vania-janet/multiturn-rag-retrieval-data huggingface dataset:
This option becomes available by selecting TLS or Mutual Auth for your [Resource Authentication](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-resource-auth). The name of the field will match the [type of destination](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-types) you have chosen.

To reject any connection which is not authorized with the list of supplied CAs, check the box Reject unauthorized from the Cloud/On-Premises Authentication panel. Once the box is checked and the resource you are connecting to is using a self-signed certificate, you must upload it, or the connection will be rejected.

It is allows for up to 6 certificates to be uploaded in order to validate the certificate of the resource which you are connecting to. These files will be added to the CA of connection to the resource and should contain the certificate or certificate chain that your resource will be presenting.

The box Reject unauthorized is supported only when using Secure Gateway Client v1.8.4 or later, old Secure Gateway Client will still reject unauthorized even if this box is unchecked.

Uncheck the box Reject unauthorized will leave you vulnerable to Man-in-the-middle attack.





 Server Name Indicator (SNI) 

This option becomes available by selecting TLS or Mutual Auth for your [Resource Authentication](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-resource-auth). It is the name of the host being connected to, and must be a host name, and not an IP address. It can be used to allow a separate hostname to be provided to the TLS handshake of the resource connection, or used by a multi-homed server to choose the correct certificate to present to the client. It is suggested to set this to be same as Resource Hostname.







 Client Certificate and Key
2. Copy the ID of the

root keythat you used to perform the initial wrap request.

You can retrieve the ID for a key by making a GET /v2/keys request, or by viewing your keys in the IBM Cloud console.
3. Copy the ciphertext value that was returned during the initial wrap request.
4. Run the following cURL command to decrypt and authenticate the key material.

curl -X POST 'https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>?action=unwrap' -H 'accept: application/vnd.ibm.kms.key_action+json' -H 'authorization: Bearer <IAM_token>' -H 'bluemix-instance: <instance_ID>' -H 'content-type: application/vnd.ibm.kms.key_action+json' -H 'x-kms-key-ring: <key_ring_ID>' -H 'correlation-id: <correlation_ID>' -d '{
"ciphertext": "<encrypted_data_key>"
}'

Replace the variables in the example request according to the following table.



Table 1. Describes the variables needed to unwrap keys in Hyper Protect Crypto Services

 Variable Description 

 region Required. The region abbreviation, such as us-south or au-syd, that represents the geographic area where your Hyper Protect Crypto Services service instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ID Required. The unique identifier for the root key that you used for the initial wrap request. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request.
* [Vonage](https://www.vonage.com/communications-apis/sip-trunking/)
* [Voximplant](https://voximplant.com/)



The SIP trunk provider sets up a SIP trunk for your voice traffic, and manages access from allowed IP addresses. Most of the major SIP trunk providers have existing relationships with IBM. Therefore, the network configuration that is required to support the SIP trunk connection typically can be handled for you with minimal effort.



1. Create a [IBM Cloud case](https://cloud.ibm.com/unifiedsupport/cases/form).
2. Click Customer success as the case type.
3. For Subject, enter SIP trunk provider setup for Watson Assistant.
4. Include the following information in the description:



* Company Name
* Your IBM Cloud account ID
* Your Watson Assistant service name
* Network diagram with IP address or SIP trunk provider information









 Bring your own SIP trunk 

If you choose to use a SIP trunk carrier that IBM does not have an established relationship with, you can do so.

The following table lists the fully qualified domain names and IP addresses that are used for SIP connections.



SIP network information

 Location Domain names IP addresses 

 Dallas public.0001.voip.us-south.assistant.watson.cloud.ibm.com <br>public.0002.voip.us-south.assistant.watson.cloud.ibm.com <br>public.0003.voip.us-south.assistant.watson.cloud.ibm.com 67.228.108.82 <br>169.63.5.162 <br>150.239.30.146 
 Frankfurt public.0001.voip.eu-de.assistant.watson.cloud.ibm.com <br>public.0002.voip.eu-de.assistant.watson.cloud.ibm.com <br>public.0003.voip.eu-de.assistant.watson.cloud.ibm.com 161.156.178.162 <br>169.50.56.146 <br>149.81.86.82
* You need to [add root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keysimport-root-key-gui) to Schematics services.
* You need to configure [service to service authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthcreate-auth) to integrate BYOK, and KYOK in Schematics service.



KMS setting is a one time settings. You need to open the [support ticket](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar) to update KMS settings.





 ibmcloud schematics kms instance ls 

Lists all the KMS instances of your IBM Cloud account to find your Key Protector Hyper Protect Crypto Services by using your location where keys are created and encrypted scheme such as KYOK, or BYOK.

Syntax

ibmcloud schematics kms instances ls --location LOCATION_NAME --scheme ENCRYPTION_SCHEME [--output OUTPUT]

Command options



Schematics KMS list flags

 Flag Required / Optional Description 

 --location or -l Required Set the Schematics location name. Supported values are US, or EU. 
 --scheme or -s Required Specify the encryption scheme. Supported values are KYOK, or BYOK. 
 --output or -o Optional Returns the command-line output in JSON format. Currently only JSON file format is supported. 
 --json or -j Deprecated Prints the output in the JSON format. 



Example

ibmcloud schematics kms instances ls -l US -s byok





 ibmcloud schematics kms enable 

Enable KMS to encrypt your data in the specific location. For more information about enabling customer-managed keys for Schematics, see [enabling keys](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datadata-storage).
A patch is created to close the vulnerability, and tests are performed on the patch to ensure that no collateral function is affected.



The timing of the notification varies depending on whether the event is unplanned, planned, or scheduled. The IBM Cloud infrastructure policy is to remedy problems as quickly as possible to remove or minimize the risk of further issues that might have a larger impact. Sometimes even planned maintenance is performed with only a short advanced notification.

To set up subscription notifications for your users, complete the following steps:



1. In the console, go to Manage > Account, and select Subscriptions.
2. Select a service from the table.
3. In the Subscribed column, select Yes for the user who wants to receive notifications.



You can also set up subscriptions under Additional notification preferences category.

To easily find the user you're looking for, click Filter and filter by given name, surname, or user name.



 Assigning required access to receive notifications 

Users that you set up for classic infrastructure notifications must also have access to the devices, network, and services that send the notifications.

To ensure that a user has the correct access, go to Manage > Access (IAM) > Users in the IBM Cloud console, select their name, and then select Classic infrastructure. From the Permissions option, assign users the following classic infrastructure permissions.



Table 1. Required classic infrastructure permissions for receiving user notifications

 Permission Category Required Permissions 

 Device View Hardware Details <br>View Virtual Server Details 
 Network Manage Network Gateways 
 Services Storage Manage 



Then, go to Devices to assign a user access to the specific devices and device types. You can also enable future access to all devices of a certain type. For more information about setting classic infrastructure permissions, see [Managing classic infrastructure access](https://cloud.ibm.com/docs/account?topic=account-mngclassicinfra).







 Managing invitation notifications 

Users can receive an invitation link in their notifications and by email to join an account, if they are already members of IBM Cloud. User managers can invite any user to the IBM Cloud platform if they have an email address to use for an invite.
In the Tool Integrations section, select each tool integration that you want to configure for your toolchain. A few of the tool integrations do not require configuration. For more information about configuring the tool integrations, see [Configuring tool integrations](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-integrations).

Many of the tool integrations that comprise a toolchain require a secret to authenticate with the Continuous Delivery service.

A secret is credentials that can be provided in the form of a password, authentication token, API key, or certificate. For example, when you add the Delivery Pipeline tool integration to your toolchain, you must provide a secret in the form of an API key.

a. In the Tool Integrations section, click Delivery Pipeline.

b. Click New to create an IBM Cloud® API Key.

c. Click OK to apply your new API key.

Each user can have a maximum of 20 API keys.

d. Click OK to create the API key without saving a secure copy of the key.

e. To securely save the API key so that you can use it again in other toolchain workflows:



* Select the Save this key in a secrets store for reuse checkbox to integrate with the Key Protect or Secrets Manager secrets store.
* If you don't have an existing instance of Key Protect or Secrets Manager, specify a name for the instance and the secret.
* Click OK to apply your new API key.



f. To validate that your Key Protect or Secrets Manager instance was successfully created, go to your [IBM Cloud® Resource list](https://cloud.ibm.com/resources) and expand the Services twistie. To view your API keys, from the menu bar, click Manage > Access (IAM), and select IBM Cloud® API keys.

g. The API key that you created and copied to Key Project is now available for use on the Create a Toolchain page. Any tool integration that requires a secret displays a key icon.
A user is expected to look in their phone or email to obtain the code and then enter it into the provided screen.
3. If the code they input matches the code that they were sent, the user is redirected back to your application and is signed in. If they enter the code incorrectly, the second authentication factor fails and users are not able to access your resources.



If email verification is not configured, App ID validates the MFA channel in the background. For example, if you configure the email channel for MFA and do not configure email verification, App ID validates the email on the first successful MFA login. But, if you configure the SMS channel, App ID validates the user's phone number on the first successful login. If you're using the SMS channel and want the email to be validated, be sure to enable email verification.



 Configuring an email channel 

You can configure App ID to send the MFA code to your users through email.

When you enable MFA for the first time, the following two things happen:



* By default, the email channel is selected. You can switch to the [SMS channel](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfacd-mfa-configure-sms).
* App ID automatically registers the primary email that is attached to your Cloud Directory user's profile.



If a user's email is not already confirmed, through either the [management APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//) or through email verification when they sign up, they are confirmed when they successfully verify an MFA code.

The first time that MFA is enabled, it is set to use email by default. You can change the setting to use SMS, but you cannot configure both at the same time.



 With the GUI 

You can configure the MFA email channel through the GUI.



1. Navigate to the Cloud Directory > Multifactor authentication tab of the App ID dashboard.
2. In the Enable Multifactor authentication box, on the Settings tab, toggle MFA to Enabled.
The audio file must be single channel (mono) and PCM-encoded, and must have an 8,000 Hz sampling rate with 16 bits per sample. 
 channel_options.voice_telephony.loop Whether to repeatedly restart the audio playback after it finishes. The default value is false. 



If you set channel_options.voice_telephony.loop to true, add a user-defined response with the vgwActForceNoInputTurn command. This command instructs the phone integration to initiate a turn with a vgwNoInputTurn text without waiting for an input from the caller. In the vgwNoInputTurn turn you can initiate a transaction while the caller is on hold. When the vgwNoInputTurn turn completes, the looped audio stops.

The following example shows an audio response with loop=true, and a user_defined response specifying the vgwActForceNoInputTurn command.

{
"generic": [
{
"response_type": "user_defined",
"user_defined": {
"vgwAction": {
"command": "vgwActForceNoInputTurn"
}
}
},
{
"response_type": "audio",
"source": "https://upload.wikimedia.org/wikipedia/commons/d/d8/Random_composition3.wav",
"channel_options": {
"voice_telephony": {
"loop": true
}
}
}
]
}
Show more





 Enabling keypad entry 

If you want customers to be able to send information by typing it on their phone keypad instead of speaking, you can add support for phone keypad entry. The best way to implement this type of support is to enable dual-tone multifrequency (DTMF) signaling. DTMF is a protocol used to transmit tones that are generated when a user presses keys on a push-button phone. The tones have a specific frequency and duration that can be interpreted by the phone network.
}





 Defining a sequence of phone commands 

If you want to run more than one command in succession, include multiple responses in the generic array. These commands are processed in the order in which they are specified in the array.

This example shows two responses: first a text response, followed by an end_session response to end the call.

{
"generic": [
{
"response_type": "text",
"values":
{
"text": "Goodbye."
}
],
"selection_policy": "sequential"
},
{
"response_type": "end_session"
}
]
}
Show more





 Injecting custom values into CDR log events 

If you are using a log webhook to log call detail record (CDR) events, you can use the cdr_custom_data context variable to add custom data to logged events. You can use this method to record data during a call (for example, to indicate the completion of a specific tasks).

To log custom CDR data, use the JSON editor to edit the context. Define cdr_custom_data as a child of the context.integrations.voice_telephony object, as in this example:

"context": {
"integrations": {
"voice_telephony": {
"cdr_custom_data": {
"key1": "value1",
"key2": "value2"
}
}
}
}

The cdr_custom_data object can contain any valid JSON data.

When you generate a CDR report, the custom data is included in the injected_custom_data field, as in this example:

{
"payload": {
...
"injected_custom_data": {
"key1": "value1",
"key2": "value2"
}
...
}
}
If you want customers to be able to send information by typing it on their phone keypad instead of speaking, you can add support for phone keypad entry. The best way to implement this type of support is to enable dual-tone multifrequency (DTMF) signaling. DTMF is a protocol used to transmit tones that are generated when a user presses keys on a push-button phone. The tones have a specific frequency and duration that can be interpreted by the phone network.

To start listening for tones as the user presses phone keys, use the dtmf response type in an action step. This response type can be added using the JSON editor.

{
"generic": [
{
"response_type": "dtmf",
"command_info": {
"type": "<command type>",
"parameters": {
"parameter name": "parameter value",
"parameter name": "parameter value"
}
},
"channels":
{
"channel": "voice_telephony"
}
]
}
]
}
Show more

The command_info property specifies a DTMF command for the phone integration. The supported commands and their related parameters are as follows.



 command_info.type : collect 

Instructs the phone integration to collect dual-tone multi-frequency signaling (DTMF) input from a user. This command supports the following parameters:



 parameter name description required default 

 termination_key The DTMF termination key, which signals the end of DTMF input (for example, ). no n/a 
 count The number of DTMF digits to collect. This must be a positive integer no larger than 100. Required if termintation_key, or minimum_count and maximum_count, are not defined n/a 
 minimum_count The minimum number of DTMF digits to collect. This property is used along with maximum_count to define a range for the number of digits to collect. This value must be a positive integer with a minimum value of 1 and a maximum value less than maximum_count.
AC-19 - Access Control for Mobile Devices 



  Control requirements 

The organization:

AC-19 (a)
:   Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

AC-19 (b)
:   Authorizes the connection of mobile devices to organizational information systems.





  NIST supplemental guidance 

A mobile device is a computing device that: (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the device to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, E-readers, and tablets. Mobile devices are typically associated with a single individual and the device is usually in close proximity to the individual; however, the degree of proximity can vary depending upon on the form factor and size of the device. The processing, storage, and transmission capability of the mobile device may be comparable to or merely a subset of desktop systems, depending upon the nature and intended purpose of the device. Due to the large variety of mobile devices with different technical characteristics and capabilities, organizational restrictions may vary for the different classes/types of such devices. Usage restrictions and specific implementation guidance for mobile devices include, for example, configuration management, device identification and authentication, implementation of mandatory protective software (e.g., malicious code detection, firewall), scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware (e.g., wireless, infrared). Organizations are cautioned that the need to provide adequate security for mobile devices goes beyond the requirements in this control. Many safeguards and countermeasures for mobile devices are reflected in other security controls in the catalog allocated in the initial control baselines as starting points for the development of security plans and overlays using the tailoring process. There may also be some degree of overlap in the requirements articulated by the security controls within the different families of controls. AC-20 addresses mobile devices that are not organization-controlled.
Review and complete the following tasks to learn about how you can ensure the security of your account and resources.



Table 3. Getting started tasks for securing your account and resources

 Task Description 

 <br><br> * Set up multifactor authentication<br><br><br> Multifactor authentication (MFA) adds an extra layer of security to your account by requiring all users to authenticate by using an extra authentication factor beyond an ID and password. This is also commonly known as two-factor authentication (2FA).<br><br>Review the [types of multifactor authentication](https://cloud.ibm.com/docs/account?topic=account-types) that can be enabled for your account. <br>Follow the steps in [enabling MFA for your account](https://cloud.ibm.com/docs/account?topic=account-enablemfa) to configure the setting that is most appropriate for your company. 
 <br><br> * Identity and Access Management (IAM) overview<br><br><br> Learn about what IBM Cloud IAM is, how IAM works, what features are available, and how to access the console, CLI, and APIs to work with IAM in your account. Learn more about [how IBM Cloud IAM works](https://cloud.ibm.com/docs/account?topic=account-iamoverview). 
 <br><br> * Track your account activities by setting up an IBM Cloud Activity Tracker instance<br><br><br> You can use the IBM Cloud Activity Tracker service to track how users and applications interact with IBM Cloud resources that you have created.
* [Search for the answer](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-step-what-nextsearch-for-answer)
* [Connect to agent](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-step-what-nextconnect-to-agent)
* [End the action](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-step-what-nextend-action)





 Continue to next step 

This option processes the next step in the steps list. As always, the conditions for the next step are evaluated first to determine whether to show the step's response to the customer. This is the default selection.





 Re-ask previous step(s) 

This option repeats one or more steps that are listed earlier in the current action. These might be steps that the customer already completed, or steps that were skipped previously based on their step conditions.

You can use this option to handle situations where the customer has made a mistake and asks to go back to a previous point in the conversation. For example, you might include a confirmation step at the end of a process that asks the user whether the collected information is correct; if the user says no, you can return to the beginning of the process. This option is only available from a step that comes third or later in the steps list.

To repeat previous steps:



1. In the And then field, select Re-ask previous step(s).
2. In the Settings window, click to select any previous steps you want to repeat. You can select any step that precedes the step you are editing.

Note that only the selected steps will repeat, regardless of their And then settings. Therefore, if you want to repeat the entire action up to this point, you must select all of the previous steps.

The current step you are editing is automatically included in the list of steps to be repeated. To avoid an infinite loop, use step conditions to ensure that this step only executes when it is appropriate for previous steps to be repeated.