vania-janet/multiturn-rag-retrieval-data huggingface dataset:
1.4.1 Ensure that the --profiling option is set to false. Scored 1 Pass IBM 
 1.4.2 Ensure that the --bind-address option is set to 127.0.0.1. Scored 1 Pass IBM 









 2 Etcd node configuration 

Review the Etcd Node Configuration results of the version 1.5 CIS Kubernetes benchmark.



Section 2 Etcd Node Configuration benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Scored 1 Pass IBM 
 2.2 Ensure that the --client-cert-auth option is set to true. Scored 1 Pass IBM 
 2.3 Ensure that the --auto-tls option is not set to true. Scored 1 Pass IBM 
 2.4 Ensure that the --peer-cert-file and --peer-key-file options are set as appropriate. Scored 1 Pass IBM 
 2.5 Ensure that the --peer-client-cert-auth option is set to true. Scored 1 Pass IBM 
 2.6 Ensure that the --peer-auto-tls option is not set to true. Scored 1 Pass IBM 
 2.7 Ensure that a unique Certificate Authority is used for etcd. Not Scored 2 Pass IBM 







 3 Control plane configuration 

Review the Control Plane Configuration results of the version 1.5 CIS Kubernetes benchmark.



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.1.1 Client certificate authentication should not be used for users. Not Scored 2 Pass Shared 







 3.2 Logging 



Section 3.2 Logging benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.2.1 Ensure that a minimal audit policy is created. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 3.2.2 Ensure that the audit policy covers key security concerns.
1.4.1 Ensure that the --profiling option is set to false. Scored 1 Pass IBM 
 1.4.2 Ensure that the --bind-address option is set to 127.0.0.1. Scored 1 Pass IBM 









 2 Etcd node configuration 

Review the Etcd Node Configuration results of the version 1.5 CIS Kubernetes benchmark.



Section 2 Etcd Node Configuration benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Scored 1 Pass IBM 
 2.2 Ensure that the --client-cert-auth option is set to true. Scored 1 Pass IBM 
 2.3 Ensure that the --auto-tls option is not set to true. Scored 1 Pass IBM 
 2.4 Ensure that the --peer-cert-file and --peer-key-file options are set as appropriate. Scored 1 Pass IBM 
 2.5 Ensure that the --peer-client-cert-auth option is set to true. Scored 1 Pass IBM 
 2.6 Ensure that the --peer-auto-tls option is not set to true. Scored 1 Pass IBM 
 2.7 Ensure that a unique Certificate Authority is used for etcd. Not Scored 2 Pass IBM 







 3 Control plane configuration 

Review the Control Plane Configuration results of the version 1.5 CIS Kubernetes benchmark.



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.1.1 Client certificate authentication should not be used for users. Not Scored 2 Pass Shared 







 3.2 Logging 



Section 3.2 Logging benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.2.1 Ensure that a minimal audit policy is created. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 
 3.2.2 Ensure that the audit policy covers key security concerns.
The minimum value is 0.

--limit (int64)
: The number of secrets to list.

The maximum value is 1000. The minimum value is 1.

--sort (string)
: Sort a collection of secrets by the specified field in ascending order. To sort in descending order use the - character

Available values: id | created_at | updated_at | expiration_date | secret_type | name

Usage: To sort a list of secrets by their creation date, use ../secrets?sort=created_at.

The maximum length is 17 characters. The minimum length is 2 characters. The value must match regular expression /^-?(id|created_at|updated_at|expiration_date|secret_type|name)$/.

--search (string)
: Filter secrets that contain the specified string in one or more of these fields: "id", "name", "description","labels", "secret_type".

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.?)/.

--groups ([]string)
: Filter secrets by groups.

The list items must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|default)$/. The maximum length is 201 items. The minimum length is 0 items.

--all-pages (bool)
: Invoke multiple requests to display all pages of the collection for secrets.





 Example 

ibmcloud secrets-manager secrets --offset=0 --limit=10 --sort=created_at --search=example --groups=default





 Example output 

Example secret metadata collection response

{
"first" : {
(enriched_text.entities.text:Google) AND IBM





 <=, >=, >, < [Numerical comparisons] 

Creates numerical comparisons of less than or equal to, greater than or equal to, greater than, and less than.

For example:

enriched_text.sentiment.document.score>0.679





 ^x [Score multiplier] 

Increases the score value of a search term.

For example:

enriched_text.concepts.text:IBM^3





 * [Wildcard] 

Matches unknown characters in a search expression. Do not use capital letters with wildcards.

For example:

enriched_text.entities.text:ib





 n [String variation] 

The number of one-character changes to make one string match another. For example, car1 matches car,cap,cat,can, and so on.

For example:

enriched_text.concepts.text:Watson3





 :* [Exists] 

Used to return all results where the specified field exists.

For example:

title:





 !* [Does not exist] 

Used to return all results that do not include the specified field.

For example:

title:!
Not Scored 2 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.7 Minimize the admission of containers with the NET_RAW capability. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.8 Minimize the admission of containers with added capabilities. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.9 Minimize the admission of containers with capabilities assigned. Not Scored 2 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 







 5.3 Network policies and CNI 



Section 5.3 Network policies and CNI benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.3.1 Ensure that the CNI in use supports network policies. Not Scored 1 Pass IBM 
 5.3.2 Ensure that all namespaces have network policies defined. Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.4.1 Prefer using secrets as files over secrets as environment variables. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.4.2 Consider external secret storage.
1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set Scored 1 Pass IBM 
 1.2.18 Ensure that the --insecure-bind-address argument is not set. Scored 1 Pass IBM 
 1.2.19 Ensure that the --insecure-port argument is set to 0. Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port argument is not set to 0. Scored 1 Pass IBM 
 1.2.21 Ensure that the --profiling argument is set to false. Scored 1 Pass IBM 
 1.2.22 Ensure that the --audit-log-path argument is set. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate.
The severity level for all TKE events is critical due to the sensitivity of the actions.

The following table lists the actions that are associated with each severity level.



Table 17. Severity level for Hyper Protect Crypto Services service actions

 Severity Actions 

 Critical hs-crypto.target-keystores.delete<br><br>hs-crypto.managed-keys.delete<br><br>hs-crypto.vaults.delete<br><br>hs-crypto.registrations.delete<br><br>hs-crypto.tke-cryptounit-admin.add<br><br>hs-crypto.tke-cryptounit-admin.remove<br><br>hs-crypto.tke-cryptounit-current-master-key-register.clear<br><br>hs-crypto.tke-cryptounit-new-master-key-register.clear<br><br>hs-crypto.tke-cryptounit-master-key-register.add<br><br>hs-crypto.tke-cryptounit-master-key-register.commit<br><br>hs-crypto.tke-cryptounit-master-key-register.activate<br><br>hs-crypto.tke-cryptounit-threshold.set<br><br>hs-crypto.tke-cryptounit.reset<br><br>hs-crypto.mtlscert-admin-key.create<br><br>hs-crypto.mtlscert-admin-key.update<br><br>hs-crypto.mtlscert-admin-key.delete<br><br>hs-crypto.mtlscert-cert.set<br><br>hs-crypto.mtlscert-cert.set<br><br>hs-crypto.keystore.deletekey<br><br>hs-crypto.keystore.deletekeystore<br><br>hs-crypto.keystore.updatekey
Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.2.2 Minimize the admission of containers wanting to share the host process ID namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.2.3 Minimize the admission of containers wanting to share the host IPC namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.2.4 Minimize the admission of containers wanting to share the host network namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.2.6 Minimize the admission of root containers. Not Scored 2 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.2.7 Minimize the admission of containers with the NET_RAW capability. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.2.8 Minimize the admission of containers with added capabilities.
Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) IBM 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Scored 1 Pass IBM 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) IBM 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is set if PodSecurityPolicy is not used. Not Scored 1 Pass IBM 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Scored 1 Pass IBM 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Scored 1 Pass IBM 
 1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 Pass IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Scored 1 Pass IBM 
 1.2.19 Ensure that the --insecure-port option is set to 0. Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port option is not set to 0. Scored 1 Pass IBM 
 1.2.21 Ensure that the --profiling option is set to false. Scored 1 Pass IBM 
 1.2.22 Ensure that the --audit-log-path option is set.
Not Scored 2 Pass IBM 







 3 Control plane configuration 

Review the Control Plane Configuration results of the version 1.5 CIS Kubernetes benchmark.



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.1.1 Client certificate authentication should not be used for users. Not Scored 2 Pass Shared 







 3.2 Logging 



Section 3.2 Logging benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.2.1 Ensure that a minimal audit policy is created. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) Shared 
 3.2.2 Ensure that the audit policy covers key security concerns. Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) Shared 









 4 Worker node security configuration 

Review the Worker Node Security Configuration results of the version 1.5 CIS Kubernetes benchmark.



 4.1 Worker node configuration files 



Section 4.1 Worker Node Configuration benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.2 Ensure that the kubelet service file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root. Scored 1 Pass IBM
Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.2.3 Minimize the admission of containers wanting to share the host IPC namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.2.4 Minimize the admission of containers wanting to share the host network namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.2.6 Minimize the admission of root containers. Not Scored 2 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.2.7 Minimize the admission of containers with the NET_RAW capability. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.2.8 Minimize the admission of containers with added capabilities. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.2.9 Minimize the admission of containers with capabilities assigned.
Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123) IBM 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Scored 1 Pass IBM 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123) IBM 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is set if PodSecurityPolicy is not used. Not Scored 1 Pass IBM 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Scored 1 Pass IBM 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Scored 1 Pass IBM 
 1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 Pass IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Scored 1 Pass IBM 
 1.2.19 Ensure that the --insecure-port option is set to 0. Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port option is not set to 0. Scored 1 Pass IBM 
 1.2.21 Ensure that the --profiling option is set to false. Scored 1 Pass IBM 
 1.2.22 Ensure that the --audit-log-path option is set.
For example, you might request to create a key with an invalid key and are not authenticated in the service instance. The unauthentication takes precedence and the event is evaluated as a 401 bad request call with a severity of critical.

The severity level for all TKE events is critical due to the sensitivity of the actions.

The following table lists the actions that are associated with each severity level:



Table 20. Severity level for Hyper Protect Crypto Services service actions

 Severity Actions 

 Critical hs-crypto.secrets.delete<br><br>hs-crypto.registrations.delete<br><br>hs-crypto.tke-cryptounit-admin.add<br><br>hs-crypto.tke-cryptounit-admin.remove<br><br>hs-crypto.tke-cryptounit-current-master-key-register.clear<br><br>hs-crypto.tke-cryptounit-new-master-key-register.clear<br><br>hs-crypto.tke-cryptounit-master-key-register.add<br><br>hs-crypto.tke-cryptounit-master-key-register.commit<br><br>hs-crypto.tke-cryptounit-master-key-register.activate<br><br>hs-crypto.tke-cryptounit-threshold.set<br><br>hs-crypto.tke-cryptounit.reset<br><br>hs-crypto.mtlscert-admin-key.create<br><br>hs-crypto.mtlscert-admin-key.update<br><br>hs-crypto.mtlscert-admin-key.delete<br><br>hs-crypto.mtlscert-cert.set<br><br>hs-crypto.mtlscert-cert.set<br><br>hs-crypto.keystore.deletekey<br><br>hs-crypto.keystore.deletekeystore<br><br>hs-crypto.keystore.updatekey
If the threshold is set to a number greater than 0.8, this function returns null.



SELECT TS_MATCH(ts4, TS_MATCHER_SUBSET_MS(0.8), ARRAY('a','b','d'))

Result:

[(0,'a'), (1,'b'), (3,c), (7,'d')]







 Set matching 

Set matching is similar to sequence matching, except that the sequence of the members of the specified array is unimportant. For example, consider the following string time series that contains five observations that is stored in a table column with the name ts4:

[(0,'a'), (1,'b'), (3,'c'), (7,'d'), (8,'e')]

The following SELECT statement returns the matching observations. The array [b,a,d] is a match because the matcher threshold is 0.4, and the three input values represent at least 60% of the entire sequence [a,b,c,d,e]. If the threshold is set to a number greater than 0.6, this function returns null.

SELECT TS_MATCH(ts4, TS_MATCHER_SUBSET_PS(0.6), ARRAY('b','a','d'))

Result: [(0,'a'), (1,'b'), (7,'d')]

The following SELECT statement returns the matching observations. The array [b,a,d] is a match because the matcher threshold is 0.75, and the three input values represent at least 75% of the match sublist [a,b,c,d]. If the threshold is set to a number greater than 0.75, this function returns null.

TS_MATCH(ts4, TS_MATCHER_SUBSET_PM(0.75), ARRAY('b','a','d'))

Result:

[(0,'a'), (1,'b'), (7,'d')]
{"begin": -1.0, "end": -0.9, "count": 0},
{"begin": -0.9, "end": -0.7, "count": 0},
{"begin": -0.7, "end": -0.5, "count": 0},
{"begin": -0.5, "end": -0.3, "count": 0},
{"begin": -0.3, "end": -0.1, "count": 0},
{"begin": -0.1, "end": 0.1, "count": 70},
{"begin": 0.1, "end": 0.3, "count": 0},
{"begin": 0.3, "end": 0.5, "count": 0},
{"begin": 0.5, "end": 0.7, "count": 0},
{"begin": 0.7, "end": 0.9, "count": 0},
{"begin": 0.9, "end": 1.0, "count": 0}
],
"clipping_rate": [
{"begin": 0.0, "end": 1e-05, "count": 70},
{"begin": 1e-05, "end": 0.0001, "count": 0},
{"begin": 0.0001, "end": 0.001, "count": 0},
{"begin": 0.001, "end": 0.01, "count": 0},
{"begin": 0.01, "end": 0.1, "count": 0},
{"begin": 0.1, "end": 1.0, "count": 0}
],
"speech_level": [
{"begin": 0.0, "end": 0.1, "count": 37},
For example, a threshold of 0.75 means that the specified pattern must match at least 75% of the match string, in sequence but not necessarily contiguously. If the threshold is met, the pattern is considered to match, and the function that uses the matcher returns the observations that correspond to the pattern; otherwise, the function returns null.

TS_MATCHER_SUBSEQ_MS(Double) Output: MatcherType
Creates a matcher that matches an array of string values (the pattern) with a subsequence of a string time series, to within the specified coverage threshold. The threshold is a double-precision number in the range 0.0 - 1.0 that indicates the minimum ratio of match string size to sequence size. For example, a threshold of 0.75 means that the specified pattern must match at least 75% of the sequence of time series values. If the threshold is met, the pattern is considered to match the subsequence and the function that uses the matcher returns the observations that correspond to the match string; otherwise, the function returns null.

TS_MATCHER_SUBSET_PS(Double) Output: MatcherType
Creates a matcher that matches an array of string values (the pattern) with a string time series, regardless of the order in the items in the pattern and the order in the time series. The specified coverage threshold is a double-precision number in the range 0.0 - 1.0 that indicates the minimum ratio of pattern size to sequence size. For example, a threshold of 0.75 means that the specified pattern must match at least 75% of the sequence of time series values. If the threshold is met, the pattern is considered to match, and the function that uses the matcher returns the observations that correspond to the pattern; otherwise, the function returns null.

TS_MATCHER_SUBSET_PM(Double) Output: MatcherType
Creates a matcher that matches an array of string values (the pattern) with a string time series, regardless of the order in which the items in the pattern occur in the time series. The specified coverage threshold is a double-precision number in the range 0.0 - 1.0 that indicates the minimum ratio of pattern size to match string size.