vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[development icon](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/development-icon.png)Tutorial: For a tutorial that shows an example of using web chat security to authenticate users and protect sensitive data, see [Tutorial: Authenticating a user in the middle of a session](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-web-chat-develop-security).

To encrypt sensitive data:



1. On the Security tab of the web chat integration settings, click the Generate key button.
2. Copy the public key that displays in the IBM-provided public key field. This field is available only if [web chat security is enabled](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-web-chat-security-encryptweb-chat-security-enable).
3. In the JavaScript function you use to create your JWT, include in the payload a private claim called user_payload. Use this claim to contain the sensitive data, encrypted with the IBM public key.

The following code snippet shows a function that accepts a userID and user payload. If a user payload is provided, its content is encrypted and signed with the IBM public key. In this example, the public key is stored in an environment variable.

// Example code snippet to encrypt sensitive data in JWT payload.
const jwt = require('jsonwebtoken');
const RSA = require('node-rsa');

const rsaKey = new RSA(process.env.PUBLIC_IBM_RSA_KEY);

/
* Returns a signed JWT. Optionally, also adds an encrypted user payload
* as stringified JSON in a private claim.
/
function mockLogin(userID, userPayload) {
* [Security Bulletin: A jwt-go vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-26160)](https://www.ibm.com/support/pages/node/6574543)
* [Security Bulletin: A vulnerability in Golang Go affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-29923)](https://www.ibm.com/support/pages/node/6574545)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)](https://www.ibm.com/support/pages/node/6583151)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution with IBM WebSphere Application Server (CVE-2021-23450)](https://www.ibm.com/support/pages/node/6583149)







 17 March 2022 (Version 4.0.6) 

Grammar support for next-generation models is now generally available
: Grammar support is now generally available (GA) for next-general models that meet the following conditions:



* The models are generally available.
* The models support language model customization.



For more information, see the following topics:



* For more information about the status of grammar support for next-generation models, see [Customization support for next-generation models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-custom-supportcustom-language-support-ng).
* For more information about grammars, see [Grammars](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-customizationgrammars-intro).







 15 March 2022 (Version 4.0.6) 

Important: Deprecation of most previous-generation models
To ensure that visitors have previously run and passed JavaScript detections, you can create a firewall rule with the field cf.bot_management.js_detection.passed which performs a Managed Challenge action. Enter (cf.bot_management.js_detection.passed) into the Expression preview section as a singular rule.





 Considerations 



* If you have a Content Security Policy (CSP):



* Ensure that anything under /cdn-cgi/challenge-platform/ is allowed. Your CSP should allow scripts that are served from your origin domain (script-src self).
* If your CSP uses a nonce for script tags, CIS adds these nonces to the scripts it injects by parsing your CSP response header.
* If your CSP does not use nonce for script tags and JavaScript Detection is enabled, you might see a console error such as

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-b123b8a70+4jEj+d6gWI9U6IilUJIrlnRJbRR/uQl2Jc='), or a nonce ('nonce-...') is required to enable inline execution.
* It is not recommended to use unsafe-inline. Instead, it is recommend that you use CSP nonces in script tags which are parsed and supported in the CDN.
For security purposes, CIS does not reveal the code (or other exact information) used to filter traffic. Doing so prevents malicious actors from reverse engineering it to bypass our defenses.





 OWASP rule set 

The OWASP rule set for WAF contains generic attack detection rules. The OWASP rules protect against many common attack categories, including SQL injection, cross-site scripting, and local file inclusion. CIS provides, but does not curate these rules.

OWASP is an industry standard that provides a good security baseline. For more information, see:



* [OWASP on GitHub](https://github.com/SpiderLabs/owasp-modsecurity-crs)
* [OWASP.org](https://owasp.org/www-project-modsecurity-core-rule-set/)





 Managing OWASP 

Unlike the [CIS rule set](https://cloud.ibm.com/docs/cis?topic=cis-waf-settingscis-ruleset-for-waf), OWASP allows you to set sensitivity.

A request can trigger a set of OWASP rules that have a high to low severity score associated with them. The final score is calculated based on all the rules triggered. After calculating the final score, CIS compares it to the sensitivity threshold selected in the beginning, and then either blocks, challenges, or simulates the request based on the option selected.

It is recommended that you set OWASP sensitivity to low initially, then review for false positives before increasing the sensitivity. If you set it to high, check the logs on CIS, and fine-tune the OWASP rule set to work for your application.

Keep in mind that you can only toggle OWASP rules on or off, unlike rules in the CIS rule sets, which can be set to Disable, Simulate, Challenge, or Block.





 Understanding the OWASP package 

The OWASP ModSecurity Core Rule Set assigns a score to each request based on how many OWASP rules trigger. Some OWASP rules have a higher sensitivity score than others.
For a secured connection with HTTPS, you can either obtain a certificate from [Let's Encrypt](https://letsencrypt.org/) as described in the following [IBM Cloud® blog](https://www.ibm.com/cloud/blog/secure-apps-on-ibm-cloud-with-wildcard-certificates) or through [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-public-certificates&interface=ui).





 Increase performance and protect from Denial of Service attacks 

A distributed denial of service ([DDoS](https://en.wikipedia.org/wiki/Denial-of-service_attack)) attack is a malicious attempt to disrupt normal traffic of a server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic. CIS is equipped to protect your domain from DDoS.



1. In the CIS dashboard, select Reliability > Global Load Balancer.
2. Locate the GLB you created in the Load Balancers table.
3. Enable the Security and Performance features in the Proxy column:

Zoom

![CIS Proxy Toggle ON](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/includes/solution-tutorials/includes/solution-tutorials/images/solution32-multi-region-k8s-cis/cis-proxy.png)

CIS Proxy Toggle ON



Your GLB is now protected. An immediate benefit is that the origin IP addresses of your clusters will be hidden from the clients. If CIS detects a threat for an upcoming request, the user may see a screen like this one before being redirected to your application:

Zoom

!
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable a denial of service, caused by a buffer overflow with Twisted (CVE-2022-21716)](https://www.ibm.com/support/pages/node/6593867)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in NumPy. (CVE-2021-33430)](https://www.ibm.com/support/pages/node/6592841)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by improper input validation with Spring Framework (CVE-2022-22950)](https://www.ibm.com/support/pages/node/6593865)







 1 May 2022 (Version 1.2.x) 

Important: End of service for Text to Speech version 1.2.x on IBM Cloud Pak for Data version 3.5
: Important: Text to Speech version 1.2.x on IBM Cloud Pak for Data version 3.5 is out of service as of 1 May 2022. Text to Speech version 1.2.x is no longer supported, available, or documented. For more information about End of Service for Text to Speech, which is part of the Watson API Kit, see [Software support discontinuance: IBM Watson API Kit for IBM Cloud Pak for Data 1.2.x](https://www.ibm.com/common/ssi/cgi-bin/ssialias?subtype=ca&infotype=an&appname=iSource&supplier=897<=tternum=ENUS922-038).





 27 April 2022 (Version 4.0.8) 

Version 4.0.8 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.0.8 is now available. This version supports IBM Cloud Pak for Data version 4.x and Red Hat OpenShift versions 4.6 and 4.8.
In the Secret field, add a private key to pass with the request that can be used to authenticate with the external service.

The key must be specified as a text string, such as purple unicorn. Maximum length is 1,024 characters. You cannot specify a context variable.

It is the responsibility of the external service to check for and verify the secret. If the external service does not require a token, specify any string you want. You cannot leave this field empty.

If you want to see the secret as you enter it, click on the Show password icon ![view icon](https://cloud.ibm.com/docs-content/v1/content/icons/view.svg) before you start typing. After you save the secret, the string is replaced by asterisks and can't be viewed again.

For more information about how this field is used, see [Webhook security](https://cloud.ibm.com/docs/assistant?topic=assistant-webhook-prewebhook-pre-security).
7. In the Timeout field, specify the length of time (in seconds) you want the assistant to wait for a response from the webhook before returning an error. The timeout duration cannot be shorter than 1 second or longer than 30 seconds.
8. In the Headers section, add any headers that you want to pass to the service one at a time by clicking Add header.

For example, if the external application that you call returns a response, it might be able to send a response in multiple different formats. The webhook requires that the response is formatted in JSON. The following table illustrates how to add a header that indicates that you want the resulting value to be returned in JSON format.



Header example

 Header name Header value 

 Content-Type application/json 



The service automatically sends an Authorization header with a JWT; you do not need to add one. If you want to handle authorization yourself, add your own authorization header and it will be used instead.

After you save the header value, the string is replaced by asterisks and can't be viewed again.



Your webhook details are saved automatically.
Specify yes or true for a web action, raw for a raw HTTP web action, or no or false for a standard action. To secure your web action, also include the --web-secure option.

--web-secureSECRET
: Secure the web action. The VALUE for SECRET can be true, false, or any string. This option can be used only with the --web option.





 Example 

ibmcloud fn action create hello folder/hello_world.js

Output

ok: created hello







 ibmcloud fn action delete 

You can clean up your namespace by deleting actions that you do not want to use any longer.

ibmcloud fn action delete ACTION_NAME



 Example 

ibmcloud fn action delete helloworld

Output

ok: deleted hello







 ibmcloud fn action get 

Get metadata that describes a specific action.

ibmcloud fn action get ACTION_NAME [--save] [--save-as FILENAME] [--summary] [--url]



 Command options 

ACTION_NAME
: The name of an action. This value is required.

--save
: You can get and locally save the code that is associated with an existing action, except for sequences and Docker actions. The FILENAME corresponds with an existing action name in the current working directory and the file extension corresponds to the action kind. For example, for action code that is an archive file, an extension of .zip is used. This flag is optional.

--save-asFILENAME
: Save the code for actions in a custom-named file by providing a file path, FILENAME, and extension. This flag is optional.

--summary
: Get a summary of the action details. Parameters with the prefix "*" are bound; parameters with the prefix "**" are bound and finalized. This flag is optional.

--url
: Get the URL only for the action. This flag is optional.





 Example 

ibmcloud fn action get hello

Output

ok: got action hello
{
Also consider the following service-specific requirements:



* You need to specify only the input audio. All other parameters are optional.
* If necessary, make sure to specify the model parameter to indicate a model that is appropriate for your language and audio.
* If you specify an invalid query parameter or JSON field as part of the input, the response includes a warnings field that describes the invalid argument. The request succeeds despite any warnings.







 Sending audio with a request 

The audio that you pass to the service must be in one of the service's supported formats. For most audio, the service can automatically detect the format. For some audio, you must specify the format with the Content-Type or equivalent parameter. For more information, see [Audio formats](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-audio-formatsaudio-formats-list). (For clarity, the following examples specify the audio format with all requests.)

With the WebSocket and synchronous HTTP interfaces, you can pass a maximum of 100 MB of audio data with a single request. With the asynchronous HTTP interface, you can pass a maximum of 1 GB of audio data. You must send at least 100 bytes of audio with any request.

If you are recognizing large amounts of audio, you can manually divide the audio into smaller chunks. But it is usually more efficient and convenient to convert the audio to a compressed, lossy format. Compression can maximize the amount of data that you can send with a single request. Especially if the audio is in WAV or FLAC format, converting it to a lossy format can make an appreciable difference.



* For more information about audio formats that use compression, see [Audio formats](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-audio-formatsaudio-formats-list).
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python (CVE-2021-3737)](https://www.ibm.com/support/pages/node/6610329)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a possible sensitive information exposure in Python (CVE-2021-4189)](https://www.ibm.com/support/pages/node/6610339)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in lxml (CVE-2021-43818)](https://www.ibm.com/support/pages/node/6610341)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in MS Visual Studio (CVE-2021-21300)](https://www.ibm.com/support/pages/node/6610343)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Git (CVE-2021-40330)](https://www.ibm.com/support/pages/node/6610345)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in MS Visual Studio (CVE-2022-24765)](https://www.ibm.com/support/pages/node/6610347)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git (CVE-2018-1000021)](https://www.ibm.com/support/pages/node/6610349)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2015-9251)](https://www.ibm.com/support/pages/node/6610351)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41715)](https://www.ibm.com/support/pages/node/6890851)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in OpenSSL (CVE-2022-2097)](https://www.ibm.com/support/pages/node/6890853)







 30 November 2022 (Version 4.6.0) 

Version 4.6.0 is now available
: Speech to Text for IBM Cloud Pak for Data version 4.6.0 is now available. This version supports IBM Cloud Pak for Data version 4.6.x and Red Hat OpenShift versions 4.8 and 4.10. For more information, see [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-watson-speech).

Amazon Web Services (AWS) is now supported
: Watson Speech services for IBM Cloud Pak for Data are now supported on Amazon Web Services™ (AWS™). The services support Amazon Elastic Block Store, which you specify by setting the blockStorageClass property of the Speech services custom resource to gp2-csi or gp3-csi.

New storage classes are now supported
: Watson Speech services for IBM Cloud Pak for Data now support two additional storage classes:



* IBM Cloud Block Storage (ibmc-block-gold)
* NetApp Trident (ontap-nas)



You specify the storage class with the blockStorageClass property of the Speech services custom resource. For more information about all supported storage classes, see the following topics in [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-watson-speech):



* Before you begin in Installing Watson Speech services
* Specifying a storage class in Using the Watson Speech services custom resource
How do I know the data activities on the Secure Gateway Client? 

On SecureGateway Client, change the log level to TRACE to know the data activities on the client. The following information will be displayed after requests are sent.

Data size sent from request application:

[TRACE] Connection <connection ID> transmitted data: <size> bytes

Data size sent from destination:

[TRACE] Connection <connection ID> received data: <size> bytes





 How do I get the amount of the real-time connections on Secure Gateway? 



 To get connections information such as the amount of the real-time connections, the data size sent and received from Secure Gateway Client, do the following: 



* On Secure Gateway client interactive command line: Type s to print the connection status details.
* On Secure Gateway client UI, click the Connection Information menu



The following connection statistics would be displayed:



* Overall data size transmitted.
* Overall data size received.
* The amount of total connections.
* Real-time active connections.



Note: This connections information is on Client level, not in Gateway level. If you need connections information in Gateway level, please check each Client which connected to that Gateway.







 How many concurrent connections can Secure Gateway handle? 

If the connections are being rejected or having latency, the connections might be exceeding concurrent connections limit.

The Secure Gateway can handle only 250 concurrent connections. For details, see [Limitations](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-client-interactinglimits).

For SG client v186 and later, there will be error shown in SG client log in each 30 seconds when the concurrent connections exceed the limit on cloud side.





 What are the recommended configurations to make my connections more secure? 

Set these configuations to make connections more secure:



 Reject unauthorized 

To protect against Man-in-the-middle attack, reject connections to the resource which is not authorized with the list of supplied CAs. On the Resource Authentication, check the box Reject unauthorized, then upload the certificate if the certificate of the resource is self-signed.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an HTTP request smuggling issue in Twisted (CVE-2022-24801)](https://www.ibm.com/support/pages/node/6610098)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by a buffer overflow in Twisted (CVE-2022-21716)](https://www.ibm.com/support/pages/node/6610100)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by incomplete string comparison in NumPy (CVE-2021-34141)](https://www.ibm.com/support/pages/node/6610102)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by a buffer overflow in NumPy (CVE-2021-41496)](https://www.ibm.com/support/pages/node/6610104)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cookie and authorization header exposure in Twisted (CVE-2022-21712)](https://www.ibm.com/support/pages/node/6605065)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18311)](https://www.ibm.com/support/pages/node/6610118)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18312)](https://www.ibm.com/support/pages/node/6610122)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18313)](https://www.ibm.com/support/pages/node/6610124)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a sensitive information exposure in systemd (CVE-2022-4415)](https://www.ibm.com/support/pages/node/6988079)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python (CVE-2022-45061)](https://www.ibm.com/support/pages/node/6988081)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Libksba (CVE-2022-47629)](https://www.ibm.com/support/pages/node/6988083)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in GNU Tar (CVE-2022-48303)](https://www.ibm.com/support/pages/node/6988085)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in FasterXML jackson-databind (CVE-2022-42003)](https://www.ibm.com/support/pages/node/6988087)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Perl (CVE-2020-10878)](https://www.ibm.com/support/pages/node/6988089)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Apache Tomcat (CVE-2022-45143)](https://www.ibm.com/support/pages/node/6988091)
* CVE-2020-10543: Publication of the security bulletin is pending.







 29 March 2023 (Version 4.6.4) 

Version 4.6.4 is now available
: Speech to Text for IBM Cloud Pak for Data version 4.6.4 is now available.