vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Helpful tools for managing your CIS deployment 

Some public-domain Unix system administration tools can help you manage your IBM Cloud® Internet Services (CIS) deployment.



 Sysadmin tools 



* whois (domain identification tool)
* dig (DNS tool)
* cURL (HTTP and HTTPS tool)
* netcat (IP and port tool)
* traceroute (network tool)







 Commercial tools for external and remote testing 



* GTMetrix (HTTP)
* Web page test (HTTP)
* WhatsMyDNS (DNS tool)
* G Suite Toolbox (DNS and HTTP)







 Tools for looking at logs and history 

HTTP Archive files (HAR files)



 Using whois 

whois is a UNIX system command line tool you can use to look up registrar information for a given domain name or IP address. For example, the domain’s given authoritative servers or the owner of a particular IP address.

Examples:

whois example.com

whois 8.8.8.8





 Using dig 

dig is a Unix command line tool that can perform DNS queries and check DNS records for a specific domain. It is similar to nslookup.

The schema of this command is dig <record_type> <domainname> <options>

For example:



* dig example.com
* dig my.example.com
* dig example.com +trace
* dig NS example.com
* dig example.com @ns.example.com







 Using cURL 

cURL is a Unix command line tool that lets you transmit data using the URL syntax. It’s commonly used to make HTTP requests or compare server responses.

The schema for this command is: curl -option1 -option2 http://example.com/url

For example:



* curl -svo /dev/null http://www.example.com
* curl -svo /dev/null -A “USER_AGENT_STRING” http://www.example.com
* curl -svo /dev/null -H “host: www.example.com” http://ORIGIN_IP
Managing your CIS deployment for optimal reliability 

To achieve optimal reliability for your IBM Cloud® Internet Services deployment, you can set up a helpful DNS configuration and global load balancers. For additional reliability, you can use our page rules to be sure that your web content is delivered to your customers, even if your origin server or the cache has a problem. This document gives details about some best practices for making your CIS deployment optimally reliable.

Generally, our recommended best practices are these:



* Set up your DNS to take advantage of CIS proxy servers and other features.
* Use one or more global load balancers to distribute your site traffic evenly.
* Set up appropriate page rules to manage your caching and other options.



Each of these items provides certain functionality you can use to create a more reliable CIS deployment.

Notice that the CIS interface is organized into sections for security, reliability, and performance.



 Setting up DNS 

To get started setting up your DNS configuration, select DNS from the navigation menu.

For detailed information about setting up and managing your DNS for reliability, see [Setting up your Domain Name System for CIS](https://cloud.ibm.com/docs/cis?topic=cis-set-up-your-dns-for-cis).





 Setting up global load balancers 

To get started setting up your global load balancers, select Global Load Balancers from the navigation menu.

For detailed information about setting up and managing your global load balancers, see [Global load balancer concepts](https://cloud.ibm.com/docs/cis?topic=cis-global-load-balancer-glb-concepts).





 Using page rules to increase reliability 

Here are some recommended page rule settings to give your site maximum reliability:



* Serve Stale Content
* Origin Cache Control
* Forwarding URL







 Serve Stale Content 

You can use the Serve Stale Content page rule setting to keep a limited version of your site online if your server goes down.

With Serve Stale Content, when your server goes down, CIS serves pages from our cache, so your visitors still see some of the pages they are trying to visit. Your visitors see a message at the top of the page telling them that they are in offline browsing mode.
Step 9: Manage compliance 

Controls are safeguards that are used to meet security and compliance requirements. Only controls that are supported by Security and Compliance Center, formatted correctly, and validated by Code Risk Analysis and Security and Compliance Center scans appear in the catalog. For more information, see [Adding compliance details](https://cloud.ibm.com/docs/account?topic=account-catalog-format-controls).



 Manage compliance controls 

You can review the controls that were added from your readme file and add additional controls.



1. Click Add controls.
2. Choose a profile.
3. Select the controls that you want to add to your version.
4. Click Add.







 Run Code Risk Analyzer scan 

Scan your source code with Code Risk Analyzer to identify any security vulnerabilities that you need to assess.



1. Click Run scan.
2. Wait for the scan to finish.







 Add Security and Compliance Center scan 

Add the scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. Select the profile that you scanned.
2. Select the Security and Compliance Center scan.
3. Click Add scan.
4. Click Next.









 Review requirements 

You must complete validation and any other requirements to publish to your account.





 Next steps 

After you onboard and validate your Terraform template, you're ready to publish it to your account. From the Actions menu, select Publish to account. As a result, the Terraform template is available to only users that have access to the Sample Terraform private catalog in your account.
* Users who manipulate, trigger (either directly in the user interface or indirectly by committing to a repo), or view the status of a delivery pipeline.
* Users who interact with DevOps Insights.



If your toolchain integrates Git Repos and Issue Tracking projects in the open-toolchain group that is provided by IBM, such as in us-south.git.cloud.ibm.com/open-toolchain, members of these projects are not counted as authorized users of your toolchains.

The Lite plan is subject to limits. For more information about the Lite plan and the Professional plan, see the [service catalog](https://cloud.ibm.com/catalog/services/continuous-delivery).

You can maintain an activity log related to authorized users. For more information about viewing, managing, and auditing service-initiated and user-initiated activities in your IBM Cloud® Continuous Delivery instances, see [IBM Cloud Activity Tracker events](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-cd-at-events).



 How are users counted for instances of Continuous Delivery in resource groups? 

Users are counted and managed by using the list of authorized users that belongs to each Continuous Delivery service instance. Users are automatically added to this list when they meet any of the following criteria:



* View, edit, or run a delivery pipeline.
* Have Developer (or greater) access to a repo in Git Repos and Issue Tracking that allows them to commit and push changes to that repo. Users of Git repos with the Guest or Reporter roles with read-only access are not counted as authorized users. Users of Git Project Access Tokens with the Developer (or greater) role are counted as authorized users. These users appear in the list of authorized users as bot users.



Users with the Guest or Reporter roles are not automatically added to the authorized users list. To prevent users from accessing toolchains and automatically being added to the authorized user list for a Continuous Delivery service instance, complete the following actions:



* Remove the user's access to the toolchain from IAM.
Users of Git Project Access Tokens with the Developer (or greater) role are counted as authorized users. These users appear in the list of authorized users as bot users.



Users with the Guest or Reporter roles are not automatically added to the authorized users list. To prevent users from accessing toolchains and automatically being added to the authorized user list for a Continuous Delivery service instance, complete the following actions:



* Remove the user's access to the toolchain from IAM.
* Remove Developer access from all Git Repos and Issue Tracking repos that are attached to all of the toolchains in the resource group by removing their repo access or downgrading their role to Guest or Reporter.



The specific activities that are used to automatically count users, and the method for counting those users might change over time. However, the process for counting users will continue to comply with the terms of Continuous Delivery plans. You can also manually add users to the list of authorized users, at any time.

For more information about using IAM to manage access to toolchains in a resource group or the toolchain itself, see [Managing user access to toolchains with Identity and Access Management](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-toolchains-iam-security). For more information about managing access to a Git Repos and Issue Tracking repo, see [Project's members](https://us-south.git.cloud.ibm.com/help/user/project/members/index.md).

The method that you use to organize toolchains within resource groups directly impacts user access and billing. When a user uses toolchains in multiple regions or resource groups, they are counted and billed for each Continuous Delivery service instance within each unique pairing of region and resource group.

You can manage the list of authorized users on the Manage tab within the Continuous Delivery service instance.



1. Go to the [Resource list](https://cloud.ibm.com/resources) for your IBM Cloud account.
2. In the Name column, in the filter text box, type Continuous Delivery to view your existing services.
3.
Managing your CIS deployment for best performance 

IBM Cloud® Internet Services (CIS) can provide the fastest experience for your customers because it optimizes your images, and it stores your web content as near as possible to your end-users. Your content is loaded from proxied edge servers (which reduces latency).

With CIS, you can enhance your site's performance further by using best practices to speed up the loading of your web content. Here are some specific best practices for enhancing the performance of your web content within CIS.

Recommended and best practices:



* Cache as much of your static and semi-static web content as possible
* For event-driven content, purge your cache using the API





 Best practice 1: Cache as much static and semi-static content as possible 



* Enable Cache Everything for static HTML web pages
* Use conservative Time-to-live (TTL) for your content that changes occasionally





 Utilize conservative TTLs (Time-to-Lives) for content that changes occasionally 

If content rarely changes, you can set a conservative TTL to utilize our cache as much as possible. If you have a high percentage of re-validation requests, you could increase the TTLs of your content without negatively affecting your customers. By using the cache more effectively, you'll increase performance because you'll revalidate less often.





 How do I tell if items are being cached? 

CIS adds the response header CF-Cache-Status when it attempts to cache an object. If caching is successful, the value of this header indicates its status with one of these keywords:



* MISS: The asset was not yet in the cache or the TTL had expired (that is, it had reached the cache-control maximum age of 0).
* HIT: The asset was delivered from the cache.
* EXPIRED: This asset was delivered from cache, but the next request requires revalidation.
* REVALIDATED: The asset was delivered from cache. The TTL was expired, but an If-Modified-Since request to the origin indicated that the asset had not changed. Therefore, the version in cache is considered valid again.









 Best practice 2: For event-driven content, purge your cache
Usually, it is combined with grouped rule-sets, these rule-sets aim to protect against vulnerabilities in the application by filtering out malicious traffic.



1. In the IBM Cloud Internet Services dashboard, navigate to Security, then on the WAF.
2. Ensure the WAF is On.
3. Click OWASP Rule Set. From this page, you can review the OWASP Core Rule Set and individually enable or disable rules. When a rule is enabled, if an incoming request triggers the rule, the global threat score will be increased. The Sensitivity setting will decide whether an Action is triggered for the request.



1. Leave default OWASP rule sets as it is.
2. Set Sensitivity to Low.
3. Set Action to Simulate to log all the events.



4. Click CIS Rule Set. This page shows additional rules based on common technology stacks for hosting websites.



For a secured connection with HTTPS, you can either obtain a certificate from [Let's Encrypt](https://letsencrypt.org/) as described in the following [IBM Cloud® blog](https://www.ibm.com/cloud/blog/secure-apps-on-ibm-cloud-with-wildcard-certificates) or through [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-public-certificates&interface=ui).





 Increase performance and protect from Denial of Service attacks 

A distributed denial of service ([DDoS](https://en.wikipedia.org/wiki/Denial-of-service_attack)) attack is a malicious attempt to disrupt normal traffic of a server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic. CIS is equipped to protect your domain from DDoS.



1. In the CIS dashboard, select Reliability > Global Load Balancer.
2. Locate the GLB you created in the Load Balancers table.
3. Enable the Security and Performance features in the Proxy column:

Zoom

!
* UI
* CLI
* API
* Terraform







 Managing user access 

IBM Cloud Hyper Protect Crypto Services supports a centralized access control system, which is governed by IBM Cloud® Identity and Access Management, to help you manage users and access for your encryption keys.



 Roles and permissions 

The following table shows the roles that Hyper Protect Crypto Services supports.



Table 1. Roles and permissions

 Roles Permissions 

 Service administrator Manages [platform access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-platform-mgmt-roles) and [service access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-service-access-roles), [grants access to vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaults), creates and deletes service instances, and manages keys. An IBM Cloud account owner is automatically assigned the service administrator permission. 
 Crypto unit administrator Provides signature keys, and signs Trusted Key Entry (TKE) administrative commands such as for adding another crypto unit administrator. In some cases, a crypto unit administrator can also be a master key custodian. 
 Master key custodian Provides master key parts for initializing a service instance. In some cases, a master key custodian can also be a crypto unit administrator. 
 Service user Manages root keys and standard keys through user interface and the API, and performs cryptographic operations through the PKCS #11 API or the Enterprise PKCS #11 over gRPC (GREP11) API.
* Move the iRules that you want to enable to the Enabled section.



10. Under the Policies section:



* Click Manage.
* Move the policy that you want to enable to the Enabled section.











 Step 11: Configure WAF on the virtual server 



 Enable license 



1. Under System > License, click the Module Allocation tab.
2. If Application Security (ASM) is not enabled, enable it with the Nominal selection.
3. BIG-IP restarts.
4. When the restart completes, log back into BIG-IP.







 Set up WAF 



1. Go to Security > Guided Configuration.
2. Click Web Application Protocol and then Web Application Comprehensive Protection.
3. Click Next.
4. Under Security Layers* do the following:



1. Enter a configuration name.
2. Enable any security layers that you would like. The security layers of Security Policy and Behavioral Analysis DoS should at least be enabled.
3. Click Save and Next.



5. Under Web Application Security Policy Properties:



1. Set the following:





* Select Enforcement Mode: Blocking
* Select type of policy to protect application: Generic
* Application Language: Select the language encoding for your web application





1. Click Save and Next.



6. Under Bot Defense Properties



1. Set the following:





* Select Enforcement Mode: Blocking
* Profile Template: Balanced





1. Click Save and Next.



7. Under DoS Profile Properties



1. Set the following under Operation Mode:





* Operation Mode: Blocking
* Verify that Bad actors behavior detection and Request signature detection are selected





1. Set the following under Mitigation Mode:





* Mitigation Mode: Standard





1. Click Save and Next.



8. Under Virtual Server Properties



1. Check Assign Policy to Virtual Server(s).
2. Under Virtual Server select Use Existing.
3. Under Assign Virtual Servers, move the virtual server that you created previously over from Available to Selected.
Catalog management on IBM Cloud 

As an account owner, you can control your users' access to the IBM Cloud catalog, which contains over 350 products available for public use. You can hide the IBM Cloud catalog from all users, or apply filters to scope the products that are available. Within your account, private catalogs provide more fine-tuned control over access to products in the IBM Cloud catalog.

Let's say you're an account administrator for your team, and you require access to all products in the IBM Cloud catalog. A member of your team is tasked with a specific project, for example, building a voice-enabled chatbot by using Watson Assistant, Speech to Text, and Text to Speech. And, you want them to access only those products in the IBM Cloud catalog.

To achieve this, you create one catalog that includes all products in the IBM Cloud catalog. Then, you create another catalog that includes only the required products, and you give the team member viewer access to the catalog.

For information about managing settings for all catalogs in your account, go to [Managing catalog settings](https://cloud.ibm.com/docs/account?topic=account-filter-account&interface=ui).

For information about filtering the products that are available to users in your account, go to [Customizing the IBM Cloud catalog and private catalogs for users in your account](https://cloud.ibm.com/docs/account?topic=account-restrict-by-user&interface=ui).

When you're ready, head over to [Catalog management](https://cloud.ibm.com/content-mgmt/overview) in the IBM Cloud console to get started.



 Watch and learn 



* Video transcript

Manage settings for catalogs across your account. Go to Manage > Catalogs to access catalog management. Then, click Settings.

Turn the IBM Cloud catalog off or on with one click. From the Settings page, you can control whether users in your account can access the IBM Cloud catalog or not. Toggle on the IBM Cloud catalog to make the catalog available for users in your account.

Add rules for fine-grained control.
The CD DevSecOps Toolchain uses the guided wizard that is provided by the toolchain template to configure the toolchain and integrate different tools with the CD toolchain. When the toolchain is configured, you can customize the toolchain as follows, for example:



* Integrate more tools supported by the CD Service. For example, update pipeline triggers.
* Update pipeline triggers that are provided by the toolchain or add more triggers to your pipelines.
* Update environment properties for your pipelines or add more properties for your pipelines.



* Continuous Compliance (CC) toolchain - Ensure that you are running a secure and compliant application: A template that ensures that your deployed artifacts and their source repositories are always compliant. The template uses Tekton pipelines and integrates with various tools and the [IBM Cloud® Security and Compliance Center](https://www.ibm.com/cloud/security-and-compliance-center). Tools include Git repos, secrets storage, image registry, and a change management system. The CC DevSecOps Toolchain uses the guided wizard that is provided by the toolchain template to configure the toolchain and integrate different tools with the CC toolchain. When the toolchain is configured, you can customize the toolchain as follows, for example:



* Integrate more tools supported by the CD Service. For example, update pipeline triggers.
* Update pipeline triggers provided by the toolchain or adds more triggers to your pipelines
* Update environment properties for your pipelines or add more properties for your pipelines



* Compliance Pipelines: The Tekton pipeline definitions are referenced from a Git Repos and Issue Tracking repository that is hosted in the IBM Cloud region. For instance, the pipeline definitions hosted in the Dallas region are in [compliance-pipelines](https://us-south.git.cloud.ibm.com/open-toolchain/compliance-pipelines). During the pipeline runs, these definitions are used by the underlying Tekton worker nodes to run the pipeline.



These reference implementations of Tekton definitions are managed and updated periodically by IBM.
In the Tags field, you can enter a name of a specific tag to attach to your Operator. Tags provide a way to organize, track usage costs, and manage access to the resources in your account.
3. Click Validate.







 Step 8: Manage compliance 

Controls are safeguards that are used to meet security and compliance requirements. Only controls that are supported by Security and Compliance Center, formatted correctly, and validated by Code Risk Analysis and Security and Compliance Center scans appear in the catalog. For more information, see [Adding compliance details](https://cloud.ibm.com/docs/account?topic=account-catalog-format-controls).



 Manage compliance controls 

You can review the controls that were added from your readme file and add additional controls.



1. Click Add controls.
2. Choose a profile.
3. Select the controls that you want to add to your version.
4. Click Add.







 Run Code Risk Analyzer scan 

Scan your source code with Code Risk Analyzer to identify any security vulnerabilities that you need to assess.



1. Click Run scan.
2. Wait for the scan to finish.







 Add Security and Compliance Center scan 

Add the scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. Select the profile that you scanned.
2. Select the Security and Compliance Center scan.
3. Click Add scan.
4. Click Next.









 Review requirements 

You must complete validation and any other requirements to publish to your account.





 Next steps 

After you onboard and validate your Operator, you're ready to publish it to your account. From the Actions menu, select Publish to account. As a result, the Operator is available only to users who have access to the Sample Operator private catalog in your account.