vania-janet/multiturn-rag-retrieval-data huggingface dataset:
IBM performs external and internal vulnerability scanning and subsequent remediation in all IBM Maximo Application Suite Dedicated environments on a quarterly basis per IBM IT Security Standards (ITSS). This includes Operating System, Middleware, Application and TCP/IP vulnerability scanning.

Vulnerabilities are assigned individual vulnerability ratings and exploitation categories (Critical, High, Medium or Low). These ratings are used to determine an IBM mandated time requirement to remediate and resolve the vulnerability.

Vulnerability scanning results and logs are considered IBM Confidential Information and are not disclosed to customers or prospects.

SQL Injection - please see FAQ link below regarding how Maximo protects against SQL injection: [https://www-01.ibm.com/support/docview.wss?uid=swg21419049](https://www-01.ibm.com/support/docview.wss?uid=swg21419049)





 Security Services 

The IBM Maximo Application Suite Dedicated team provides the following security and system access services. These services are included as part of IBM Maximo Application Suite Dedicated:

Setup of SSL certificates and DNS registration. This is standard by default and allows for secure browser based HTTPS (encrypted) access IBM Maximo Application Suite Dedicated end users.

Setup of IPsec Virtual Private Network (VPN) between client locations and IBM Cloud data center(s). VPN setup is optional, and is used to provide the following:



* Direct read-only access to IBM on Cloud databases
* LDAP authentication



Other uses are not currently available using VPN.

Setup and configuration of SSO including OIDC (default), SAML and LDAP user authentication for IBM Maximo Application Suite applications. SSO configuration is optional but is included as part of the IBM on Cloud subscription.





 Compliance - IBM Cloud (Infrastructure) 

All IBM Maximo Application Suite Dedicated customer environments are managed to IBM IT Security Standards (ITSS) defined by IBM’s Chief Information Security Officer (CISO). This includes vulnerability scanning and subsequent remediation.

IBM Cloud holds ISO-27001 certification and can provide SOC 1, 2 and 3 reports to customers

IBM Cloud (IaaS) ISO certificates:
Code Risk Analyzer vulnerability scan Finds vulnerabilities for all of the app package dependencies, container base images, and operating system packages. Uses the Code Risk Analyzer tool. 
 Code Risk Analyzer CIS check Runs configuration checks on Kubernetes deployment manifests. Uses the Code Risk Analyzer tool. 
 Code Risk Analyzer Bill of Material (BOM) check The BOM for a specified repo that captures the pedigree of all of the dependencies. This BOM is collected at different granularities. For example, the BOM captures the list of base images that are used in the build, the list of packages from the base images, and the list of app packages that are installed over the base image. The BOM acts as a ground truth for the analytic results and can potentially be used to enforce policy gates. Uses the Code Risk Analyzer tool. 
 Mend Unified Agent vulnerability scan The [Mend Unified Agent scanning tool](https://docs.mend.io/bundle/unified_agent/page/overview_of_the_unified_agent.html) scans app repos' open source components for vulnerable libraries and source files. For more information, see [Configuring Mend Unified Agent scans](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-mend-scans). 
 Repository compliance checking Checks that branch protection settings are correct. 



These scripts are run on all of the app repos that the pipeline is aware of. To add repos to these scans, use the [pipelinectl](https://cloud.ibm.com/docs/devsecops?topic=devsecops-pipelinectl) interface that is provided in your setup stage.

For more information about the expected output from user script stages, see [Custom scripts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-custom-scripts).





 Task jobs 



Table 3. Compliance scans and checks

 Task job Description
Secure support for SOC 2, NIST 800-53 rev4 and rev5 regulatory compliance
: SOC2, NIST 800-53 rev4 and NIST 800-53 rev5 standards have been added to the compliance feature. New checks have also been added to the admission controller, network security policies, and node analyzer.





 23 February 2021 

Secure support for Windows scanning in beta
: A beta version of Windows scanning is available as a standalone scanning engine. No UI, management, or historical data is available.

Secure support for a UI-based admission controller
: Kubernetes admission controlers define and customize the requests that are allowed on the cluster. An admission controller intercepts and process requests to the Kubernetes API prior to persisting the object and after the request is authenticated. Additional functionality is added to check images for common vulnerabilities and exposures (CVEs), misconfiguration, outdated images and so on. Container images that do not meet the configured admission policies are rejected from the cluster before being allowed to run.





 20 February 2021 

Secure support for CronJobs, Weave, and Cilium CNIs
: The network security policy tool has been upgraded to add CronJob, Weave, and Cilium CNIs in addition to Calico support.





 16 February 2021 

Secure support for multiple credentials
: You can now assign multiple credentials to the same registry depending on the relative internal registry path that is used to pull the image.





 10 February 2021 

Secure support for Inline Scanner
: V2.3 is supported with the following changes:



* Removes the prefixing of image names with localbuild when unneccessary.
* Improved version detection for Logback, SpringFramework, and Tomcat Java.
* Allows setting openssl using the OPENSSL_SECLEVEL environment variable to support old certificates.
* Creation of a more robust image ID to avoid unnecessary image rescans.
* Added malware detection.







 5 February 2021 

Importing Prometheus alert rules
: You can now import Prometheus alert rules.

Dashboard enhancements
: The following dashboard enhancements have been released:



* You can edit the dashboard scope within the panel editor.
Future releases are planned to support custom content in the OVAL format.
* Software Scan - This scan collects the software inventory that is installed on the target workload under management. This inventory is then available for search through the search option on the user interface.
* LogExtract - This scan supports log collection from Microsoft® Windows and Linux® workloads. The results are used for forensics purposes and ingested through machine learning to produce useful information.
* AMQP Task - This AMQP task is used for collecting live events from the VCD to enable real-time sync. RiskForesight consumes Asset add, delete, and update events and acts on these events. For example, if a new asset gets added and RiskForesight received that notification through AMQP then it updates the database immediately and starts the compliance risk and cyberrisk scan.
* VMware Infrastructure Scan - This scan carries out an infrastructure scan of the VMware Assets.
* VMware Vulnerability Scan - This scan carries out a Vulnerability scan of the VMware Assets.



* Compliance Regime - Available through license; NIST, NESA, PCI, ISO, HIPAA, GDPR, Custom, FFIEC, FedRAMP Low, FedRAMP Moderate, FedRAMP High
* Policy Manager - The Policy Manager serves policy creation function for an Organization based on the machine learning output. Caveonix provides three types of machine learning jobs per organization, which are non-editable. Additional jobs are not supported yet.

The following jobs are currently supported:



* Caveo Logs
* Caveo Networks
* Caveo Scan



* Anomaly - Based on the anomalies that are found in the data, you can configure the policies act based on the user-defined conditions. You can select the job type and configure Boolean conditions for the anomaly score and define action when condition is true.



See the following example:

Job: "Caveo Logs" Anomaly score is > 90 then Mark asset for quarantine and send Notification to slack Channel.
Job: "Caveo Network" Anomaly score is > 95 then quarantine the asset and send email notification and also send UI notification.
RA-5 - Vulnerability Scanning 



 Control requirements 

The organization:

RA-5 (a)
: Scans for vulnerabilities in the information system and hosted applications [IBM Assignment: weekly operating system/infrastructure and databases; weekly container images; quarterly web applications; annual source code/static analysis] and when new vulnerabilities potentially affecting the system/applications are identified and reported;

RA-5 (b)
: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:



1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;



RA-5 (c)
: Analyzes vulnerability scan reports and results from security control assessments;

RA-5 (d)
: Remediates legitimate vulnerabilities [IBM Assignment: Priority 1 (very high), such as publicly known vulnerabilities with very high likelihood and impact, must be mitigated within four (4) days from date of discovery; Priority 2 (high), such as vulnerabilities with high likelihood and high impact, must be remediated within 45 days; Priority 3 (moderate), such as vulnerabilities with moderate likelihood and impact, must be remediated within 100 days; Priority 4 (low) and 5 (very low) have no specific remediation period unless otherwise directed. Refer to table I-2 in NIST SP 800-30 for additional guidance on assessing risk] in accordance with an organizational assessment of risk; and

RA-5 (e)
: Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).





 Additional IBM Cloud for Financial Services specifications 



* The organization must remediate all Priority 1 (critical/high risk) and Priority 2 (moderate risk) vulnerabilities identified in new applications, releases, or public-facing systems before rolling out to production.
* All software/technology is upgraded to the most up to date supported version.







 Implementation guidance
Or, you might push a Docker image that you work with to your namespace so that other users can access the image. To get started, see [Adding images to your namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_).





 Managing security of images in IBM Cloud Container Registry with Vulnerability Advisor 

Vulnerability Advisor checks the security status of container images that are provided by IBM, third parties, or added to your organization's IBM Cloud Container Registry namespace.

When you add an image to a namespace, the image is automatically scanned by Vulnerability Advisor to detect security issues and potential vulnerabilities. If security issues are found, instructions are provided to help fix the reported vulnerability. To get started, see [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index).





 Setting up trusted content for container images 

You can build containers from trusted images that are signed and stored in IBM Cloud Container Registry, and prevent deployments from unsigned or vulnerable images.



1. [Sign images for trusted content](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontentregistry_trustedcontent). After you set up trust for your images, you can manage trusted content and signers that can push images to your registry.
2. To enforce a policy so that only signed images can be used to build containers in your cluster, [install the open source Portieris project](https://cloud.ibm.com/docs/openshift?topic=openshift-imagesportieris-image-sec).
3. Cluster users can deploy apps that are built from trusted images.



1. [Deploy to the default Kubernetes namespace](https://cloud.ibm.com/docs/openshift?topic=openshift-imagesnamespace).
2. [Deploy to a different Kubernetes namespace, or from a different IBM Cloud region or account](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother).
RA-5 (1) - Update Tool Capability 



  Control requirements 

RA-5 (1) - 0
:   The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities
*  Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)
*  Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely
*  Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts
*  Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities
*  Check whether DevSecOps Toolchain source code contains no secrets
*  Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code







  NIST supplemental guidance 

The vulnerabilities to be scanned need to be readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This updating process helps to ensure that potential vulnerabilities in the information system are identified and addressed as quickly as possible.
container-registry.exemption.create Create a Vulnerability Advisor exemption. 
 container-registry.exemption.delete Delete a Vulnerability Advisor exemption. 









 Analyzing Activity Tracker events 

The following fields are populated as described, depending on how you populate the request:



* target.name shows the image name and, if you request an image name with a tag, a tag. If you request an image name by digest, the digest is shown instead of the tag because the digest might have many tags.
* target.id shows the image name by digest to represent a searchable unique ID for the image, unless the request is for an image with a tag and the request fails before the digest is discovered. To see all the events for this digest across all tags, you can search by target.id.
* target.resourceGroupId shows the resource group ID that is associated with a namespace and its resources. For more information, see [Set up a namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_namespace_add).

Earlier namespaces that aren't migrated to IAM don't have a resource group, therefore this field is not available.





 Request data for vulnerability events 

Get the data for vulnerability events in Container Registry.



 Request data for the account vulnerability report 

Get the vulnerability assessment (container-registry.account-vulnerability-report.list) for the list of registry images that belong to a specific account.

The following table lists the fields that are available through the requestData field in events with the action container-registry.account-vulnerability-report.list.



Table 18. Custom event fields for Container Registry account vulnerability reports list

 Custom Event Fields Type Description 

 requestData.RequestParameters.repository String The name of the repository that you want to see image vulnerability assessments for. For example, us.icr.io/namespace/image. 
 requestData.RequestParameters.includeIBM String When set to true, the returned list contains IBM public images and the account images. If not set, or set to false, the list contains only the account images.
ibmcloud doi testrecord-publish --logicalappname "$MY_APP_NAME" --buildnumber "$MY_BUILD_NUMBER" --filelocation "./Report-final.xml" --type staticsecurityscan

Change the type to dynamicsecurityscan if the report is from a dynamic scan.





 Uploading SonarQube results 

To upload data from SonarQube, you must provide the SonarQube server token by using --token. Your SonarQube server is required to be accessible from your CI/CD tool.

After you run a scan by using SonarQube, you can upload SonarQube results by running this command.

ibmcloud doi testrecord-publish --logicalappname "$MY_APP_NAME" --buildnumber "$MY_BUILD_NUMBER" --filelocation ".scannerwork/report-task.txt" --type=sonarqube --token=$SONARQUBE_TOKEN

report-task.txt is a file that is generated during the SonarQube scan.





 Uploading IBM Vulnerability Advisor results 

To get the result of the vulnerability advisor scan from the CLI, use the following command:

ibmcloud cr va ${PIPELINE_IMAGE_URL} -o json > vulnerability_advisor.json

You can get your image's repository and tag from the Vulnerability Advisor UI or in the CLI by using ibmcloud cr image-list. DevOps Insights accepts only the JSON output. You can upload Vulnerability Advisor output file to DevOps Insights by running this command.

ibmcloud doi testrecord-publish --logicalappname "${APP_NAME}" --buildnumber "${BUILD_NUMBER}" --filelocation "vulnerability_advisor.json" --type vulnerabilityadvisor
: Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).





 Additional IBM Cloud for Financial Services specifications 



* The organization must remediate all Priority 1 (critical/high risk) and Priority 2 (moderate risk) vulnerabilities identified in new applications, releases, or public-facing systems before rolling out to production.
* All software/technology is upgraded to the most up to date supported version.







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Development processes and software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processes)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for RA-5 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 RA-5 (a) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br><br><br>
If you want to run Vulnerability Advisor in a different version, see [Setting the Vulnerability Advisor version](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_set_version). For more information about the versions of Vulnerability Advisor, see [About Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiabout).

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

ibmcloud cr image-digests [--format FORMAT | --quiet | -q | --json] [--restrict RESTRICTION] [--include-ibm] [--no-va] [--va]



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

--format FORMAT
: (Optional) Format the output elements by using a Go template. For more information, see [Formatting and filtering the Container Registry CLI output](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_cli_list).

--quiet, -q
: (Optional) Each image is listed in the format: repository@digest

--json
: (Optional) Outputs the list in JSON format.

--restrict RESTRICTION
: (Optional) Limit the output to display only images in the specified namespace or repository.

--include-ibm
: (Optional) Includes IBM-provided public images in the output. By default only private images are listed. You can view IBM-provided images in the global registry only.

--no-va
: (Optional) Excludes the security status (Vulnerability Advisor) results from the output.
To include security status, you can either add the --va option to the command, or use the [ibmcloud cr va](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_va) command to query the security status for an individual image.

For more information, see [Container Registry CLI stops returning security status results in lists by default from version 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_lists).

All releases of Container Registry plug-in 0.1 are deprecated
: All releases of version 0.1 of the Container Registry CLI plug-in are deprecated. You can continue to use releases of version 0.1, but version 1.0.0 is available for you to use. Version 0.1 will continue to be updated with any required updates until 15 September 2023. To update the version of your CLI plug-in, see [Updating the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespace&interface=uiregistry_cli_update).

Vulnerability Advisor 4 is available from Container Registry plug-in 1.0.0
: From Container Registry plug-in 1.0.0, you can choose whether to use Vulnerability Advisor version 3 or version 4 to run your commands. Vulnerability Advisor 4 is available from version 1.0.0 of the Container Registry plug-in. Vulnerability Advisor 3 is the default.

If you want to continue to use version 3, you don't need to do anything.

If you want to use version 4 to run the ibmcloud cr va, ibmcloud cr image-list, or ibmcloud cr image-digests commands, see [Setting the Vulnerability Advisor version](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_set_version).