vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Let's say there's an attribute that is called team in the corporate user directory that identifies an employee's team by manager. Enter the condition team equals marla.



11. Click Add a condition again and click Add manually.



1. Let's say there's an attribute that is called job-role in the corporate user directory that identifies an employee's job role. Enter the condition job-role equals dev.



12. Set the session duration to 8 hours.
13. Click Continue.



For more information about the fields that are used to create conditions for trusted profiles, see [IAM condition properties](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties).





 Step 3: Assign access 

Marla created narrow conditions that authenticate only the developers on the team that are working in the chatbot test environment. Now she can create a policy to give them the [IBM Cloud service and platform access they need for the project.



1. Select Access policy
2. Select Kubernetes Service from the list of services. Click Next.
3. Scope the access to Specific resources based on selected attributes.
4. Select Resource group. Marla can select or input the name of the resource group that's created for the chatbot project.
5. Select Viewer and Reader roles to define the scope of access, and click Review.
6. Click Add to add your policy configuration to your policy summary.
7. Select IBM Watson® Tone Analyzer from the list of services.
8. Scope the access to Specific resources based on selected attributes.
9. Select Resource group. Marla can select or input the name of the resource group that's created for the chatbot project.
10. Select Viewer and Reader roles to define the scope of access, and click Review.
11. Click Add to add your policy configuration to your policy summary.
12. Review the profile summary and click Create.







 Next steps
CP-2 (1) - Coordinate with Related Plans 



  Control requirements 

CP-2 (1) - 0
:   The organization coordinates contingency plan development with organizational elements responsible for related plans.





  NIST supplemental guidance 

Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, Insider Threat Implementation Plan, and Occupant Emergency Plans.
Create applications that match business and IT services. For example, Application=SAP, Sub-Applications=SAP Front End, SAP Middle Tier, and SAP Back End. Business Impact Value corresponds to an application and compliance regimes apply to an application.
5. Remote Access - Remote Access is required to run scans on assets, can be a default service account or an asset-specific account.
6. Task Scheduler - Schedule scans to run on a periodic basis. The types of tasks include; SCAP Scan-Vulnerability, SCAP Scan-XCCDF, NSX Flow Scan, Software Scan, Log Extract Scan.



The following information is collected from the user at time of order and is used in the application setup.



Table 1. Information collected from the user

 Setup stage Parameter 

 Organization / Asset repositories Organization name 
 Organization Phone Number 
 Organization Email 
 Organization / Asset Repositories Address Line 1 
 Cloud Provider / Asset Repositories Name 
 Cloud Provider Description 
 Cloud Provider POC email 
 Cloud Provider Type 
 Cloud Provider POC Name 
 Cloud Provider POC Phone 



The following default information is used in the application setup.



Table 2. Default information used in application setup

 Setup stage Parameter 

 Environment Environment Name is set to “Initial” 
 Environment Score is set to 5 
 Asset Repository Two Asset Repositories are configured; vCenter and NSX Manager. Host URL set to https://vCenter_fqdn and https://NSX Manager_fqdn 
 Asset Repository Two Asset Repositories are configured; vCenter and NSX Manager, both use the same username. Username set to vCenter administrator username 
 Asset Repository Two Asset Repositories are configured; vCenter and NSX Manager, both use the same password. Password is set to vCenter administrator password 
 Asset Repository Two Asset Repositories are configured; vCenter and NSX Manager, both use the same password. Type is set to vCenter for one repository and NSX for the other 
 Task Four tasks are set up; Asset Scan, NSX Flows, VMware® Infrastructure Scan, and VMware Vulnerability.
If your application to the program is approved, awarded credits are referred to as the Technology Incubator Program on an IBM Cloud Invoice. For more information about the program and its credits, see [Startup with IBM FAQs](https://developer.ibm.com/startups/faq).





 What is IBM PartnerWorld? 

[IBM PartnerWorld Program](https://www.ibm.com/partnerworld/resources) is an IBM corporate program that provides access to the IBM product portfolio including the IBM Cloud Platform. Acceptance decisions, length of participation, awarding of credits, and any possible extensions are made by the IBM PartnerWorld Team and not IBM Cloud Support.

For more information about the program, contact the [IBM PartnerWorld Team](https://www.ibm.com/partnerworld/resources/support).
Set and unset credentials that allow you to access the classic IBM Cloud infrastructure portfolio through your IBM Cloud account.

You can manually set infrastructure credentials to a different account only for classic clusters, not for VPC clusters.



 ibmcloud oc credential get 

Classic infrastructure

If you set up your IBM Cloud account to use different credentials to access the IBM Cloud infrastructure portfolio, get the infrastructure username for the region and resource group that you are currently targeted to.

ibmcloud oc credential get --region REGION [-q] [--output json]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--region REGION
: Specify a region in Red Hat OpenShift on IBM Cloud: jp-osa, jp-tok, au-syd, eu-de, eu-gb, us-east, or us-south.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example credential get command 

ibmcloud oc credential get --region us-south







 ibmcloud oc credential set classic 

Classic infrastructure

Set credentials for a resource group and region so that you can access the IBM Cloud infrastructure portfolio through your IBM Cloud account.

If you have an IBM Cloud Pay-As-You-Go account, you have access to the IBM Cloud infrastructure portfolio by default. However, you might want to use a different, existing IBM Cloud infrastructure account to order infrastructure. You can link this infrastructure account to your IBM Cloud account by using this command.

If IBM Cloud infrastructure credentials are manually set for a region and a resource group, these credentials are used to order infrastructure for all clusters within that region in the resource group. These credentials are used to determine infrastructure permissions, even if an [IBM Cloud IAM API key](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_api_key_info) exists for the resource group and region.
Detailed design 

The following diagram and descriptions provide information about the RiskForesight™ application components.

Zoom

![Application components](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/caveonix-app-components.svg)

Figure 1. Application components



* Graphical user interface - The web interface that you can use to access RiskForesight application.
* Central Collector - Collects different types of data payload that come from the plug-ins and make it available in the messaging store. RiskForesight supports the following types of payloads:



* Scan
* Logs
* Netflow
* Software
* Workload metadata



* Central Router - Manages all integration touch points with the VMware® Orchestration layer. All the RiskForesight plug-ins must communicate with the Central Router to get authorized to communicate with the RiskForesight ecosystem.
* Application Routing Server - Is the REST endpoint middleware that connects the GUI and the backend data stores. Also, it validates the user access requests and manages the RBAC.
* vCenter Data Collector - The plug-in extracts the virtual machine (VM) details from vCenter. The generic plug-in uses the VMware APIs to connect to vCenter and extracts workload-relevant information. After the information is available, the plug-in packages the payload and sends it to the Central Collector.
* vCD Data Collector - The plug-in extracts the VM details from the VMware Cloud Director. The generic plug-in uses the VMware APIs to connect to the VMware Cloud Director and extracts the workload-related information. After the information is available, the plug-in packages the payload and sends it to the Central Collector.
* vCD Network Data Collector - The plug-in extracts Netflow details from the VMware vCD. The generic plug-in uses the VMware APIs to connect to the VMware NSX and extracts Network, FW, Security Rules, and Security Groups.
CP-4 (1) - Coordinate with Related Plans 



  Control requirements 

CP-4 (1) - 0
:   The organization coordinates contingency plan testing with organizational elements responsible for related plans.





  Additional IBM Cloud for Financial Services specifications 



*  To ensure response times can be met, testing must be performed by all appropriate parties, including response teams, executives, management, and 3rd/4th party resources as needed.







  NIST supplemental guidance 

Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, and Occupant Emergency Plans. This control enhancement does not require organizations to create organizational elements to handle related plans or to align such elements with specific plans. It does require, however, that if such organizational elements are responsible for related plans, organizations should coordinate with those elements.
The DevSecOps Deployable Architecture creates a set of DevOps toolchains and pipelines.

Deployable![deployment guide icon](https://cloud.ibm.com/media/docs/images/homepage/deployment-guide.svg) [Enhance cloud security by applying context-based restrictions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cbr-enhanced-security)Enhance cloud security by applying context-based restrictions Solution tutorial

This tutorial walks you through the process of implementing context-based restrictions (CBRs) in your IBM Cloud account. CBRs help you to secure the cloud environment further and move towards a zero trust security model.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Enhance security of your deployed application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-extended-app-security)Enhance security of your deployed application Solution tutorial

You already developed and deployed an application on IBM Cloud. You already followed the introductory tutorial on how to apply end to end security to an application. Following "security by design", you now start to look into the design of a new application, or you need to adapt an older application to new security requirements. This tutorial walks you through options for applications with advanced security requirements. It looks into enhanced data encryption, isolation of compute runtimes and network traffic, and by using activity logs to look for suspicious activities.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Enterprise account architecture](https://cloud.ibm.com/docs/enterprise-account-architecture)Enterprise account architecture White paper

A generalized recommendation for how large customers should configure and govern IBM Cloud at scale.

!
[Cluster 1 master](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutcomponents-satellite-location-control-plane-workers) <br>⁣9. [Cluster 2 master](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutcomponents-satellite-location-control-plane-workers) 
 ⁣10. [Workload cluster 1](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutcomponents-satellite-location-workload-clusters) <br>⁣10. [Workload cluster 2](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutcomponents-satellite-location-workload-clusters) 



Satellite also supports deployments to other public cloud providers. However, we do not explore that feature in this reference architecture.





 Financial Services Validated services 

The reference architecture depends upon services that are [IBM Cloud for Financial Services Validated](https://cloud.ibm.com/catalog?search=label%3Afs_ready). These services are designated to have evidenced compliance to the controls of the IBM Cloud Framework for Financial Services. Financial Services Validated services are designed to help address the requirements of financial institutions for regulatory compliance, security, and resiliency.

When properly configured and managed, services that are Financial Services Validated work together so you can deliver a solution that conforms to the best practices of the IBM Cloud Framework for Financial Services. The following table shows the required services that are included in the Satellite reference architecture and the complementary optional services that are available.

Generally speaking, you should strive to use only services which are Financial Services Validated in your solutions. However, depending on your circumstance there may be exceptions.
High availability for Container Registry 

The IBM Cloud® Container Registry service is a highly available, regional, service.

High availability(HA) is a core discipline in an IT infrastructure to keep your apps up and running, even after a partial or full site failure. The main purpose of high availability is to eliminate potential points of failures in an IT infrastructure.



* In each supported region, traffic is load balanced across registry infrastructure in multiple

availability zones, with no single point of failure.
* Data that is stored in IBM Cloud Container Registry is replicated over the availability zones and it is also backed up in another region regularly.
* If you're worried about the availability of your images if an entire region is unavailable, you can choose to push your images to multiple registry regions.

You might also choose to push your images to multiple registry regions in case you accidentally delete or overwrite your images.

For more information about regions, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).



For more information about service availability, see [Service Level Agreements](https://cloud.ibm.com/docs/overview?topic=overview-slas).



 Ownership of responsibilities 

To find out more about responsibility ownership for using IBM Cloud products between IBM and the customer, see [Shared responsibilities for IBM Cloud products](https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities).

For more information about your responsibilities when you are using IBM Cloud Container Registry, see [Shared responsibilities for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_responsibilities).





 What level of availability do I need? 

You can achieve high availability on different levels in your IT infrastructure and within different components of your cluster. The level of availability that is appropriate for you depends on several factors, such as your business requirements, the service level agreements (SLAs) that you have with your customers, and the resources that you want to expend.





 What level of availability does IBM Cloud offer? 

The level of availability that you set up for your cluster impacts your coverage under the IBM Cloud high availability service level agreement terms.
IBM Cloud Kubernetes Service provides spin-up of compute by using open-source standard technology. After the company moved to IBM Cloud Kubernetes Service, Developers have access to DevOps friendly tools, such as portable and easily shared containers.

Then, Developers can experiment easily, pushing changes to Development and Test systems quickly with open toolchains. Their traditional development tools get a new face when they add on AI cloud services to apps with a click.



 Context 

Streamlining developer productivity and deploying AI tools to partners 4 times faster**



* Disruption is rampant in the payment industry that also has dramatic growth both in the consumer and business-to-business segments. But updates to payment tools were slow.
* Cognitive features are needed to target fraudulent transactions in new and faster ways.
* With the growing numbers of partners and their transactions, the tool traffic increases, but their infrastructure budget needs to decrease, by maximizing efficiency of the resources.
* Their technical debt is growing, not shrinking from an inability to release quality software to keep up with market demands.
* Capital expense budgets are under tight control, and IT feels they don't have the budget or staff to create the testing and staging landscapes with their in-house systems.
* Security is increasingly a primary concern, and this concern only adds to the delivery burden that all cause even more delays.







 Solution 

The Development Exec is faced with many challenges in the dynamic payment industry. Regulations, consumer behaviors, fraud, competitors, and market infrastructures are all rapidly evolving. Fast-paced development is essential to being part of the future payment world.

Their business model is to provide payment tools to business partners, so they can help these financial institutions and other organizations deliver security-rich digital payment experiences.

They need a solution that helps the Developers and their business partners:



* FRONT-END TO PAYMENT TOOLS: fee systems, payment tracking including cross-border, regulatory compliance, biometrics, remittance, and more
* REGULATION-SPECIFIC FEATURES: each country has unique regulations so that the overall toolset might look similar but show country-specific benefits
* DEVELOPER-FRIENDLY TOOLS that accelerate roll-out of features and bug fixes
* FRAUD DETECTION AS A SERVICE (FDaaS) uses Watson AI to keep one step ahead of frequent and growing fraudulent actions
The IBM Cloud infrastructure credentials that are set by the ibmcloud oc credential set command persist after your session ends. If you remove IBM Cloud infrastructure credentials that were manually set with the [ibmcloud oc credential unset --region <region>](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_credentials_unset) command, the credentials of the Pay-As-You-Go or Subscription account are used instead. However, this change in infrastructure account credentials might cause [orphaned clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster_infra_errors).

Before you begin:



* If you are not using the account owner's credentials, [ensure that the user whose credentials you want to set for the API key has the correct permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsowner_permissions).
* [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).



To set infrastructure account credentials to access the IBM Cloud infrastructure portfolio:



1. Get the infrastructure account that you want to use to access the IBM Cloud infrastructure portfolio. You have different options that depend on your [current account type](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsunderstand_infra).
2. Find and record your infrastructure username, it will be used when you set API credentials.

ibmcloud oc ibmcloud sl user list



1. Set the infrastructure API credentials to use.

ibmcloud oc credential set classic --infrastructure-username <infrastructure_API_username> --infrastructure-api-key <infrastructure_API_authentication_key> --region <region>
2. Verify that the correct credentials are set.

ibmcloud oc credential get --region <region>

Example output
Name: myproject
ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Subdomain: aabon2dfwa0
Domain: us-south.codeengine.appdomain.cloud
Region: us-south
Kubectl Context: 4svg40kna19

Kubernetes Config:
Context: aabon2dfwa0
Environment Variable: export KUBECONFIG=/user/myusername/.bluemix/plugins/code-engine/myproject-01234567-abcd-abcd-abcd-abcdabcd1111.yaml

Then, copy the export command, paste it into your command-line interface, and run it.



Verify that your environment is set correctly by running the kubectl config command.

kubectl config current-context

If the context is correctly set, the output matches the Kubectl Context value of your project. For example, if your Kubectl Context value of your project is 4svg40kna19, the command returns 4svg40kna19.

For more information about Kubernetes and how it works with Code Engine architecture, see [Learning about Code Engine architecture and workload isolation](https://cloud.ibm.com/docs/codeengine?topic=codeengine-architecture).





 Required access authorities to work with Kubernetes API 

After you set up your environment, you can interact with Kubernetes API. You must have the correct level of authority for specific tasks. These roles are set in Identity and access management. See [IBM Cloud service roles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamservice).



Table 1. Kubernetes authorities

 Resource Manager role Writer role Reader role 

 serviceaccounts get, list, watch get, list, watch None
Architecture overview for Caveonix RiskForesight 

The Caveonix RiskForesight™ architecture is shown in the following diagram.

Zoom

![Architecture diagram](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/caveonix-architecture.svg)

Figure 1. Architecture for Caveonix RiskForesight

Caveonix RiskForesight architecture has four layers:



* Detect - The Detect module is fully integrated into the VMware® stack and many public clouds. By using plug-ins, RiskForesight uses vCenter and NSX Manager as Asset Repositories, collecting details on virtual machines (VMs), networks, and network flows. Remote Collectors scan workloads, operating systems, and applications to allow a "full-stack" view of compliance and vulnerabilities.
* Predict - The Predict module uses analytics to identify risky assets and mitigation steps with risk reduction models to improve the risk posture.
* Act - The Act module implements the mitigation steps based on prioritization and automated protective actions to provide proactive workload protection from risks due to cyberthreats.



* RMCP – The Risk Management Control Plane (RMCP) provides continuous and proactive protection of the workloads, by monitoring the full-stack within private, public, and managed cloud data centers.
* Policy Manager - Currently supports three types of machine learning jobs per organization; Caveo Logs, Caveo Networks, Caveo Scan. Based on the anomalies found in the data, you can configure the policies and actions for user-defined conditions. These actions might include selecting the job type, configuring Boolean conditions for the Anomaly score, and defining the action when the condition is true. For example,



* Job: "Caveo Logs" Anomaly score is > 90 then Mark asset for quarantine and send notification to slack Channel.
* Job: "Caveo Network" Anomaly score is > 95 then quarantine the asset and send email notification and also send UI notification.