vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Interacting with the Client 

There are a few ways to interact with the client:



* Through terminal command line prior to startup
* After startup, using the client's interactive command line
* After startup, using the client's local UI





 Startup Configurations 



 Startup Arguments and Options 

The following table describes all of the available options that can be provided alongside the startup command for the client. Using these will allow complete configuration of the client prior to startup rather than requiring individual setup once the client is running.



 Parameter and Arguments Description 

 Connect to IBM Cloud by using the gateway ID that is provided 
 -F, --aclfile Access control List file 
 -g, --gateway hostname:port Used to manually select a specific gateway destination (advanced use only) 
 -l, --loglevel Change the log level to ERROR, INFO, DEBUG or TRACE 
 -p, --logpath Direct logging to a specific file 
 -P, --port The port for the UI to run on. Defaults to port 9003 
 -r, --reconnect Reconnect attempts after drop the connection between SG client and SG server, -1 means retry forever. Defaults to 20 
 -t, --sectoken The security token to use for this gateway connection 
 -w, --password The password to protect the UI with. Defaults to no password. Passwords must contain only letters. 
 -x, --proxy (For SG client v182fp2 and former) The proxy for the port 9000 wss connection 
 (For SG client v183 and later) The proxy for the port 9000 wss connection and port 443 gateway authentication connection 
 --noUI Prevent the UI from starting up automatically 
 --allow Allows all connections to the client. Is overridden by the ACL file, if provided 
 --service After an initial connection, the parent will restart within 60s if all child clients are terminated 



Note:--service, --allow, and --noUI flags should be the last parameters in the command line arguments.

The most basic use case is to start with a single client connection with the default settings:

<gateway_id> -t <security_token>
Image security API methods, IAM actions, and Activity Tracker events.

 API Method Description IAM action for the API Activity Tracker event 

 POST/v2/enableImageSecurity Enable image security. containers-kubernetes.cluster.operate cluster-image-security.enable 
 POST/v2/disableImageSecurity Disable image security. containers-kubernetes.cluster.operate cluster-image-security.disable 







 Ingress 



Ingress API methods, IAM actions, and Activity Tracker events.

 API Method Description IAM action for the API Activity Tracker event 

 GET/ingress/v2/secret/getSecret View Ingress secret details. containers-kubernetes.cluster.create cluster-ingress-secret.get 
 GET/ingress/v2/secret/getSecrets View Ingress secrets for a cluster. containers-kubernetes.cluster.create cluster-ingress-secret.list 
 POST/ingress/v2/secret/createSecret Create an Ingress secret for a certificate. containers-kubernetes.cluster.create cluster-ingress-secret.create 
 POST/ingress/v2/secret/deleteSecret Delete an Ingress secret from the cluster. containers-kubernetes.cluster.create cluster-ingress-secret.delete 
 POST/ingress/v2/secret/updateSecret Update an Ingress secret for a certificate. containers-kubernetes.cluster.create cluster-ingress-secret.update 
 POST/ingress/v2/secret/addField Add a field to an Ingress secret. containers-kubernetes.cluster.operate cluster-ingress-secret-field.add 
 POST/ingress/v2/secret/removeField Remove fields from an Ingress secret with a secret stored in IBM Cloud Secrets Manager. containers-kubernetes.cluster.operate cluster-ingress-secret-field.remove 
 POST/ingress/v2/secret/registerInstance Register an IBM Cloud Secrets Manager instance to the cluster. containers-kubernetes.cluster.update cluster-ingress-instance.create
callback(err, response);
});







 VerifyInit 

The VerifyInit function initializes a verification operation. You need to call this function first to verify a signature.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_VerifyInit, which is an implementation of PKCS #11 C_VerifyInit. 
 Parameters message VerifyInitRequest { Mechanism Mech = 2; bytes PubKey = 3; } message VerifyInitResponse { bytes State = 1; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet

VerifyInitRequest := &pb.VerifyInitRequest {
Mech: &pb.Mechanism{Mechanism: ep11.CKM_SHA1_RSA_PKCS},
PubKey: GenerateKeyPairResponse.PubKeyBytes,
}

VerifyInitResponse, err := cryptoClient.VerifyInit(context.Background(), VerifyInitRequest)
* JavaScript code snippet

client.VerifyInit({
Mech: {
Mechanism: ep11.CKM_SHA1_RSA_PKCS
},
PubKey: keys.PubKeyBytes
}, (err, data={}) => {
cb(err, signature, data.State);
});







 Verify 

The Verify function verifies a signature on single-part data. You don't need to perform the VerifyUpdate and VerifyFinal suboperations for a single-part verification. Before you call this function, make sure to run VerifyInit first.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_Verify, which is an implementation of PKCS #11 C_Verify. 
 Parameters message VerifyRequest { bytes State = 1; bytes Data = 2; bytes Signature = 3; } message VerifyResponse { }
Key Protect and Hyper Protect Crypto Services support the rotation of root keys, either on demand or on a schedule. When this occurs, App Configuration adopts the new key by rewrapping the DEK as described previously in [how customer-managed encryption works](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-managing-encryptionac-encryption-how).

An activity tracker event is generated to report the action. For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-at_events).







 Disabling customer-managed encryption 

After enabling customer-managed encryption, it is not possible to disable it. Instead, you must delete the service instance and create a new instance.
* UI
* CLI
* API







 Managing the network access policy 

After you set up your IBM Cloud® Hyper Protect Crypto Services instance, you manage network access policy by using the Hyper Protect Crypto Services key management service API.

Before you update the network access policy, you need to initialize the service instance first. See [Initializing service instances with the IBM Cloud TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm) or [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities) for instructions.

For more information about how the network access differs, see [Understanding the network access policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectionunderstand-network-access-policies).



 Updating the network access policy for your Hyper Protect Crypto Services instance with the console 

As a security administrator, if you prefer to update the network access policy for your instance by using a graphical interface, you can use the IBM Cloud console.

After the network access policy is set to private-only, the UI cannot be used for any Hyper Protect Crypto Services actions. Any Hyper Protect Crypto Services operations in the UI return an unauthorized error (HTTP status code 401).

After you create a Hyper Protect Crypto Services instance, complete the following steps to create a network access policy:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. In the UI of the selected service instance, select the Instance policies tab in the side menu.
5. In the Allowed network section, select the network that you want traffic to come through, and click Save policy.
Use the API, SDK, CLI, or console tools to apply the provided updates for the local entities (app code, CLI, and SDK). 







 Identity and access management 

You and IBM share responsibilities for controlling access to your IBM Cloud Event Notifications instances and resources.

You are responsible for identity and access management of your application and application data.



Table 3. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 Applications Offer ability to restrict access to resources. Depending on your needs, restrict access to resources and service functions by using Cloud IAM access policies. For more information, see [Managing user access](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-service-access-management). 







 Security and regulation compliance 

IBM is responsible for the security and compliance of IBM Cloud Event Notifications.

You are responsible for the security and compliance of your application and application data.



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Encryption <br><br> * Automatically apply security fix updates for infrastructure.<br> * Enable security settings, such as encrypted disks.<br> * Disable insecure actions, such as user SSH access to the host.<br> * Encrypt communication with TLS.<br> * Continuously monitor IBM Cloud Event Notifications entities to detect vulnerability and security compliance issues.<br> * Integrate IBM Cloud Event Notifications with IBM Cloud Identity and Access Management (IAM).<br><br><br> Manage IBM Cloud credentials, and keep credentials secure. 







 Disaster recovery 

IBM is responsible for the recovery of IBM Cloud Event Notifications components if there is a disaster.

You are responsible for the recovery of the workloads that run IBM Cloud Event Notifications and your application and application data.



Table 5. Responsibilities for disaster recovery

 Task IBM Responsibilities Your Responsibilities 

 Availability <br><br> * Provide high availability capabilities, such as IBM-owned infrastructure in multizone regions, to meet local access, and low latency requirements for each supported region.<br> * Run IBM Cloud Event Notifications deployments with three replicas in the same region for high availability.
: The phone and SMS with Twilio deployment documentation was updated to include instructions for migrating from Voice Agent with Watson. For more information, see [Integrating with phone](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-phonedeploy-phone-migrate-from-va) and [Integrating with SMS with Twilio](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-smsdeploy-sms-migrate-from-va).





 27 January 2021 

German language improvements
: A word decomposition function was added to the intent and entity recognition models for German-language dialog skills.

A characteristic of the German language is that some words are formed by concatenating separate words to form a single compound word. For example, "festnetznummer" (landline number) concatenates the words "festnetz" (landline) and "nummer" (number). When your customers chat with your assistant, they might write a compound word as a single word, as hyphenated words, or as separate words. Previously, the variants resulted in different intent confidence scores and different entity mention counts based on your training data. With the addition of the word decomposition function, the models now treat all compound word variants as equivalent. This update means you no longer need to add examples of every variant of the compound words to your training data.





 19 January 2021 

The Phone and SMS with Twilio integrations are now generally available!
: For more information, see:



* [Integrating with phone](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-phone)
* [Integrating with SMS with Twilio](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-sms)



Preview link change
: When you create a preview link, you can now test your skill from a chat window that is embedded in the page. You can also copy the URL that is provided, and open it in a web browser to see an IBM-branded web page with the web chat embedded in it.
<br><br> * Demonstrate compliance with control requirements of the IBM Cloud Framework for Financial Services<br> * Set up network for all created services<br> * Isolate network for all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 Network security architecture decisions 



Table 2. Network security architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Isolate management VPC and allow only a limited number of network connections<br> * All other connections from or to management VPC are forbidden<br><br><br> ACL and security group rules in management VPC Isolate environment for access through site-to-site VPN<br><br><br><br> * All ports to other VPCs are open<br><br><br> More ports might be opened in preset or added manually after deployment 
 <br><br> * Isolate workload VPC and allow only a limited number of network connections<br> * All other connections from or to workload VPC are forbidden<br><br><br> ACL and security group rules in workload VPC All ports to other VPCs are open More ports might be opened in preset or added manually after deployment 
 Load VPN configuration to simplify VPN setup VPNs VPN configuration is the responsibility of the customer 
 Collect and store Internet Protocol (IP) traffic information with Activity Tracker and Flow Logs Activity Tracker 
 Securely connect to multiple networks with a site-to-site virtual private network 







 Key and password management architecture decisions 



Table 3. Key and password management architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Use public SSH key to access virtual server instances by using SSH<br><br><br> Public SSH key provided by customer Ask customer to specify the key. Accept the input as secure parameter. 









 Next steps 

Read about [IBM Cloud for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about)
AC-17 - Remote Access 



  Control requirements 

The organization:

AC-17 (a)
:   Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

AC-17 (b)
:   Authorizes remote access to the information system prior to allowing such connections.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Connecting application provider to the management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management)
*  [Running operator actions through a bastion host](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion)







  NIST supplemental guidance 

Remote access is access to organizational information systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the Internet). Remote access methods include, for example, dial-up, broadband, and wireless. Organizations often employ encrypted virtual private networks (VPNs) to enhance confidentiality and integrity over remote connections. The use of encrypted VPNs does not make the access non-remote; however, the use of VPNs, when adequately provisioned with appropriate security controls (e.g., employing appropriate encryption techniques for confidentiality and integrity protection) may provide sufficient assurance to the organization that it can effectively treat such connections as internal networks. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. Also, VPNs with encrypted tunnels can affect the organizational capability to adequately monitor network communications traffic for malicious code. Remote access controls apply to information systems other than public web servers or systems designed for public access. This control addresses authorization prior to allowing remote access without specifying the formats for such authorization. While organizations may use interconnection security agreements to authorize remote access connections, such agreements are not required by this control. Enforcing access restrictions for remote connections is addressed in AC-3.
[Conditions](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/action-conditions-icon.png)

Conditions
3. Choose the variable for the condition. You can select any of the following:



* An action variable storing the customer response from a previous step in the action
* A session variable containing a value stored by any action
* A built-in variable set by the assistant or by an integration



You can also define a complex condition by writing an expression defining some other value. For more information about expressions, see [Writing expressions](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-expressions).
4. Select the operator representing the test you want to perform on the variable (for example, is or is not). The available operators for a particular value depend upon its data type. For more information, see [Operators](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-action-conditionsaction-conditions-operators).
5. Select the value you want to evaluate the condition against. The values available depend upon the type of value you are testing. For example, a variable containing an options response can be tested against any of the defined options, and a date value can be tested against any date.

Zoom

![Conditions](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/action-conditions-editor.png)

Conditions
6. To add more than one condition to an action, click Add condition.
7. To add another group of conditions, click New condition group.

You can use groups to build complex action conditions. Each group is evaluated true or false as a whole, and then these results are evaluated together.
Managing APIs 

Managing your APIs allows you to control usage, increase adoption and track statistics in the Lite, Enterprise, and Hybrid plans.

You can use API Connect to manage APIs in IBM Cloud, whether they are hosted in IBM Cloud or maintained outside of IBM Cloud.

If you are a customer, you can manage how it is used within the API Manager UI after a developer creates an API and pushes the product to IBM Cloud. The following topics describe how to create and manage products within API Connect.



 Exposing on-premises APIs through a Secure Gateway 

IBM Cloud Secure Gateway is deprecated and replaced with [IBM Cloud Satellite](https://www.ibm.com/cloud/satellite). For more information, see the [IBM Cloud Secure Gateway Deprecation](https://www.ibm.com/cloud/blog/ibm-cloud-secure-gateway-deprecation) notice.

You can create a secure gateway to securely expose on-premises APIs to IBM® API Connect for IBM Cloud®.

When you create a secure gateway and then provide a target address for its client or Cloud <host>:<port>, you integrate the features of the IBM Cloud Secure Gateway service with API Connect. This means that you have a secure way to access your on-premises APIs from API Connect through a secure passage. Effectively you create a tunnel to API Connect on a public environment without exposing your on-premises data. All that you need to do is create and configure the secure gateway service on IBM Cloud and provide an address for it in an API.

For more information about the Secure Gateway service, and how to set it up, see [About Secure Gateway](https://cloud.ibm.com/docs/SecureGateway?topic=securegateway-getting-started-with-sg).



 Using the secure gateway with your APIs 

When you have configured the gateway, you can use it with your APIs.

To use your secure gateway with APIs, complete the following steps.



1. Create your API and Product. When you create the API, be sure to select the Add a Product option to create a new Product at the same time.

IMPORTANT: Do not publish the Product yet.
CP-8 (1) - Priority of Service Provisions 



  Control requirements 

The organization:

CP-8 (1) (a)
:   Develops primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives); and

CP-8 (1) (b)
:   Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.





  NIST supplemental guidance 

Organizations consider the potential mission/business impact in situations where telecommunications service providers are servicing other organizations with similar priority-of-service provisions.
Enabling application Advanced Message Security (AMS) 

This guide talks you through enabling Advanced Message Security at the application level.



 What is IBM MQ Advanced Message Security? 

In an asynchronous messaging system, one process connects to the queue manager to put a message, called a Sender or Publisher, and another independent process connects to the queue manager to consume the message, called a Receiver or Subscriber. These two processes are loosely coupled and have no direct knowledge of one another. The only identity information that the consumer application can access is the identity information in the message itself. If the message is changed in transit or produced by an unauthorized sender, the consumer has no way to detect this situation with a plain text message. In this case, the consuming application trusts the identity of the message but cannot verify its authenticity. Also, this process opens a number of possibilities to intercept and modify the message while in custody of the queue manager.

IBM® MQ Advanced Message Security expands MQ security services to provide security at the 'message' level to protect sensitive data, such as high-value financial transactions and personal information. MQ Advanced Message Security is based on interceptors, that is, outbound messages are intercepted, signed, and optionally encrypted prior to the handoff to queue manager. Inbound messages are received from queue manager to the AMS layer, decrypted and validated as necessary, and then handed off to the receiving application. AMS architecture is capable of cryptographic protection of messages and enforcement of fine-grained protection policies that authorize individual senders and recipients of messages, with few or no changes to the application program logic.

There are two approaches to IBM MQ AMS, which we will refer to as Application AMS and [Queue Manager AMS](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_qm_ams). This tutorial focuses on Application AMS.



 AMS Protection Policy 

Protection policy defines the quality of protection to be used for protecting the messages. AMS provides message protection policies to allow message content to be signed and encrypted.