP API](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-management-pluginrabbitmq-management-http-api). Use the GET /api/nodes endpoints, and look for mem_alarm and disk_free_alarm in the response.

For more checks related to memory alarms, you can gather information that is related to a single node's memory by using the GET /api/nodes/{node}/memory endpoint.





 Standard Health Checks 

The [RabbitMQ HTTP API](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-management-pluginrabbitmq-management-http-api) provides a couple of [health check](https://www.rabbitmq.com/monitoring.htmlhealth-checks) endpoints to verify the state of the RabbitMQ nodes in your deployment.



* [All Nodes](https://www.rabbitmq.com/monitoring.htmlnode-metrics) - GET /api/healthcheck/node
* [Single Node](https://www.rabbitmq.com/monitoring.htmlnode-metrics) - GET /api/healthcheck/node/<node_name>



Health checks consume system resources. For smaller, less busy deployments, the health check shouldn't take long to give you a response. Larger deployments, or deployments under load, can take some time to return results.
"priority": 2,
"target": {
"listener": {
"id": "0456-a578be10-31e3-46b3-8513-79babb852398"
},
"http_status_code": 302
},
"rules":
{
"condition": "contains",
"type": "header",
"field": "aheader",
"value": "avalue"
},
{
"condition": "equals",
"type": "header",
"field": "cookie",
"value": "flavor=oatmeal"
}
]
},
{
"name": "path_hostname",
"action": "https_redirect",
"priority": 5,
"target": {
"listener": {
"id": "0386-d898be10-21e3-66b3-9513-69babb852390"
},
"http_status_code": 301,
"uri": "/test/sample"
},
"rules":
{
"condition": "contains",
"type": "hostname",
"value": "abc"
},
{
"condition": "equals",
"value": "/test",
"type": "path"
}
]
}
] ! ! ! ! !
The alerts that you set up might not be related to a storage volume issue, but to issues that occurred within your app, on the worker node, or in the cluster.



* [Troubleshooting persistent storage volumes](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storage_file).
* [Troubleshooting worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_reload).
* [Troubleshooting apps](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_apps).
* [Troubleshooting clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_clusters).
* [Open a support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar).
[Test option](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/alerts/images/alert_test.png)
7. Click Save Alert
8. If you want to create an additional alert channel, click + and follow the prior steps to create additional channels. You can create different channel types, for example, an email and a Slack channel. Or, you can create multiple channels of the same type with different alert criteria.





Your preset can now be used by others to setup alerts.





 Deleting a preset 

You can manage presets through the ALERTS dashboard.

Complete the following steps to delete a preset from the ALERTS dashboard:



1. In the web UI, select the Settings icon ![Settings icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/alerts/images/admin.png).
2. Select ALERTS.
3. Hover the mouse over the Edit button of the preset that you want to delete. The Delete option displays.
4. Click Delete.
5. Confirm that you want to delete the preset by clicking Yes, delete.



When you delete a preset, any alerts that are defined by using this preset are automatically deleted.