vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If the Security status column shows any issues, to find out about the issues, click the Issues by type tab. The Vulnerabilities and Configuration Issues tables open.



* Vulnerabilities table. Shows the Vulnerability ID for each issue, the policy status for that issue, the affected packages and how to resolve the issue. To see more information about that issue, expand the row. A summary of that issue is displayed that contains a link to the vendor security notice for that issue. Lists packages that contain known vulnerability issues.

The list is updated daily by using published security notices for the Docker image types that are listed in [Types of vulnerabilities](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indextypes). Typically, for a vulnerable package to pass the scan, a later version of the package is required that includes a fix for the vulnerability. The same package can list multiple vulnerabilities, and in this case, a single package update can correct multiple issues. Click the security notice code to view more information about the package and for steps to update the package.
* Configuration issues table. Shows the configuration issue ID for each issue, the policy status for that issue, and the security practice. To see more information about that issue, expand the row. A summary of that issue is displayed that contains a link to the security notice for that issue.

The list contains suggestions for actions that you can take to increase the security of the container and any application settings for the container that are nonsecure. Expand the row to view how to resolve the issue.



6. Complete the corrective action for each issue shown in the report, and rebuild the image.







 Reviewing a vulnerability report by using the CLI 

You can review the security of Docker images that are stored in your namespaces in IBM Cloud Container Registry by using the CLI.



1. List the images in your IBM Cloud account. A list of all images is returned, independent of the namespace where they are stored.

ibmcloud cr image-list
2. Check the status in the SECURITY STATUS column.



* No Issues No security issues were found.
Caveonix RiskForesight introduction 

Enterprises that undergo a digital transformation are adopting a hybrid cloud strategy. This strategy includes workloads in both the private cloud and multiple external cloud environments, such as the public cloud or a cloud managed by a service provider. Most enterprises are also faced with the challenge of protecting an ever-increasing attack surface while simultaneously maintaining compliance with industry and regulatory compliance requirements.

To protect this expanding attack surface, enterprises need continuous visibility into workloads from the start until the end of their lifecycle. Enterprises must maintain a “full-stack” understanding of the workload vulnerabilities and configuration issues at the infrastructure, platform, and application level in the context of threats and compliance requirements. Enterprises need predictive analytics to “connect the dots” to give a proactive view of their cyberrisk and compliance risk posture in this vast, new hybrid world.

Caveonix RiskForesight™ provides proactive workload protection from risks due to cyberthreats and regulatory compliance issues. It provides real-time visibility into what is running in an enterprise’s hybrid cloud through native integration into cloud orchestration platforms. Combining such visibility with risk reduction models and enforcement actions that can be automated, RiskForesight quickly develops a prioritized list of actions to mitigate. RiskForesight is a multitenant-aware hybrid cloud workload protection platform that implements a proactive risk management framework. This framework can operate at multiple control planes: network, compute, security, and compliance, while the implementation of the framework at cloud scale is automated.

The platform is fully integrated into the VMware® technology stack from vCD, vRA, vCenter to NSX and many public clouds. The RiskForesight platform has three key modules: Detect, Predict, and Act, providing 360-degree visibility into hybrid cloud workloads in real time by natively integrating into hybrid cloud orchestration modules. It is the industry’s first, seamless hybrid cloud protection platform. This platform allows customers to see IT, cyberrisk and compliance risk across the full cybercontrol planes of network, security, compute, and compliance.
However, if you want to specify a new exclude list during the detect-secrets scan, the new list overwrites the existing exclude list in the baseline file.
2. Run the following command to review and audit the baseline file that is created with the scan step:

detect-secrets audit .secrets.baseline

This command brings up an interactive terminal to mark false positives. You can indicate (y)es if the secret found is an actual secret or (n)o if it is a false positive.
3. Commit and push the .secrets.baseline file back to the repo, his process must be done locally on a periodic basis.









 Detect-secrets scan parameters 

If you have an existing baseline file, the scan uses the existing configuration. Your previous auditing results and settings are not overwritten. If no baseline file exists, a temporary baseline is created automatically for the run.

The detect-secrets-baseline-filename parameter specifies a custom file name for the baseline file that is used by detect-secrets. By default, detect-secrets looks for a file that is named .secrets.baseline in the repository root directory. However, if you name your baseline file differently, you can provide its file name by using this parameter.

The detect-secrets-exclusion-list parameter overrides the default exclusion list when a run is done without an existing baseline file. This pàrameter identifies files to ignore so that issues are not created that are linked to them.

The detect-secrets-verbose parameter, when set to 1, logs the name of the current file that is being scanned.



Table 1. Secrets-scan parameters

 Name Type Description Required or Optional 

 detect-secrets-baseline-filename String The name of the baseline file in your app repository. Defaults to .secrets.baseline. Required if your baseline file is not the default name .secrets.baseline. 
 detect-secrets-exclusion-list String A regex list of files to be excluded in the detect-secrets scan. Defaults to requirements.txt go.modgo.sumpom.xmlbuild.gradlepackage-lock.json. Optional, This file list overrides the general exclusion list only when there is no .secrets.baseline file present.
If the Security status column shows any issues, to find out about the issues, click the Issues by type tab. The Vulnerabilities and Configuration Issues tables open.



* Vulnerabilities table. Shows the Vulnerability ID for each issue, the policy status for that issue, the affected packages and how to resolve the issue. To see more information about that issue, expand the row. A summary of that issue is displayed that contains a link to the vendor security notice for that issue. Lists packages that contain known vulnerability issues.

The list is updated daily by using published security notices for the Docker image types that are listed in [Types of vulnerabilities](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uitypes). Typically, for a vulnerable package to pass the scan, a later version of the package is required that includes a fix for the vulnerability. The same package can list multiple vulnerabilities, and in this case, a single package update can correct multiple issues. Click the security notice code to view more information about the package and for steps to update the package.
* Configuration issues table. Shows the configuration issue ID for each issue, the policy status for that issue, and the security practice. To see more information about that issue, expand the row. A summary of that issue is displayed that contains a link to the security notice for that issue.

The list contains suggestions for actions that you can take to increase the security of the container and any application settings for the container that are nonsecure. Expand the row to view how to resolve the issue.



6. Complete the corrective action for each issue shown in the report, and rebuild the image.







 Reviewing a vulnerability report by using the CLI 

You can review the security of Docker images that are stored in your namespaces in IBM Cloud Container Registry by using the CLI.



1. List the images in your IBM Cloud account. A list of all images is returned, independent of the namespace where they are stored.

ibmcloud cr image-list
2. Check the status in the SECURITY STATUS column.



* No Issues No security issues were found.
IBM Calico extension 1096 1213 Updated image to fix the following CVEs: [CVE-2020-35525](https://nvd.nist.gov/vuln/detail/CVE-2020-35525), [CVE-2020-35527](https://nvd.nist.gov/vuln/detail/CVE-2020-35527), [CVE-2022-3515](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3515), [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2022-2509](https://nvd.nist.gov/vuln/detail/CVE-2022-2509), [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149). 
 IBM Cloud Controller Manager v1.23.13-1 v1.23.13-5 Key rotation and updated Go dependencies. 
 IBM Cloud File Storage for Classic plug-in and monitor 416 420 Updated universal base image (UBI) to version 8.7-923 to resolve CVEs. 
 Key Management Service provider v2.5.10 v2.5.11 Updated Go dependencies and to Go version 1.19.3. 
 Kubernetes v1.23.13 v1.23.14 [CVE-2022-3294](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3294) and [CVE-2022-3162](https://nvd.nist.gov/vuln/detail/CVE-2022-3162).
Running Code Risk Analyzer scan 

Scan your source code with Code Risk Analyzer to identify any security vulnerabilities that you need to address.



1. Click Run scan.
2. Wait for scan to finish.







 Adding a Security and Compliance Center scan 

To include controls with your product, you must add scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. On the Manage compliance page go to Add Security and Compliance Center scan and select a profile that you previously scanned.
2. Select a Security and Compliance Center scan. If you don't see any scans, you need to run a scan in Security and Compliance Center. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).
3. Click Add scan.



These results are displayed on your About page for your product as evidence that the controls that you listed for your product are validated as compliant.
IBM Calico extension 1096 1213 Updated image to fix the following CVEs: [CVE-2020-35525](https://nvd.nist.gov/vuln/detail/CVE-2020-35525), [CVE-2020-35527](https://nvd.nist.gov/vuln/detail/CVE-2020-35527), [CVE-2022-3515](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3515), [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2022-2509](https://nvd.nist.gov/vuln/detail/CVE-2022-2509), [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149). 
 IBM Cloud Controller Manager v1.22.15-3 v1.22.15-7 Key rotation and updated Go dependencies. 
 IBM Cloud File Storage for Classic plug-in and monitor 416 420 Updated universal base image (UBI) to version 8.7-923 to resolve CVEs. 
 Key Management Service provider v2.5.10 v2.5.11 Updated Go dependencies and to Go version 1.19.3. 
 Kubernetes v1.22.15 v1.22.16 [CVE-2022-3294](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3294) and [CVE-2022-3162](https://nvd.nist.gov/vuln/detail/CVE-2022-3162).
GPU device plug-in and installer c1c6dd3 19bf25c Updated image for [CVE-2021-3449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449), [CVE-2021-3450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450), and [CVE-2021-20305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305). 
 IBM Cloud Controller Manager v1.18.17-1 v1.18.18-1 Updated to support the Kubernetes 1.18.18 release. 
 IBM Cloud File Storage for Classic plug-in and monitor 389 390 Updated to use Go version 1.15.9 and for [CVE-2020-28851](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28851) and [CVE-2021-3121](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121). 
 IBM Cloud RBAC Operator 3dd6bbc b6a694b Updated image for [CVE-2021-3449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449) and [CVE-2021-3450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450). 
 Key Management Service provider v2.2.5 v2.3.3 Updated to use Go version 1.15.11.
Red Hat OpenShift on IBM Cloud. N/A N/A N/A 
 HAPROXY b034b2 3a1392 [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2020-35525](https://nvd.nist.gov/vuln/detail/CVE-2020-35525), [CVE-2020-35527](https://nvd.nist.gov/vuln/detail/CVE-2020-35527), [CVE-2022-3515](https://nvd.nist.gov/vuln/detail/CVE-2022-3515), [CVE-2022-2509](https://nvd.nist.gov/vuln/detail/CVE-2022-2509). 







 Change log for master fix pack 4.7.59_1587_openshift, released 27 October 2022 

The following table shows the changes that are in the master fix pack 4.7.59_1587_openshift. Master patch updates are applied automatically.



Changes since version 4.7.591582openshift

 Component Previous Current Description 

 Cluster health image v1.3.11 v1.3.12 Updated Go dependencies, golangci-lint, and to Go version 1.19.2. Updated base image version to 109. Excluded ingress status from cluster status calculation. 
 IBM Cloud Controller Manager v1.20.15-17 v1.20.15-19 Updated to support the Kubernetes 1.20.15 release. 
 IBM Cloud RBAC Operator dc1725a 778ef2b Updated to Go version 1.18.6. 
 Key Management Service provider v2.5.9 v2.5.10 Updated Go dependencies and to Go version 1.19.2.
Logging for Secrets Manager 

Use the IBM® Log Analysis service to view IBM Cloud® Secrets Manager logs for your instance.

With IBM Log Analysis, administrators, DevOps teams, and developers can review log data, define alerts, and design custom views to monitor application and system logs. For more information, see the [Log Analysis docs](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-started).



 Before you begin 

If you're working with Log Analysis for the first time, be sure that you create an instance in the same location as your Secrets Manager instance. For more information, see [Configuring platform logs through the Observability dashboard](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-config_svc_logsconfig_svc_logs_ui).





 Viewing logs 

Logs that are generated by a Secrets Manager service instance are forwarded automatically to the Log Analysis instance that is available in the same location.

Only logs with the level ERROR are forwarded.

To view Secrets Manager logs, complete the following steps:



1. Log in to the IBM Cloud console.
2. Go to IBM Cloud > Observability to access your [Observability dashboard](https://cloud.ibm.com/observe).
3. From the navigation menu, click Logging.
4. Select a Log Analysis instance, and click Open Dashboard.

Don't have a Log Analysis instance? [Create an instance](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-provision) in the same location as your Secrets Manager instance. Then, click Configure platform logs to receive logs from supported services in your account.
5. In the logging UI, filter by secrets-manager to view logs that are generated by Secrets Manager.

For more information about searching and filtering logs, check out the [Log Analysis documentation](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-monitor_logs).







 Analyzing logs
Images used by DevSecOps pipelines 

The DevSecOps Continuous Integration (CI), Continuous Deployment (CD), and Continuous Compliance (CC) pipelines use Docker images for different tools to run the scans within the pipeline runs. The images are available in the Global IBM Container Registry (ICR) and are pulled and run during the pipeline runs.



1. DevSecOps Baseimage - Used to run the compliance pipelines. This image runs all the stages within the pipelines, triggering different scans, collecting evidence, and creating issues.
2. OWASP ZAP API Scanner - Used to trigger OWASP ZAP API scans against the API endpoints of a deployed application to detect vulnerabilities.
3. OWASP ZAP UI Scanner - Used to trigger OWASP ZAP UI scans against the URL of a deployed application to detect vulnerabilities exposed by the UI.
4. OWASP ZAP UI Proxy - Used with the OWASP ZAP UI scan image as a proxy service to trigger ZAP UI scans against a deployed application.
5. Detect Secrets - Used to detect secrets like passwords or secret keys that are exposed by the application source code.
6. Docker In Docker (DinD) - Used to run a docker container within another docker container. DinD runs various images that belong to tools within the DevSecOps Baseimage.
7. Sonarqube - Used to run static scan against application source code to detect vulnerabilities.
8. Sonarqube Scanner CLI - Command-line utility to trigger SonarQube scans.





Table 1. DevSecOps Images

 Tool Type IBM Cloud Container Registry Repository Latest version Vulnerability Status Vulnerability Description 

 Baseimage icr.io/continuous-delivery/toolchains/devsecops/baseimage 2.83.0_commons-0.32.5 Non-Vulnerable 
 DevSecOps Baseimage icr.io/continuous-delivery/toolchains/devsecops/devsecops-baseimage 2.83.0_commons-0.32.5 Non-Vulnerable
Organizations consider using tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine/test for the presence of vulnerabilities. Suggested sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). In addition, security control assessments such as red team exercises provide other sources of potential vulnerabilities for which to scan. Organizations also consider using tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).
Running Code Risk Analyzer scan 

Scan your source code with Code Risk Analyzer to identify any security vulnerabilities that you need to address.



1. Click Run scan.
2. Wait for scan to finish.







 Adding a Security and Compliance Center scan 

To include controls with your product, you must add scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. On the Manage compliance page go to Add Security and Compliance Center scan and select a profile to use to scan your product.
2. Select a Security and Compliance scan. If you don't see any scans, you need to run a scan in Security and Compliance Center. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).
3. Click Add scan.



These results are displayed on your About page for your product when it is published in the catalog as evidence that the controls you listed for your product are validated as compliant.
You can use an existing secret in Secrets Manager or add your API key directly. For more information, see [Using an API key or secret to authorize projects](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-authorize-project).
2. Enter values for other required fields from the Required tab.
3. Optional: Specify other values from the Optional tab.
4. Save the configuration.
5. Click Validate. Validation takes a few minutes

IBM Cloud projects runs a Code Risk Analyzer scan that includes a [supported set of Security and Compliance Center rules](https://cloud.ibm.com/docs/code-risk-analyzer-cli-plugin?topic=code-risk-analyzer-cli-plugin-cra-cli-pluginterraform-scc-goals). Controls that are part of the deployable architecture and that are also supported by IBM Cloud projects are checked. Any extra controls that are not included in the list of supported Security and Compliance Center rules are not checked when you validate the configuration.

If the validation fails because of the Code Risk Analyzer scan, you can [troubleshoot the failure](https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-ts-na-failures).



9. Deploy the configuration:

After you validate your configuration, you can deploy it to your target account.



1. Review the input values and make any necessary changes.
2. Click Deploy.

Deploying the deployable architecture can take more than an hour. You are notified when the deployment is successful.



10. Review the outputs from the deployable architecture.



During the validation and deployment process, monitor the [needs attention items](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-needs-attention-projects). The widget reflects any issue that occurs in your configurations.
Gateway-enabled cluster controller 1444 1510 Updated image for [CVE-2021-3711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711) and [CVE-2021-3712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712). 
 IBM Cloud Block Storage plug-in and driver v2.0.9 v2.1.1 Updated to use Go version 1.16.7. Updated universal base image (UBI) to the latest 8.4-208 version to resolve CVEs. 
 IBM Cloud File Storage for Classic plug-in and monitor 398 400 Updated to use Go version 1.16.7. Updated universal base image (UBI) to the latest 8.4-208 version to resolve CVEs. 
 IBM Cloud RBAC Operator 945df65 e3cb629 Updated to use Go version 1.16.7. 
 Load balancer and load balancer monitor for IBM Cloud Provider 1510 1550 Updated image for [CVE-2021-3711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711) and [CVE-2021-3712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712). 
 Kubernetes API server auditing configuration N/A N/A Updated to support verbose[Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-auditaudit-api-server). 
 OpenShift Container PlatformControl Plane Operator v4.5.0-20210816 v4.5.0-20210830 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.5.0+20210830).