vania-janet/multiturn-rag-retrieval-data huggingface dataset:
remote-router 10.28.94.195 {
password 
sync-map syncme
username vyatta
}

You must add rules to determine which configuration branches to migrate over. For example, if you want to have the firewall and IPsec configuration to be pushed, add these commands:

set system config-sync sync-map syncme rule 1 action include
set system config-sync sync-map syncme rule 1 location firewall
set system config-sync sync-map syncme rule 2 action include
set system config-sync sync-map syncme rule 2 location "vpn ipsec"

After these are committed, any changes to the firewall or IPsec configuration are pushed to the other Vyatta on commit.

sync-group and sync-map are two different things. The sync-map configuration is for rules to push configuration changes to another Vyatta. sync-group is for VRRP IPs to fail over as a group instead of one at a time. Configuring one does not affect the other.
* CLI
* API







 Managing Event Streams targets 

You can manage IBM® Event Streams for IBM Cloud® (Event Streams) targets in your account by using the IBM Cloud Activity Tracker Event Routing CLI, the IBM Cloud Activity Tracker Event Routing REST API, and Terraform scripts. A target is a resource where you can collect auditing events.

For more information on IBM Cloud Activity Tracker Event Routing targets, see [Targets](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2).



 IAM access 

You must grant users IAM permissions to manage targets. For more information, see [Assign access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).

When you define a policy, you can indicate the scope of the permissions. You can choose from granting permissions for a specific region or for the entire account.

Users with regional scope will be limited to access targets in their authorized region.



Table 1. IAM actions and the IAM roles that include them.

 IAM action IAM Policy scope IAM Roles Description 

 atracker.target.read Region Administrator <br>Editor <br>Viewer <br>Operator Read (view) information about a target 
 atracker.target.create Region Administrator <br>Editor Create a target 
 atracker.target.update Region Administrator <br>Editor Update a target 
 atracker.target.delete Region Administrator <br>Editor Delete a target 
 atracker.target.list Account Administrator <br>Editor <br>Viewer <br>Operator List all targets 





 IAM access for Event Streams 

If you need to restrict access to a single Event Streams topic, you will need to create two policies:



* A policy for the topic with the writer role and the resource ID with the name of the topic.
* A policy for the cluster with the reader role.



For more information, see the [IBM® Event Streams for IBM Cloud® documentation.](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-security)







 CLI prerequisites
* [IAM (Identity and Access Management)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-iam)
* [Ports](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-ports)
* [Key management](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-keys)
* [Membership service providers (MSPs)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-msp)
* [Access control lists (ACLs)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-acls)
* [API authentication](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-apis)





 IAM (Identity and Access Management) 

Identity and access management allows the owner of a console to control which users can access the console and their privileges within it. Identity and access management on IBM Cloud is controlled by using the IAM service. Every user that accesses the blockchain console must have an IBMid account and be assigned an access policy in the IAM service. This policy determines what actions the user can perform within the console. Blockchain-specific permissions (for example, which users can create components) are based on the IAM roles that are mapped to blockchain permissions in this [Role to permissions mapping table](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-manage-consoleibp-console-manage-console-role-mapping).
Enable tls_client_auth for domain 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis domain-settings-update -f tls_client_auth -v on 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"









 Edge functions 

Manipulate how Edge Functions perform using the following edge-functions commands:



 ibmcloud cis edge-functions-actions 

List all Edge Functions actions of a service instance.

ibmcloud cis edge-functions-actions [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

List all Edge Functions actions in instance cis-demo.

ibmcloud cis edge-functions-actions -i "cis-demo"







 ibmcloud cis edge-functions-action 

Show an Edge Functions action of a service instance.

ibmcloud cis edge-functions-action [--name ACTION_NAME] [-i, --instance INSTANCE]



 Command options 

`--name
: Action name (Enterprise plan only).

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.





 Examples 

Show details of Edge Functions action action-demo.

ibmcloud cis edge-functions-action --name "action-demo" -i "cis-demo"







 ibmcloud cis edge-functions-action-create 

Create an Edge Functions action for a service instance.

ibmcloud cis edge-functions-action-create [--name ACTION_NAME] (--javascript-str JAVASCRIPT_STR | --javascript-file JAVASCRIPT_FILE) [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

--name
: Action name (Enterprise plan only).
Optimizing traffic steering 

Load balancing provides several traffic steering modes, which allow customers to optimize how load balancers route traffic.

You can configure traffic steering from the load balancing dashboard, in the Edit Load Balancer panel. You can also configure traffic steering via the CIS API. Available steering options include standard failover (steering disabled), dynamic steering, and geo steering.



 Standard failover 

Standard failover directs traffic from unhealthy pools to the next healthy pool in the configuration, using the pool order to determine failover priority (the failover order).

If all pools are marked unhealthy, the load balancer directs traffic to the fallback pool. The default fallback pool is the last pool listed in the load balancer configuration.

To nominate a specific fallback pool through the CIS API, use the Update Load Balancers command and set the fallback_pool parameter. If no monitors are attached to the load balancer, it directs traffic to the primary pool exclusively.





 Dynamic steering 

Dynamic steering uses health check data to identify the fastest pool for a CIS region or point of presence (PoP).

Dynamic steering creates Round Trip Time (RTT) profiles based on an exponential weighted moving average (EWMA) of RTT to determine the fastest pool. If there is no current RTT data for your pool in a region or colocation center, CIS directs traffic to the pools in failover order.

Allow 10 minutes for CIS to build an RTT profile the first time you enable dynamic steering for a server pool.

If you are terminating TCP at a cloud provider edge location, the calculated latency might not reflect the true latency to the origin for TCP health checks.

The following diagram shows how CIS routes traffic to the pool with the lowest EWMA among three regions: Eastern North America, Europe, and Australia. In this case, the ENAM pool is selected, because it has the lowest RTT.

Zoom

![Figure showing traffic steering](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/cis-traffic-steering.svg)
The TPM device is integrated within the server system and provides a range of Intel TXT security-related functions.





 What does Intel TXT does for you 

Intel TXT is especially advantageous for large enterprises subject to compliance and audit regulations, such as healthcare, financial services, and government organizations. It helps assure that tracking of all trusted resources can be integrated, managed, and reported on with the relevant compliance organizations (HIPAA, PCI, FedRAMP, ISO, FISMA, and SSAE 16). For the first time, these organizations are able to certify that a cloud computing system is secured for workloads such as



* Governance and enterprise risk
* Information and lifecycle management
* Compliance and audit
* Application security
* Identity and access management
* Incident response



For more information about Intel TXT on IBM Cloud Bare Metal Servers, see [Intel® Trusted Execution Technology](https://www.ibm.com/cloud/bare-metal-servers/intel-txt).





 Special technical notice 

Intel TXT is provided by Intel® and operates on the IBM Cloud Bare Metal Servers that require specific technical knowledge to support and manage. The IBM Cloud current delivery model can turn Intel® TXT either on or off. IBM Cloud can't assist with configuration of Intel TXT settings because of the sensitivity of customer environments and data. The recommendation is that you either include staff who is trained in Intel TXT technologies or engage with a consulting firm with expertise in orchestrating root of trust and measured launch environment (MLE) architecture.
* CLI
* API







 Managing routes using the V1 API 

You can manage routes in your account by using the IBM Cloud® Activity Tracker Event Routing CLI or IBM Cloud Activity Tracker Event Routing REST API. A route defines the rules that indicate what auditing events are collected in a region and where to store them.

The V1 API is deprecated. See [managing routes using the V2 API](https://cloud.ibm.com/docs/atracker?topic=atracker-route_v2) for information on using the V2 API. Also see [migrating resources](https://cloud.ibm.com/docs/atracker?topic=atracker-migrate-resources) for information on migrating from your V1 configuration.

The version of the API running in your account can be determined by running the [ibmcloud atracker init version command.](https://cloud.ibm.com/docs/atracker?topic=atracker-v2api)



 Understanding how routes work in your account 

Note the following information about routes:



* You can define 1 route per region.
* By default, the account has 0 routes configured.
* You can configure 1 or more rules for each route.
* You can configure 1 target for each rule.
* If you plan to share a target across multiple regions, you must define the target in each region. You can only configure a route with a target that is defined in the same region.
* For each rule, you must specify what auditing events are affected by the rule. In additon, you must define the target where you want the auditing events to be collected.
* You can only configure 1 route for each account to collect global events.



After you configure a route, it takes over 1 hour for the configuration to be enabled in that region.

The target defines where auditing events are collected. The route defines what auditing events are collected in a target.

A route definition is similar to the follows:

{
CM-2 (2) - Automation Support for Accuracy / Currency 



  Control requirements 

CM-2 (2) - 0
:   The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Compliance monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts
*  Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis







  NIST supplemental guidance 

Automated mechanisms that help organizations maintain consistent baseline configurations for information systems include, for example, hardware and software inventory tools, configuration management tools, and network management tools. Such tools can be deployed and/or allocated as common controls, at the information system level, or at the operating system or component level (e.g., on workstations, servers, notebook computers, network components, or mobile devices). Tools can be used, for example, to track version numbers on operating system applications, types of software installed, and current patch levels. This control enhancement can be satisfied by the implementation of CM-8 (2) for organizations that choose to combine information system component inventory and baseline configuration activities.
Security and Compliance Center allows you to define the controls you need to meet by using pre-defined or custom profiles, attach the profiles to a group of resources, or scope, and [perform regularly scheduled evaluations](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-scan-resources). As evaluations are completed, the results are displayed in a dashboard so you can get an overarching view of your current compliance posture against the controls that are important for your use case and download compliance reports. Your security and compliance managers can also choose to set up notifications to get alerted when an issue is found so that it can be remediated quickly. In addition, Security and Compliance Center can collect evidence from your DevSecOps pipeline runs on your application code so that it can show a complete view of your compliance on IBM Cloud.
* UI
* CLI
* API







 Managing COS targets 

You can manage IBM Cloud Object Storage (COS) targets in your account by using the IBM Cloud Activity Tracker Event Routing CLI, the IBM Cloud Activity Tracker Event Routing REST API, and Terraform scripts. A target is a resource where you can collect auditing events.

For more information on IBM Cloud Activity Tracker Event Routing targets, see [Targets](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2).



 About COS targets 

If you are using an IBM Cloud Object Storage (COS) target, you can use the same COS bucket for collecting auditing events in your account across multiple regions. In that scenario events are forwarded to the target region before being written to the COS bucket. You may consider defining a bucket in each region to improve performance and reduce network latency.

When you define a target in IBM Cloud Object Storage (COS), consider the following information:



* You can create the bucket in any location. For more information, see [Managing IBM Cloud Object Storage (COS) buckets](https://cloud.ibm.com/docs/atracker?topic=atracker-cos).
* You can only configure 1 bucket for a target.
* If you have regulatory and compliance requirements, check the locations where you can create a bucket. Then, if performance is critical, consider creating the COS bucket in the same region where the auditing events are generated.







 IAM Access 

You must grant users IAM permissions to manage targets. For more information, see [Assign access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).

When you define a policy, you can indicate the scope of the permissions. You can choose from granting permissions for a specific region or for the entire account.

Users with regional scope will be limited to access targets in their authorized region.



Table 1. IAM actions and the IAM roles that include them.

 IAM action IAM Policy scope IAM Roles Description
* CLI
* API







 Setting session affinity 

Loading a website usually requires fetching multiple assets from a web server. CIS session affinity minimizes redundant network requests by automatically directing requests from the same client to the same origin web server.

CIS sets a cookie on the initial response to the client. Using the cookie in subsequent client requests ensures those requests are sent to the same origin, unless the origin is unavailable.

When enabled, CIS session affinity does the following:



* When a client makes its first request, CIS sets a CFLib cookie on the client. The cookie encodes the origin to which the request is forwarded.
* Subsequent requests by the same client are forwarded to that origin for the duration of the cookie and as long as the origin server remains healthy.
* If the cookie expires or the origin server is unhealthy, CIS sets a new cookie encoding the appropriate failover origin.



All sessions default to 23 hours unless a custom session TTL is specified (in seconds) between 30 minutes and 7 days. A session affinity cookie is required to honor the TTL. The session cookie is secure when Always Use HTTPS is enabled. Additionally, HttpOnly is always enabled for the cookie to prevent cross-site scripting attacks.



 Setting session affinity using the CLI 

When you create a global load balancer using the CLI, take the following steps to set the session affinity:



1. Log in to your IBM Cloud account
2. Create a global load balancer
3. Set the following variables:



* Session affinity: Valid values are cookie, none.
* Session Affinity TTL: Time, in seconds, until this load balancers session affinity cookie expires after being created. Valid values between 1800, 604800. Default is 82800.
* Session Affinity Attributes are cookie attributes for session affinity cookie.



* Samesite: Valid values are Auto, None, Lax, Strict.
* Secure: Valid values are Auto, Always, Never.
* Drain Duration (optional): Configures the drain duration in seconds. This field is only used when session affinity is enabled on the load balancer.







For example:
For TTL, CIS still relies on headers set by the origin.





 Custom cache keys 

This feature is available only to enterprise customers.

A request's cache key is what determines if two requests are "the same" for caching purposes. If a request has the same cache key as some previous request, then we can serve the same cached response for both.

// Set cache key for this request to "some-string".
fetch(event.request, { cf: { cacheKey: "some-string" } })

Normally, CIS computes the cache key for a request based on the request's URL, but you might want different URLs to be treated as if they were the same for caching purposes. For example, if your web site content is hosted from both Amazon S3 and Google Cloud Storage - you have the same content in both places, and you use a Worker to randomly balance between the two. However, you don't want to end up caching two copies of your content. You could utilize custom cache keys to cache based on the original request URL rather than the subrequest URL:

addEventListener("fetch", (event) => {
let url = new URL(event.request.url)
if (Math.random() < 0.5) {
url.hostname = "example.s3.amazonaws.com"
}
else {
url.hostname = "example.storage.googleapis.com"
}

let request = new Request(url, event.request)
event.respondWith(
fetch(request, {
cf: { cacheKey: event.request.url },
})
)
})
Show more

Remember, edge functions operating on behalf of different zones cannot affect each other's cache. You can only override cache keys when making requests within your own zone (in the previous example event.request.url was the key stored), or requests to hosts that are not on CIS.
This includes: <br>[Defining the account management strategy](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-adoptionadoption_account) <br>[Configuring the accounts settings for compliance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-adoptionadoption_acc_settings) <br>[Define IAM Strategy](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-adoptionadoption_iam) <br>[Define the notification strategy](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-adoptionadoption_alerts) 







 Disaster recovery 



Table 5. Responsibilities for disaster recovery

 Task IBM Responsibilities Your Responsibilities 

 Restore functionality for Activity Tracker[] Automatically recover and restart Activity Tracker components after any disaster event. <br>In case of a regional disaster, IBM Cloud service teams, who are responsible for the operations of services that generate auditing events, will point their service to Activity Tracker endpoints in the alternate region within the same regulatory boundaries. N/A 
 Backup {{site.data.keyword.a_short}} components Daily backup of the Activity Tracker infrastructure and components. N/A 
 Backup auditing events for Activity Tracker N/A [Configure archiving to retain a backup copy of the data.](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-archiving) 
 Backup metadata for Activity Tracker Backup metadata that is used by the service. [Backup the metadata such as views, dashboards, screens, parsing templates, and alerts for each auditing instance.](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-reuse_resource_definitionsrrd_export_config) 
 Restore metadata for Activity Tracker Restore metadata that is used by the service. [Restore the metadata such as views, dashboards, screens, parsing templates, and alerts for each instance.]
Running operator actions through a bastion host 

All interactive operator actions must be run through a bastion host in the management VPC. A bastion host is a server that can be accessed through SSH, Windows Remote Desktop Protocol (RDP), or kubectl, but only through a Direct Link or VPN for VPC connection. After set up, the bastion host allows a secure connection to virtual server instances or Red Hat OpenShift on IBM Cloud clusters within the management VPC and the workload VPC. Administrative tasks on the individual servers are completed by using SSH, RDP, or kubectl, proxied through the bastion. Access to the servers and regular internet access from the servers, for example, for software installation, is allowed only with a special maintenance security group that is attached to those servers. In addition, session auditing must be enabled to record all privileged user actions.

After [connecting to the management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management) through Direct Link or VPN for VPC, a complete bastion solution should include the following details:



* Full session recording of actions executed via the bastion to perform session audits. This includes SSH, and Kubernetes exec (kubectl exec -it) sessions.



* Linux-based session recordings are captured as a raw dump of stdout and stderr streams, including TAB characters (bash escape sequences).
* Session recordings should be placed in to a storage service maintained within your environment for archiving. The storage should be configured as “immutable object storage.” Retention policies are should be applied to the storage, so that data is stored in a WORM (Write-Once-Read-Many), non-erasable and non-rewritable manner. The policy is set and enforced for a 12-month (minimum) retention period.



* Authenticating users with MFA using a physical hardware-based security key that generates a six-digit numerical code.