vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Add Security and Compliance Center scan 

Add the scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. Select the profile that you scanned.
2. Select the Security and Compliance Center scan.
3. Click Add scan.
4. Click Next.









 Review requirements 

You must complete validation and any other requirements to publish your virtual server image.





 Next steps 

The virtual server image isn't yet publicly available to other accounts. Use a REST API to make the image public so that users can use it to create virtual server instances. For more information, see [Update the visibility of your image](https://github.com/IBM-Cloud/isv-vsi-product-deploy-sampleupdate-the-visibility-of-your-image-patch-api).

After you make the virtual server image public, you can return to the Partner Center and publish it to the catalog. For more information, see [Publishing a virtual server image to the IBM Cloud catalog](https://cloud.ibm.com/docs/sell?topic=sell-vsimage-publish).
baseimage-auth-password SECRET The credentials for the base image of the application Dockerfile that is required by the Code Risk Analyzer scan. Optional 
 cra-cveignore-path text The path to the cveignore file that is relative to the root of the application repo. The default file path is .cra/.cveignore. Optional 
 cra-custom-script-path text The path to a custom script that runs before Code Risk Analyzer scanning. This script is sourced to provide the option to set ENV variables in the context of the Code Risk Analyzer BOM tool. Optional 
 cra-docker-buildflags text The custom Docker build command for build stage scanning. This parameter is empty by default. Optional 
 cra-docker-build-context text If specified, Code Risk Analyzer uses the directory in the path parameter as the Docker build context. Optional 
 cra-exclude-devdependencies text Specifies whether to exclude dev dependencies from scanning (true or false). The default value is false. Optional 
 cra-gradle-exclude-configs text Specifies which Gradle configurations to exclude dependencies from in scanning. For example, runtimeClasspath,testCompileClasspath. This parameter is empty by default. Optional 
 cra-maven-exclude-scopes text Specifies which Maven scopes to exclude dependencies from in scanning. For example, test,compile. This parameter is empty by default. Optional 
 cra-nodejs-create-package-lock text Enables Code Risk Analyzer discovery to build the package-lock.json file for node.js repos. This parameter is set to false by default. Optional 
 ibmcloud-api-key SECRET The IBM Cloud® API key that interacts with the ibmcloud CLI tool. Required 
 pipeline-dockerconfigjson SECRET The base64-encoded Docker config.json file that pulls images from a private registry. Optional 
 onepipeline-dockerconfigjson SECRET Deprecated.
baseimage-auth-email text The email credential for the base image of the application Dockerfile, required by the Code Risk Analyzer scan. Optional 
 baseimage-auth-host text The host credential for the base image of the application Dockerfile, required by the Code Risk Analyzer scan. Optional 
 baseimage-auth-password SECRET The password credential for the base image of the application Dockerfile, required by the Code Risk Analyzer scan. Optional 
 baseimage-auth-user text The user credential for the base image of the application Dockerfile, required by the Code Risk Analyzer scan. Optional 
 cocoa-config-retry-status-code text The response status code for an API call that needs to be retried in the cocoa CLI. For example: 500,404. Default value: 500 Optional 
 cocoa-config-max-retry-attempts text The number of times that the cocoa CLI can retry the API call before giving up. For example: 5. Default value: 3 Optional 
 cocoa-config-git-default-branch (supported in Q4, 2022) text The default native Git branch for the cocoa CLI. For example: main. Default value: master Optional 
 cra-custom-script-path text Path to a custom script to be run before CRA scanning. This script is sourced to provide the option to set ENV variables in the context of the CRA BOM tool. Optional 
 cra-cveignore-path text File path to the cveignore, relative to the application repository root. Default file path is .cra/.cveignore if value is not provided. Optional 
 cra-docker-build-context text If this flag is specified, Code Risk Analyzer uses the directory in the path parameter as the Docker build context. The default value is false. Optional 
 cra-docker-buildflags text Customize docker build command for build stage scanning. The parameter is empty by default. Optional
The platform is fully integrated into the VMware® technology stack from vCD, vRA, vCenter to NSX and many public clouds. The RiskForesight platform has three key modules: Detect, Predict, and Act, providing 360-degree visibility into hybrid cloud workloads in real time by natively integrating into hybrid cloud orchestration modules. It is the industry’s first, seamless hybrid cloud protection platform. This platform allows customers to see IT, cyberrisk and compliance risk across the full cybercontrol planes of network, security, compute, and compliance.

Caveonix RiskForesight enables the enterprise to meet industry standards and government regulatory requirements such as PCI, FISMA, HIPAA, GDPR, ISO, NESA, and others.

Caveonix RiskForesight is a multitenant cyberrisk and Compliance Management platform for the hybrid cloud, enabling an enterprise, and its business units, continuous cybersecurity, and compliance visibility into their workloads. The Detect, Predict, and Act modules extend the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). The extensions allow continuous monitoring, quantitative risk analytics, and protective actions in the Risk Management Continuum of Detect, Predict, and Act.

With machine learning and CaveoIQ Risk Analytics Engine, the solution provides proactive workload protection from risks due to cyberthreats. It provides a consistent security and policy framework across a hybrid cloud environment and is fully integrated into cloud technology stack from VMware and public cloud providers such as AWS.

The three key services available through the RiskForesight GUI are Risk Management, Compliance Risk, and Forensic Management.



 Risk management 



* Continuous cyber-risk
* Cyber-risk scoring
* Vulnerability scoring and prioritization
* Supports industry-leading vulnerability and configuration scanning tools
* Global benchmarking standards
* Cyber-risk reporting







 Compliance risk 



* Automated compliance monitoring
* Compliance risk score dashboard
* Automated IA controls assessment
* It supports the following global configuration benchmarking standards: PCI, FISMA, FEDRAMP, HIPAA, GLBA, GDPR, NERC CIP Reports Against SCAP, OVAL, and XCCDF.
* Continuously updated and mapped IA controls and standards libraries
You can review the security of Docker images that are stored in your namespaces in IBM Cloud Container Registry by using the CLI.



1. List the images in your IBM Cloud account. A list of all images is returned, independent of the namespace where they are stored.

ibmcloud cr image-list
2. Check the status in the SECURITY STATUS column.



* No Issues No security issues were found.
* <X> Issues The number of potential security issues or vulnerabilities that are found, where <X> is the number of issues.
* Scanning The image is being scanned and the final vulnerability status is not determined.
* Unsupported OS The scan found no supported operating system (OS) distribution and no active configuration issues.



3. To view the details for the status, review the Vulnerability Advisor report:

ibmcloud cr va <region>.icr.io/<my_namespace>/<my_image>:<tag>

In the CLI output, you can view the following information about the configuration issues.



* Security practice A description of the vulnerability.
* Corrective action Details about how to fix the vulnerability.











 Setting organizational exemption policies 

If you want to manage the security of an IBM Cloud organization, you can use your policy setting to determine whether an issue is exempt or not.

You can deploy containers from any image regardless of security status.

To find out about the required permissions for working with exemptions, see [Access roles for configuring IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).

Using Portieris to block the deployment of images with issues that are found by Vulnerability Advisor is deprecated.



 Setting exemption policies by using the console
* To list the metadata for a specific installed package, run either of the following commands:

rpm -qi <package_name>

yum info <package_name>
* To list all installed packages and their versions, run either of the following commands:

rpm -qa

yum list installed





* Does Vulnerability Advisor have versions?

 Does Vulnerability Advisor have versions? 

Vulnerability Advisor is available in two versions, version 3 and version 4. For more information, see [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=ui).

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).



Kubernetes service



* What is Kubernetes?

Kubernetes is an open source platform for managing containerized workloads and services across multiple hosts, and offers managements tools for deploying, automating, monitoring, and scaling containerized apps with minimal to no manual intervention. All containers that make up your microservice are grouped into pods, a logical unit to ensure easy management and discovery. These pods run on compute hosts that are managed in a Kubernetes cluster that is portable, extensible, and self-healing in case of failures.

For more information about Kubernetes, see the [Kubernetes documentation](https://kubernetes.io/docs/home/?path=users&persona=app-developer<=vel=foundational).
* How does IBM Cloud Kubernetes Service work?

With IBM Cloud Kubernetes Service, you can create your own Kubernetes cluster to deploy and manage containerized apps on IBM Cloud. Your containerized apps are hosted on IBM Cloud infrastructure compute hosts that are called worker nodes.
* [Do I have any untagged images?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_untagged_image_1)
* [Do I need untagged images?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_untagged_image_2)
* [What are eligible images?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_eligible_image)
* [What regions are available?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_regions)



* [Frequently asked questions about Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqregistry_faq_va)



* [How much does Vulnerability Advisor cost?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_cost)
* [Can images from other registries be scanned?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_reg)
* [How is a Vulnerability Advisor scan triggered?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_trigger_scan)
* [Why doesn't a new image scan?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_new_scan_error)
* [How often are the security notices updated?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_update_security_notice)
* [Why can I see a vulnerability in Vulnerability Advisor v4 but not in v3?]
For example: com.ibm.image_vulnerability_scan, com.ibm.unit_tests
* --asset-key
The key in pipelinectl assets. For the following commands load_artifact <key> or load_repo <key>
* --asset-type
The asset type from pipelinectl and can be one of the following types: repo, artifact
* --status
The evidence status and can be one of the following: success, pending, failure



The following parameter is optional:



* --attachment
The file to be processed as result and attached to the evidence. The parameter can be specified multiple times for multiple files.
* --meta
Arbitrary metadata to be added to the evidence. The parameter accepts 'key=value' pairs and can be specified multiple times.



Use the following command to get help:

collect-evidence --help



 Return value 

collect-evidence outputs the evaluated evidence status string on STDOUT (one of success, failure, or pending). This evaluated value depends on the processed result attachments, found incident issues, and possible remediation of those issues, for example having a due date set or an exempt label. For more information, see [Incident issues](https://cloud.ibm.com/docs/devsecops?topic=devsecops-incident-issues).

 example on how to read the output into a variable in bash

read -r status < <(collect-evidence "${evidence_params[@]}")

echo $status success





 Example usage 

collect-evidence --tool-type "sonarqube" --evidence-type "com.ibm.static_scan" --asset-type "repo" --asset-key "app-repo" --status "success" --attachment ./sonarqube-result-1.json --attachment ./sonarqube-result-2.json --meta environment=staging







 Supported tool formats 

The current implementation currently supports the following tools (provided as the --tool-type parameter):



* cra IBM Code Risk Analyzer
* va Vulnerability Advisor for IBM Cloud Container Registry
Logging agent 

The logging agent collects and forwards logs to your IBM Log Analysis instance. After you provision an IBM® Log Analysis instance, you must configure a logging agent for each log source that you want to monitor.



* You can configure a logging agent to connect to an IBM Log Analysis instance through the public network or through the private network. By default, the agent connects through the public network. To connect to IBM Cloud® services over a private network, you must have access to the classic infrastructure and [enable virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) and connectivity to service endpoints for your account.
* The logging agent authenticates by using the logging ingestion key and opens a secure web socket to the IBM Log Analysis ingestion servers.
* The logging agent for Kubernetes automatically collects STDOUT and STDERR logs.
* By default, the logging agent monitors all files with extension .log, and extensionless files under /var/log/.
* The logging agent tails for new log data, and looks for new files that are added to the logging directories that the agent monitors.





 Logging agent for Kubernetes clusters 

Logging agent images for Kubernetes clusters are public images that are available in IBM Cloud through the [IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started) service.



* The logging agent images are hosted in the IBM Cloud Container Registry global repository icr.io/ext/logdna-agent.
* IBM Cloud Container Registry provides a multi-tenant, highly available, scalable, and encrypted private image registry that is hosted and managed by IBM.
* The IBM Cloud Container Registry includes Vulnerability Advisor features that scan for potential security issues and vulnerabilities. Vulnerability Advisor checks for vulnerable packages in specific Docker base images, and known vulnerabilities in app configuration settings. When vulnerabilities are found, information about the vulnerability is provided. You can use this information to resolve security issues so that containers are not deployed from vulnerable images.
Encrypted images
: In clusters that run Red Hat OpenShift version 4.4 or later, you can now [deploy containers from an encrypted image](https://cloud.ibm.com/docs/openshift?topic=openshift-imagesencrypted-images) by enabling the Image Key Synchronizer cluster add-on.

Master versions
: Master fix pack update change log documentation is available.
: [4.5.18_1523_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4518_1523), [4.4.29_1527_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4429_1527), [4.3.40_1548_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4340_1548), and [3.11.318_1575_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311).





 11 December 2020 

Storage add-ons
: Cluster autoscaler add-on patch update 1.0.1_195 is released. For more information, see the [Cluster autoscaler add-on change log](https://cloud.ibm.com/docs/openshift?topic=openshift-ca_changelog). Block Storage for VPC add-on patch update 2.0.3_464 is released. For more information, see the [Block Storage for VPC add-on change log](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc_bs_changelog).

strongSwan versions
For proper protection and encryption, store registry credentials in [Kubernetes imagePullSecrets](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother) and other personal information in [secrets](https://kubernetes.io/docs/concepts/configuration/secret/) instead. Remember that if personal information is stored in a previous layer of an image, deleting an image might not be sufficient to delete this personal information.





 Kubernetes security bulletins 

If vulnerabilities are found in Kubernetes, Kubernetes releases CVEs in security bulletins to inform users and to describe the actions that users must take to remediate the vulnerability. Kubernetes security bulletins that affect Red Hat OpenShift on IBM Cloud users or the IBM Cloud platform are published in the [IBM Cloud security bulletin](https://cloud.ibm.com/status?component=containers-kubernetes&selected=security).

Some CVEs require the latest patch update for a Red Hat OpenShift version that you can install as part of the regular [cluster update process](https://cloud.ibm.com/docs/containers?topic=containers-updateupdate) in Red Hat OpenShift on IBM Cloud. Make sure to apply security patches in time to protect your cluster from malicious attacks. For more information about what is included in a security patch, refer to the [version change log](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions).
Caveonix RiskForesight use cases and benefits 

Caveonix RiskForesight™ provides an automated deployment of the Caveonix RiskForesight solution in an “all-in-one” virtual machine (VM) deployment. It is initially configured with a Service Provider and a Tenant and integrated into vCenter and NSX Manager. The Asset Repository is populated with the VMware® vCenter Server infrastructure components and an Application and Sub-Application, which represent the VMware infrastructure platform, are configured. On the dashboard, the cyberrisk scores, compliance risk scores, and compliance reports for the required compliance regimes are available.

The following list is an overview of the initial workflows:



1. Client orders the service and initiates an automated installation of the RiskForesight Application.
2. Service Provider data is configured.
3. Tenant Organization and Assets are initially configured through vCenter. An Application and Sub-Application is configured for the vCenter Server® instance.
4. Dashboards are populated for the tenant to manage their cyberrisk and compliance posture:



* Compliance Management
* Risk Management
* Forensics Management



5. Client installs Remote Collectors.
6. Client can also use RiskForesight to manage their on-premises data center.





 Use cases 

The following examples are typical use cases:



* Customer wants to determine whether their infrastructure and workloads are meeting compliance requirements.
* Customer wants to assess their potential cyberrisk and compliance impact on their workloads and how to mitigate.
* Customer wants to gain visibility and determine the changes in their hybrid cloud environment.
* Customer wants to proactively manage overall risks within hybrid cloud before they can be used to reduce breaches.
* Customer wants to identify specific actions to eliminate risks due to cyberthreats, vulnerabilities, or non-compliant configurations.
* Customer wants to achieve faster time to detection with machine learning by analyzing volumes of data to understand good behavior and identify anomalies.
* Customer wants to reduce overall compliance costs due to automated controls and assessments.
* Customer wants to eliminate blind spots by viewing multidimensional grouping of assets across each location, organization, and application group in hybrid cloud.
<br><br> * Manage access to images in your account.<br> * Use IBM provided images and sample apps, such as IBM Liberty, as a parent image and add your own app code to it.<br> * Automatic scanning of images for potential vulnerabilities by Vulnerability Advisor, including OS specific recommendations to fix them.<br><br><br> 
 Any other private registry Connect any existing private registry to your cluster by creating an [image pull secret](https://kubernetes.io/docs/concepts/containers/images/). The secret is used to securely save your registry URL and credentials in a Kubernetes secret. Use existing private registries independent of their source (Docker Hub, organization owned registries, or other private Cloud registries). 
 [Public Docker Hub](https://hub.docker.com/) Use this option to use existing public images from Docker Hub directly in your [Kubernetes deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) when no Dockerfile changes are needed. Note: Keep in mind that this option might not meet your organization's security requirements, like access management, vulnerability scanning, or app privacy. No additional setup is needed for your cluster.<br><br><br><br> * Includes a variety of open-source applications.<br><br><br> 



After you set up an image registry, cluster users can use the images to deploy apps to the cluster.

Learn more about [securing your personal information](https://cloud.ibm.com/docs/containers?topic=containers-securitypi) when you work with container images.





 Understanding how to authorize your cluster to pull images from a private registry 

To pull images from a registry, your IBM Cloud Kubernetes Service cluster uses a special type of Kubernetes secret, an imagePullSecret. This image pull secret stores the credentials to access a container registry.

The container registry can be:



* A private namespace in your own IBM Cloud Container Registry.
* A private namespace in IBM Cloud Container Registry that belongs to a different IBM Cloud account.