vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Using the CIS Security Events capability 

Reviewing Security Events gives you insight into your web traffic and into any potentially malicious activity against your website. Reviewing Security Events also helps you optimize your WAF configuration.



 The CIS Security Events Table 

The Security Events Table shows you detailed information about web requests that are blocked by the WAF. Each entry shows one blocked request.



* Triggered rule indicates which rule blocked the request. Any of the following actions is available:



* Block: A hard block.
* Challenge: A CAPTCHA page that humans can bypass.
* Simulate: A request that is allowed through normally, but is logged.





Sometimes the triggered rule is not identified. In this case the UI shows a - instead of the rule ID.



* IP Address: Shows the source IP address of the web request.
* Location: Shows the country associated with the source IP of the web request.
* Host: Shows the hostname of the server that has been reached by the web request.
* Date: Shows the day the event occurred.







 CIS Security Events Details 

When viewing Security Events, you can click the arrow on an event to expand the details for that event. One section of your screen shows the event details, along with the Ray-Id. The other section shows request details such as Header, URI, Protocol, the type of firewall that blocked the request, and User Agent.

Suppose, for example, you see that the triggered rule for an event has an ID of 981176. This means that the block was caused by OWASP. When any rules in the OWASP ruleset is matched, the “threat score” of the request increases. The Sensitivity setting (Low or High) for your zone translates to a threshold. If the cumulative score of all the matched OWASP rules exceeds that threshold, rule 981176 is triggered and blocks the request.

This means that all requests blocked by OWASP show on your Security Events as blocked by 981176. Expand the event details and view the Event Triggers section to see the individual OWASP rules that matched to increase the request’s threat score.





 What do I do if valid traffic is blocked? 

Expand each event to see event details.
Manage the certificates used to secure traffic to your site.





 Origin 

Manage the TLS certificates that encrypt traffic between your origin server and your users.





 Rate limiting 

Use rate limiting rules to protect your site or API from malicious traffic by blocking client IP addresses that match a URL pattern or exceed a defined threshold.





 Traffic scrubbing 

CIS offers 192 Tbps of global network edge capacity and can mitigate DDoS attacks that have extremely high packet and HTTP request rates.

When a DDoS attack occurs, CIS doesn't use scrubbing centers; the activity is analyzed on the edge, which helps to mitigate DDoS attacks closest to the source.

Traffic that is identified as being "dirty" or part of an attack is not included in the billing. Customers are being billed for protected traffic, which consists of clean traffic that is forwarded to the origin and responses that are returned from the edge to the client.





 Web Application Firewall (WAF) 

WAF is implemented through two rule sets: [OWASP](https://cloud.ibm.com/docs/cis?topic=cis-waf-settingsowasp-rule-set-for-waf) and [CIS](https://cloud.ibm.com/docs/cis?topic=cis-waf-settingscis-ruleset-for-waf).





 IP firewall 

IBM Cloud Internet Services offers several tools for controlling your traffic so that you protect your domains, URLs, and directories against volumes of traffic, certain groups of requesters, and particular requesting IPs.



 IP rules 

With IP rules you can control access for specific IP addresses, IP ranges, specific countries, specific ASNs, and certain CIDR blocks. Available actions on incoming requests are:



* Allowlist
* Block
* Challenge (Captcha)
* JavaScript challenge (Defense mode)



For example, if you notice that a particular IP is causing malicious requests, you can block that user by IP address.

IP rules apply to TCP, HTTP, and HTTPS [Range](https://cloud.ibm.com/docs/cis?topic=cis-cis-range) apps, because IP rules are applied to Open System Interconnection (OSI) Layer 3 and Layer 4.
* The automated deployment of application artifacts, configurations, and supporting resources or services.
* Testing, validation, and other development event-generated behavior that is triggered as the result of a development process.



The usage behaviors that are not permitted include, but are not limited to, these behaviors:



* The use of pipeline jobs or workers for general compute behaviors, such as Bitcoin mining, distributed denial-of-service attacks, and malicious or offensive behavior to other clients or users within the IBM Cloud platform or general internet users.
* The use in the normal development process for sites or services that promote hate speech, or other activities that violate the [IBM Business Conduct Guidelines](https://www.ibm.com/investor/att/pdf/BCG_accessible_2020.pdf).
* The use of event-generated behavior for malicious intrusion or attacks against IBM Cloud or other sites.



At the discretion of IBM, users who violate the acceptable usage behaviors of the Continuous Delivery services or the IBM Business Conduct Guidelines can be disabled without notice. At the discretion of IBM, some services can be restored if users correct their usage behaviors after they are notified of the offensive action. Otherwise, accounts can be suspended or terminated.





 Git Repos and Issue Tracking limitations 

Git Repos and Issue Tracking is built on GitLab Community Edition and hosted by IBM on IBM Cloud, however, a few GitLab options are not available:



* Because Delivery Pipeline provides continuous integration and continuous delivery for IBM Cloud, the continuous integration features in GitLab are not supported.
* GitLab admin functions are not available because they are managed by IBM.
* Git Repos and Issue Tracking might not be fully accessible.







 Git Repos and Issue Tracking user information and content 

Three types of Git Repos and Issue Tracking projects are available:



* Public projects are visible to all site visitors. The content in a public project is visible to everyone who accesses Continuous Delivery, even if they are not invited to the project.
* Private projects are visible to select users only. For more information about granting users access to a project, see [Project members](https://us-south.git.cloud.ibm.com/help/user/project/members/index.md).
Available Cloudflare fields

 Field name Type Example value Notes 

 cf.client.bot Boolean true This field indicates whether the request is coming from a known bot or crawler, regardless of good or bad intent. 
 cf.threat_score Number A 0-100 value This field represents a risk score, 0 indicates low risk as determined by Cloudflare. Values above 10 can represent spammers or bots, and values above 40 point to bad actors on the internet. It is rare to see values above 60, so tune your firewall rules to challenge those above 10, and to block those above 50. 









 Functions 

The firewall rules language has a number of functions to convert fields.

These are not currently supported in the CIS UI Visual Expression Builder.



Table 3. Firewall rules functions

 Function name Argument types Return type Usage example Notes 

 lower String String lower(http.host) == "www.example.com" Converts a string field to lowercase. Only uppercase ASCII bytes are being converted, every other bytes are left as-is. 
 upper String String upper(http.host) == "www.example.com" Converts a string field to uppercase. Only lowercase ASCII bytes are being converted, every other bytes are left as-is. 







 Expressions 

An expression returns true or false based on a match against incoming traffic. For example:

http.host eq "www.example.com" and ip.src in 92.182.212.0/24

In this example, two single expressions comprise a compound expression. Think of each single expression as a condition. Each condition is evaluated individually before applying and logic to determine the final result of the compound expression.

Looking at the first single expression, you can see that it contains:



* a field - http.host
* a comparison operator - eq
* a value - "www.example.com"



Not all conditions have the same structure. Additional examples using different structures are discussed in the next section.



 Comparison operators 

The following comparison operators are available for use in expressions:



Table 4. Comparison operators for expressions

 English C-like Description 

 eq == Equal 
 ne != Not equal
For more information about the parameter, see [Configuration](https://integrations.us-south.assistant.watson.cloud.ibm.com/web/developer-documentation/api-configuration).





 26 March 2020 

The Covid-19 content catalog is available in Brazilian Portuguese, French, and Spanish
: The content catalog defines a group of intents that recognize the common types of questions people ask about the novel coronavirus. You can use the catalog to jump-start development of chatbots that can answer questions about the virus and help to minimize the anxiety and misinformation associated with it. For more information about how to add a content catalog to your skill, see [Using content catalogs](https://cloud.ibm.com/docs/assistant?topic=assistant-catalog).





 19 March 2020 

A Covid-19 content catalog is available
: The English-only content catalog defines a group of intents that recognize the common types of questions people ask about the novel coronavirus. The World Health Organization characterized COVID-19 as a pandemic on 11 March 2020. You can use the catalog to jump-start development of chatbots that can answer questions about the virus and help to minimize the anxiety and misinformation associated with it. For more information about how to add a content catalog to your skill, see [Using content catalogs](https://cloud.ibm.com/docs/assistant?topic=assistant-catalog).

Fixed a problem with missing User Conversation data
: A recent change resulted in no logs being shown in the User Conversations page unless you had a skill as the chosen data source. And the chosen skill had to be the same skill (with same skill ID) that was connected to the assistant when the user messages were submitted.





 18 March 2020 

Technology preview is discontinued
: The technology preview user interface was replaced with the Watson Assistant standard user interface. If you used an Actions page to create actions and steps for your skill previously, you cannot access the Actions page anymore. Instead, use the Intents and Dialog pages to work with your skill.





 16 March 2020 

Instructions updated for Slack integrations
: The steps required to set up a Slack integration have changed to reflect permission assignment changes that were made by Slack.
See [Controls](https://cloud.ibm.com/docs/assistant?topic=assistant-logs-overviewlogs-overview-controls) for more information.

Pattern limit expanded
: When using the Patterns field to [define specific patterns for an entity value](https://cloud.ibm.com/docs/assistant?topic=assistant-entitiesentities-patterns), the pattern (regular expression) is now limited to 512 characters.





 2 July 2018 

Jump-tos from conditional responses
: You can now configure a conditional response to jump directly to another node. See [Conditional responses](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-overviewdialog-overview-multiple) for more details.





 21 June 2018 

Language updates for system entities
: Dutch and Simplified Chinese language support are now generally available. Dutch language support includes fuzzy matching for misspellings. Traditional Chinese language support includes the availability of [system entities](https://cloud.ibm.com/docs/assistant?topic=assistant-system-entities) in beta release. See [Supported languages](https://cloud.ibm.com/docs/assistant?topic=assistant-language-support) for details.





 14 June 2018 

Washington, DC data center opens
: You can now create Watson Assistant service instances that are hosted in the Washington, DC data center. See [Data centers](https://cloud.ibm.com/docs/assistant?topic=assistant-services-informationservices-information-regions) for more details.

New API authentication process
: The Watson Assistant service has a new API authentication process for service instances that are hosted in the following regions:



* Washington, DC (us-east) as of 14 June 2018
* Sydney, Australia (au-syd) as of 7 May 2018



IBM Cloud® is migrating to token-based Identity and Access Management (IAM) authentication.

For new service instances in the regions listed, you use IAM for authentication. You can pass either a bearer token or an API key. Tokens support authenticated requests without embedding service credentials in every call.
CIS does cache a website's robots.txt. You can cache additional content by creating page rules.





 Understanding CIS cache responses 

The output of the CF-Cache-Status header shows whether a resource is cached.



Table 2. Cache response codes and definitions

 Response code Definition 

 HIT The resource was found in the CIS cache. 
 MISS The resource was not found in the CIS cache and was served from the origin web server. 
 EXPIRED The resource was found in cache but has since expired and was served from the origin web server. 
 STALE The resource was served from cache but is expired. CIS couldn’t contact the origin to retrieve the updated resource. 
 BYPASS The origin server instructed CIS to bypass cache via a cache-control header set to no-cache, private, or max-age=0. BYPASS is returned when enabling origin cache-control. CIS also sets BYPASS when your origin web server sends cookies in the response header. 
 REVALIDATED The resource is served from cache but is stale. The resource was revalidated by either an If-Modified-Since header or an If-None-Match header. 
 UPDATING The resource was served from cache but is expired. The resource is currently being updated by the origin web server. UPDATING is typically seen only for very popular cached resources. 
 DYNAMIC The resource was not cached by default and your current CIS caching configuration doesn't instruct CIS to cache the resource. Instead, the resource was requested from the origin web server. Use page rules to implement custom caching options. 







 Using query string sorting 

Enterprise Only CIS treats URLs that have query strings in different orders as separate files in the cache. This means that if one user requests:

/video/123456?title=0&byline=0&portrait=0&color=987654

And another user requests:

/video/123456?byline=0&color=987654&portrait=0&title=0

CIS goes back to the origin, even though we have the file in our cache.

Query String Sort sorts the query strings before they hit our cache, resulting in a higher cache hit rate.
* notes: Some useful information about this rule to help identify the purpose of it.







Sample JSON data:

{
"mode": "challenge",
"notes": "This rule is added because of event X that occurred on date xyz",
}



* For --type ua-rules: The JSON data describing a user-agent rule as follows.



* Required fields are mode, configuration.



* mode: The type of action to perform. Valid values: block, challenge, js_challenge.
* configuration: Target/Value pair to use for this rule.



* target: The request property to target. Valid values: ua.
* value: The exact UserAgent string to match with this rule.





* Option fields are paused, description.



* paused: Whether this rule is currently disabled.
* description: Some useful information about this rule to help identify the purpose of it.





Sample JSON data:



{
"mode": "block",
"configuration": {
"target": "ua",
"value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.1.1 Safari/603.2.4"
}
}



* For --type lockdowns: The JSON data describing a lockdown rule as follows.



* Required fields are urls, configurations.



* urls: URLs to be included in this rule definition.



* Wildcards are permitted.
* The URL pattern entered here will be escaped before use.
* This limits the URL to just simple wildcard patterns.



* configurations: List of IP addresses or CIDR ranges to use for this rule.



* This can include any number of ip or ip_range configurations that can access the provided URLs.
* target: The request property to target. Valid values: ip, ip_range.
* value: IP addresses or CIDR. If target is ip, then value should be an IP addresses, otherwise CIDR.
Actions



Table 125. Platform roles - Watson Machine Learning
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 







 Portworx Enterprise 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use portworx for the service name.

Platform roles

Actions



Table 126. Platform roles - Portworx Enterprise
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 







 Portworx Test 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use portworx-test for the service name.

Platform roles

Actions



Table 127. Platform roles - Portworx Test
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users.
These attacks consist of a flood of traffic at ISO Layer 3 (the network layer), such as ICMP floods, or at Layer 4 (the transport layer), such as TCP SYN floods or reflected UDP floods. These attacks send malicious ISO Layer-7 requests (the application layer), such as GET floods. 
 Automatically blocked at CIS edge CIS handles these attacks with Defense mode, WAF, and security-level settings. 







 On-demand anti-DDoS 

IBM Cloud Internet Services ingests traffic by returning a CIS IP address on the DNS lookup for a domain, instead of the actual record for the origin server’s IP address. This allows CIS to ingest, single-pass inspect, and re-encrypt data before sending it to the origin server destination. CIS can also act in DNS-only mode, returning the actual DNS record without obfuscating the IP, which disables DDoS and the other functions of CIS. To enable CIS protections, switch the "proxy" slider next to each DNS record to on; to disable protections, switch to off.





 Unlimited DDoS mitigation 

DDoS mitigation is typically an expensive service that can grow in cost when under attack. Unlimited DDoS mitigation is included with CIS at no additional cost.





 Mitigate Layer 7 attacks (configuration) 

Though DDoS is enabled by default in CIS, you can further configure Layer 7 security by:



* Configuring WAF ruleset sensitivity and response behavior
* Adding rate limiting
* Adding firewall rules



Use these features to customize Layer 7 mitigation of both volumetric and non-volumetric attacks.





 Mitigate non volumetric attacks 

CIS WAF contains rulesets to mitigate non-volumetric attacks, including cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection. For additional information about WAF, see [Web Application Firewall concepts](https://cloud.ibm.com/docs/cis?topic=cis-waf-q-and-awhat-types-of-attacks-can-waf-prevent).





 Cost protection
Since then, support for more languages has been added. This algorithm version was stabilized in December 2022 with minor enhancements since that time.

With this new release, the June 1, 2022 version is now labeled as Previous (01 Jun 2022). The oldest release labeled as 01 Jan 2022 is no longer available for training. As of now, the new Beta version has the same behavior as the Latest (20 Dec 2022) version. Updates to the Beta version will be released soon.

For more information, see [Algorithm version and training](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-algorithm-version).





 6 March 2023 

Improvements to algorithm version beta
: Improvements to the current Beta algorithm version include:



* Relevant examples are expected to get higher confidence
* For Spanish-language assistants, intent detection is improved in the presence of direct entity references
* Intent detection is more stable regarding occurrence of numerics, such as postal codes
* Intent detection now accounts for fuzzy closed entity mentions
* For German-language assistants, intent detection is more robust in the presence of umlauts



For more information, see [Algorithm version](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-algorithm-version).





 26 January 2023 

Intent recommendations and intent user example recommendations discontinued
: As of this release, intent recommendations and intent user example recommendations are discontinued. Intent recommendations has been removed from the Intents page and Recommended examples has been removed from intents. In the new Watson Assistant experience, you can [use unrecognized requests to get action recommendations](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-analytics-recognition).





 18 January 2023 

Algorithm version stability improvement
: As of this date, the Latest (01 Jun 2022) and Beta algorithm versions now have more stable behavior across retrained models, in the presence of overlapping entities (the same entity value belonging to more than one entity type). Previously, when there were overlapping entities definitions, confidences could differ across different retraining. With this improvement, you can expect to see similar confidences.