vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by a buffer overflow in Twisted (CVE-2022-21716)](https://www.ibm.com/support/pages/node/6610100)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by incomplete string comparison in NumPy (CVE-2021-34141)](https://www.ibm.com/support/pages/node/6610102)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by a buffer overflow in NumPy (CVE-2021-41496)](https://www.ibm.com/support/pages/node/6610104)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cookie and authorization header exposure in Twisted (CVE-2022-21712)](https://www.ibm.com/support/pages/node/6605065)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18311)](https://www.ibm.com/support/pages/node/6610118)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18312)](https://www.ibm.com/support/pages/node/6610122)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18313)](https://www.ibm.com/support/pages/node/6610124)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to data information exposure in cURL libcurl (CVE-2022-27776)](https://www.ibm.com/support/pages/node/6843881)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in cURL libcurl (CVE-2022-27782)](https://www.ibm.com/support/pages/node/6843883)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNOME libxml2 (CVE-2022-29824)](https://www.ibm.com/support/pages/node/6843885)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a SQL injection in PostgreSQL (CVE-2022-31197)](https://www.ibm.com/support/pages/node/6843887)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in libexpat (CVE-2022-25313)](https://www.ibm.com/support/pages/node/6843889)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in libexpat (CVE-2022-25314)](https://www.ibm.com/support/pages/node/6843891)







 10 November 2022 (Versions 4.0.x and 4.5.x) 

Known issue: Updated Network Policy needed for PostgreSQL operator
: Known issue: For Speech services version 4.0.x (not including version 4.0.0) and 4.5.x, if the PostgreSQL operator and the Speech services are installed in different namespaces, the PostgreSQL operator is not able to monitor the PostgreSQL operands for the Speech services.
For a secured connection with HTTPS, you can either obtain a certificate from [Let's Encrypt](https://letsencrypt.org/) as described in the following [IBM Cloud® blog](https://www.ibm.com/cloud/blog/secure-apps-on-ibm-cloud-with-wildcard-certificates) or through [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-public-certificates&interface=ui).





 Increase performance and protect from Denial of Service attacks 

A distributed denial of service ([DDoS](https://en.wikipedia.org/wiki/Denial-of-service_attack)) attack is a malicious attempt to disrupt normal traffic of a server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic. CIS is equipped to protect your domain from DDoS.



1. In the CIS dashboard, select Reliability > Global Load Balancer.
2. Locate the GLB you created in the Load Balancers table.
3. Enable the Security and Performance features in the Proxy column:

Zoom

![CIS Proxy Toggle ON](https://cloud.ibm.com/docs-content/v1/content/cbb80bf851fb762a838129cba09d5674f8bfffda/Registry/includes/solution-tutorials/includes/solution-tutorials/images/solution32-multi-region-k8s-cis/cis-proxy.png)

CIS Proxy Toggle ON



Your GLB is now protected. An immediate benefit is that the origin IP addresses of your clusters will be hidden from the clients. If CIS detects a threat for an upcoming request, the user may see a screen like this one before being redirected to your application:

Zoom

!
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to incorrect access control in Golang Go (CVE-2022-23773)](https://www.ibm.com/support/pages/node/6610291)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-23806)](https://www.ibm.com/support/pages/node/6610293)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-24675)](https://www.ibm.com/support/pages/node/6610295)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-24921)](https://www.ibm.com/support/pages/node/6610297)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-28327)](https://www.ibm.com/support/pages/node/6610299)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in libssh, caused by improper bounds checking (CVE-2021-3634)](https://www.ibm.com/support/pages/node/6610303)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python (CVE-2021-3737)](https://www.ibm.com/support/pages/node/6610329)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a possible sensitive information exposure in Python (CVE-2021-4189)](https://www.ibm.com/support/pages/node/6610339)
SC-23 - Session Authenticity 



  Control requirements 

SC-23 - 0
:   The information system protects the authenticity of communications sessions.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether App ID email dispatchers are using HTTPS only
*  Check whether Cloud Object Storage is accessible only through HTTPS
*  Check whether Application Load Balancer for VPC is configured to convert HTTP client requests to HTTPS
*  Check whether App ID webhooks are using HTTPS only
*  Check whether App ID redirect URIs are using HTTPS only
*  Check whether Cloud Internet Services (CIS) has TLS mode set to End-to-End CA signed
*  Check whether Application Load Balancer for VPC pool uses the HTTPS protocol for HTTPS listeners
*  Check whether Application Load Balancer for VPC uses HTTPS (SSL & TLS) instead of HTTP







  NIST supplemental guidance 

This control addresses communications protection at the session, versus packet level (e.g., sessions in service-oriented architectures providing web-based services) and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Authenticity protection includes, for example, protecting against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.
Create a Page Rule with the URL pattern of your API (for example, www.example.com/api/).
2. Identify the Security Level setting.
3. Turn Security Level to Low or Essentially off.
4. Select Provision Resource.







 What do security level settings mean? 

Our security level settings are aligned with threat scores that certain IP addresses acquire from malicious behavior on our network. A threat score above 10 is considered high.



* High: Threat scores greater than 0 are challenged.
* Medium: Threat scores greater than 14 are challenged.
* Low: Threat scores greater than 24 are challenged.
* Essentially off: Threat scores greater than 49 are challenged.
* Off: Enterprise only
* Defense mode: Should only be used when your website is under a DDoS attack. Visitors receive an interstitial page for about five seconds while CIS analyzes the traffic and behavior to make sure it is a legitimate visitor trying to access your website. Defense mode might affect some actions on your domain, such as using an API. You are able to set a custom security level for your API or any other part of your domain by creating a page rule for that section.



It is recommended that you review your security-level settings periodically. You can find instructions in [Best practices for CIS setup](https://cloud.ibm.com/docs/cis?topic=cis-best-practices-for-cis-setup).







 Best practice 3: Activate your Web Application Firewall (WAF) safely 

Your WAF is available in the Security section. Here, we walk through these settings in reverse order to ensure that your WAF is configured as safely as possible before turning it on for your entire domain. These initial settings can reduce false positives by populating Security Events for further tuning. Your WAF is updated automatically to handle new vulnerabilities as they are identified. For more information, see [Using Security events capability](https://cloud.ibm.com/docs/cis?topic=cis-using-the-cis-security-events-capability).

The WAF protects you against the following types of attacks:



* SQL injection attack
* Cross-site scripting
* Valid values for security_header are enabled, max_age, include_subdomains, preload, nosniff. For example: -v enabled=true,max_age=100,include_subdomains=true,preload=true,nosniff=true



* enabled: Whether or not security_header is enabled.Valid values for enabled are true, false.
* max_age: Specify the duration(in seconds) security_header are cached in browsers.
* include_subdomains: Every domain below the domain will inherit the same security_header. Valid values for include_subdomains are true, false.
* preload: Whether or not to permit browsers to preload security_header config. Valid values for enabled are true, false.
* nosniff: Whether or not to send X-Content-Type-Options: nosniff header. Valid values for nosniff are true, false.



* Valid values for server_level are off, essentially_off, low, medium, high, under_attack.
* Valid values for server_side_exclude are on, off.
* Valid values for tls_client_auth are on, off.
* Valid values for true_client_ip_header are on, off.
* Valid values for waf are on, off.
* Valid values for websockets are on, off.
* Valid values for proxy_read_timeout, 1-6000, default: 100.
Show more

You can reference the $ismember context variable from your dialog. For example, the following screen capture shows a dialog node that conditions on #General_Greetings. It has multiple conditioned responses. The first response checks whether the current user is a member of your rewards program by checking for the presence of the $ismember context variable. If the variable is present, the response addresses the user as a member. The next response has a more generic greeting.

![Shows multiple conditioned responses in a dialog node, one of which references the ismember context variable](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/web-chat-use-context-var.png)

If you enable security, you can encrypt the data that you pass to your dialog. For more information, see [Passing sensitive data](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-deploy-web-chatdeploy-web-chat-security-encrypt).

If you're using a Lite plan, remember that a session ends if there's no interaction with the user after 5 minutes. When the session ends, any contextual information that you pass or collect is reset.





 Adding user identity information 

If you do not enable security, and you want to perform tasks where you need to know the user who submitted the input, then you must pass the user ID to the web chat integration.

If you do enable security, you set the user ID in the JSON Web Token instead. For more information, see [Authenticating users](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-deploy-web-chatdeploy-web-chat-security-authenticate).

Choose a non-human-identifiable ID. For example, do not use a person's email address as the user_id.

User information is used in the following ways:
You must URL-encode the argument to the parameter, for example, customer_id%3dmy_customer_ID. By default, no customer ID is associated with the data. For more information, see [Information security](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-information-security).

x-watson-learning-opt-out (optional boolean)
:
IBM Cloud

Indicates whether the service logs requests and results that are sent over the connection. To prevent IBM from accessing your data for general service improvements, specify true for the parameter. Opting out directs IBM to write to disk no user data (text or audio) for your request. You can also opt out at the account level. For more information, see [Request logging](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-data-securitydata-security-request-logging).

The following snippet of JavaScript code opens a connection with the service. The call to the /v1/synthesize method passes the voice and access_token query parameters, the former to direct the service to use the US English Allison voice. Once the connection is established, the event listeners (onOpen(), onClose(), and so on) are defined to respond to events from the service.

var access_token = '{access_token}';
var wsURI = '{ws_url}/v1/synthesize'
+ '?access_token=' + access_token
+ '&voice=en-US_AllisonV3Voice';
var websocket = new WebSocket(wsURI);

websocket.onopen = function(evt) { onOpen(evt) };
websocket.onclose = function(evt) { onClose(evt) };
websocket.onmessage = function(evt) { onMessage(evt) };
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in e2fsprogs (CVE-2022-1304)](https://www.ibm.com/support/pages/node/6967639)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to errors in TrustCor (CVE-2022-23491)](https://www.ibm.com/support/pages/node/6967641)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GnuTLS (CVE-2022-2509)](https://www.ibm.com/support/pages/node/6967643)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in systemd (CVE-2022-2526)](https://www.ibm.com/support/pages/node/6967649)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in AWS SDK for Go (CVE-2022-2582)](https://www.ibm.com/support/pages/node/6967651)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in cURL libcurl (CVE-2022-32206)](https://www.ibm.com/support/pages/node/6967687)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl (CVE-2022-32208)](https://www.ibm.com/support/pages/node/6967655)
An exchange with a user is not considered a billable conversation until the customer submits a message.
* Avg. msg. per conversation: The total messages received during the selected time period divided by the total conversations during the selected time period, as shown in the corresponding graph.
* Max. conversations: The maximum number of conversations for a single data point within the selected time period.
* Weak understanding: The number of individual messages with weak understanding. These messages are not classified by an intent, and do not contain any known entities. Reviewing unrecognized messages can help you to identify potential dialog problems.







 Graphs and statistics 

Detailed graphs provide additional information. Click a data point on the graphs to see more detail.

![Single data point](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/oview-point.png)



* Containment: Number of conversations in which the assistant is able to satisfy the customer's request without human intervention.



* The volume graph shows the total number of conversations per day and how many of the conversations were contained and not contained.
* The trend graph shows the percentage of daily conversations that were contained. This graph helps you to see if the assistant is getting better or worse at containing conversations over time.



![Shows the two containment metrics for volume and trend](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/containment-metric.png)

The containment metric requires that your dialog flag requests for external support when they occur. For more information, see [Measuring containment](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-supportdialog-support-containment).
* Coverage: Number of conversations in which the assistant is confident that it can address a customer's request.
To select another folder location, change your browser's settings to prompt you for a location with each download.





 Configuring and managing your secure DNS 

DNSSec is a technology to digitally sign DNS data so you can be assured it is valid. To eliminate vulnerability from the internet, DNSSec must be deployed at each step in the lookup, from root zone to final domain name (for example, www.icann.org).

DNSSec adds a layer of authentication to the internet's DNS infrastructure, which otherwise is not secure. Secure DNS guarantees that visitors are directed to your web server when they type your domain name into a web browser. All you need to do is enable DNSSec in your DNS page from your IBM CIS account and add the DS record to your registrar.

You can select View DS records to display the information needed to add the DS record to your registrar. You must copy parts of the DS record and paste them into your registrar’s dashboard. Every registrar is different, and your registrar might only require you to enter information for some of the available fields.
[Diagram of Client to edge TLS](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/client-to-edge.png)

Figure 2. A diagram of Client to edge TLS





 End-to-End flexible 

A secure connection between your visitor and CIS, and secure connection (but not authenticated) between CIS and your web server. You must have your server configured to answer HTTPS connections, with a self-signed certificate at least. The authenticity of the certificate is not verified: from CIS’s point of view (when we connect to your origin webserver), it’s the equivalent of bypassing this error message. As long as the address of your origin webserver is correct in your DNS settings, you know that we’re connecting to your webserver, and not someone else’s.

Zoom

![Diagram of End to end flexible TLS](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/end-to-end-flexible.png)

Figure 3. A diagram of End to end flexible TLS





 End-to-End CA signed 

Default and recommended. A secure connection between the visitor and CIS, and secure and authenticated connection between CIS and your web server. You must have your server configured to answer HTTPS connections, with a valid TLS certificate. This certificate must be signed by a certificate authority, have an expiration date in the future, and respond for the request domain name (hostname). It is recommended that you keep using this TLS mode for best security practices, unless you understand the potential security threats of changing to one of the less strict modes.

Zoom

!
For more information about deleting user data, see [Labeling and deleting data](https://cloud.ibm.com/docs/assistant?topic=assistant-information-securityinformation-security-gdpr-wa).



If you disable security, then you can use the instance.updateUserID() method to specify user IDs. For more information, see [Adding user identity information](https://cloud.ibm.com/docs/assistant?topic=assistant-web-chat-configweb-chat-config-userid).







 Logging out 

To log out a customer, you must destroy the web chat.

If you reload the page when a customer logs out, you must call the instance.destroySession() method to remove any reference to the current session from the browser's cookies and storage. If you forget to call this method, information that is protected by the identityToken is not at risk, but the web chat will try to connect to the previous session and fail.

If you do not perform a full page reload when a customer logs out, call the instance.destroy() method. The destroy method removes the current instance of the web chat that is configured for the current userID from the DOM and browser memory. Next, call the instance.destroySession() method.





 Updating site security policies 

If your website uses a Content Security Policy (CSP), you must update it to grant permission to the web chat.

The following table lists the values to add to your CSP.



CSP properties

 Property Additional values 

 default-src 'self' *.watson.appdomain.cloud fonts.gstatic.com 'unsafe-inline' 
 connect-src *.watsonplatform.net *.watson.appdomain.cloud 



The following example shows a complete CSP metadata tag:

<meta
http-equiv="Content-Security-Policy"
content="default-src 'self' .watson.appdomain.cloud fonts.gstatic.com 'unsafe-inline';connect-src .watsonplatform.net .watson.appdomain.cloud" />



 Allowing elements
If you have a web chat integration, for example, you will know that your webhook has an issue if every test message you submit returns a message such as There is an error with the message you just sent, but feel free to ask me something else. If this message is displayed, use a REST API tool, such as cURL, to send a test /message API request, so you can see the error code and full message that is returned.



Error code details

 Error code and message Description 

 422 Webhook responded with invalid JSON body The webhook's HTTP response body could not be parsed as JSON. 
 422 Error validating webhook response The webhook's HTTP response body was not a valid /message body. 
 422 Webhook responded with [500] status code There's a problem with the external service you called. The code failed or the external server refused the request. 
 500 Processor Exception : [connections to all backends failing] An error occurred in the webhook microservice. It could not connect to backend services. 







 Webhook security 

To authenticate the webhook request, verify the JSON Web Token (JWT) that is sent with the request. The webhook microservice automatically generates a JWT and sends it in the Authorization header with each webhook call. It is your responsibility to add code to the external service that verifies the JWT.

For example, if you specify purple unicorn in the Secret field, you might add code similar to this:

const jwt = require('jsonwebtoken');
...
const token = request.headers.authentication; // grab the "Authentication" header
try {
const decoded = jwt.verify(token, 'purple unicorn');
} catch(err) {
// error thrown if token is invalid
}





 Request body 

It is useful to know the format of the request body of the premessage webhook so that your external code can process it.

The payload contains the request body of the /message (stateful and stateless) v2 API request.