vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The WebSocket protocol is lightweight. It requires only a single connection to perform live-speech recognition.
* Enables audio to be streamed directly from browsers (HTML5 WebSocket clients) to the service.
* Returns results as soon as they are available when you use a next-generation model or request interim results.









 Using speech recognition parameters 

The service's speech recognition interfaces share largely common parameters for transcribing speech to text. The parameters let you tailor aspects of your request, such as whether the data is streamed or sent all at once, and the information that the service includes in its response.

The following sections introduce the speech recognition parameters and their functionality. Some parameters are available only for some speech recognition interfaces or for some languages and models. For information about all parameters and their interface and language support, see the [Parameter summary](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-summary).



 Audio transmission and timeouts 



* [Audio transmission](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-inputtransmission) describes how you can pass audio as a continuous stream of data chunks or as a one-shot delivery that passes all of the data at one time. With the WebSocket interface, audio data is always streamed to the service over the connection. With the HTTP interfaces, you can stream the audio or send it all at once.
* [Timeouts](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-inputtimeouts) are used by the service to ensure an active flow of data during audio streaming. When you initiate a streaming session, the service enforces inactivity and session timeouts from which your application must recover gracefully. If a timeout lapses during a streaming session, the service closes the connection.







 Interim results and low latency 



* [Interim results](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-interiminterim-results) are intermediate hypotheses that the service returns as transcription progresses.
This tactic is commonly used by abuse bots, crawlers, or APIs.
* Challenge passage - Controls how long a visitor that passed a challenge (or JavaScript challenge) gains access to your site before they are challenged again. This challenge is based on the visitor's IP, and therefore does not apply to challenges presented by WAF rules because they are based on an action that the user performs on your site.
* Security level - Sets the security level of your website to determine which visitors receive a challenge page.
* Always use HTTPS - Redirects all visitors to the HTTPS version.
* Email obfuscation - Prevents spam from harvesters and bots that try to access email addresses on your pages.
* Automatic HTTPS rewrites - Helps fix mixed content by changing http to https for all resources (or links) on your website that can be served with HTTPS.
* Opportunistic encryption - Allows browsers to benefit from the improved performance of HTTP/2 by informing them that your site is available over an encrypted connection.
* Universal SSL - Activates universal SSL certificates from your zone to the edge.
* True client IP header - Sends the user's IP address in the True-Client-IP header.







 Security standards and platform 



* TLS (SHA2 and SHA1)
* IPv4 and IPv6
* HTTP/2







 Network attacks and mitigation 

Generally, attacks fall into two categories:



Table 1. Types of network attacks

 Layer-3 or Layer-4 attacks Layer-7 attacks 

 These attacks consist of a flood of traffic at ISO Layer 3 (the network layer), such as ICMP floods, or at Layer 4 (the transport layer), such as TCP SYN floods or reflected UDP floods. These attacks send malicious ISO Layer-7 requests (the application layer), such as GET floods. 
 Automatically blocked at CIS edge CIS handles these attacks with Defense mode, WAF, and security-level settings. 







 On-demand anti-DDoS 

IBM Cloud Internet Services ingests traffic by returning a CIS IP address on the DNS lookup for a domain, instead of the actual record for the origin server’s IP address.
The rich response types often behave differently when they are displayed in different built-in integrations or in the assistant preview. For more information about these unique behaviors, see the following topics:



* [Web chat](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-web-chatdeploy-web-chat-dialog)





* [Phone](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-phonedeploy-phone-dialog)





* [SMS with Twilio](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-smsdeploy-sms-dialog)





* [Assistant preview](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-web-linkdeploy-web-link-dialog)



If you need to provide customized responses for different channels, and you do not need to modify your dialog flow based on which integration is in use, you can also use the channels array to target your responses to specific integrations. For more information, see [Targeting specific integrations](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-responses-jsondialog-responses-json-target-integrations).





 Web chat: Accessing sensitive data 

If you enable security for the web chat, you can configure your web chat implementation to send encrypted data to the dialog. Payload data that is sent from web chat is stored in a private context variable named context.integrations.chat.private.user_payload. No private variables are sent from the dialog to any integrations. For more information about how to pass data, see [Passing sensitive data](https://cloud.ibm.com/docs/assistant?topic=assistant-web-chat-securityweb-chat-security-encrypt).

To access the payload data, you can reference the context.integrations.chat.private.user_payload object from the dialog node condition.

You must know the structure of the JSON object that is sent in the payload.
Agent status is set to Invisible unless it is explicitly changed.





 Turn on Agent Workspace 

Zendesk Agent Workspace brings Zendesk Chat and Zendesk Support together, so all your customer interactions are in one place, and communication is seamless, personal, and efficient. That means more productive agents and happy customers.

In Zendesk:



1. Click the Products icon and go to the Admin Center.
2. Click Workspaces.
3. Click the Turn on Agent Workspace button. The green On box should display.



Agent Workspace should now feature on several screens in Zendesk Support, including on the Dashboard with tickets, the Visitors page, and in the top menu as Conversations where agents can accept chats from customers waiting for assistance.







 Securing the transfer to Zendesk 

You must collect the name and email address of each user, if enabling security in Zendesk. This information must be passed to the web chat so it can be provided to Zendesk when the conversation is transferred.

When you add security to your Zendesk integration, you ensure that the visitors you are helping are legitimate customers. Enabling visitor authentication also enables support for cross-domain traffic and cross-browser identification. For more information, see the [Enabling authenticated visitors in Zendesk](https://support.zendesk.com/hc/en-us/articles/360022185314-Enabling-authenticated-visitors-in-the-Chat-widget).

Before you can secure the Zendesk connection, complete the following required tasks:



1. Secure the web chat. For more information see [Securing the web chat](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-web-chat-security).
2. Encrypt sensitive information that you pass to the web chat.

When you enable security in Zendesk, you must provide the name and email address of the current user with each request. Configure the web chat to pass this information in the payload.

Specify the information by using the following syntax. Use the exact names (name and email) for the two name and value pairs.
On SecureGateway Client, change the log level to TRACE to know the data activities on the client. The following information will be displayed after requests are sent.

Data size sent from request application:

[TRACE] Connection <connection ID> transmitted data: <size> bytes

Data size sent from destination:

[TRACE] Connection <connection ID> received data: <size> bytes
* How do I get the amount of the real-time connections on Secure Gateway?



 To get connections information such as the amount of the real-time connections, the data size sent and received from Secure Gateway Client, do the following: 



* On Secure Gateway client interactive command line: Type s to print the connection status details.
* On Secure Gateway client UI, click the Connection Information menu



The following connection statistics would be displayed:



* Overall data size transmitted.
* Overall data size received.
* The amount of total connections.
* Real-time active connections.



Note: This connections information is on Client level, not in Gateway level. If you need connections information in Gateway level, please check each Client which connected to that Gateway.



* How many concurrent connections can Secure Gateway handle?

If the connections are being rejected or having latency, the connections might be exceeding concurrent connections limit.

The Secure Gateway can handle only 250 concurrent connections. For details, see [Limitations](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-client-interactinglimits).

For SG client v186 and later, there will be error shown in SG client log in each 30 seconds when the concurrent connections exceed the limit on cloud side.
* What are the recommended configurations to make my connections more secure?

Set these configuations to make connections more secure:



 Reject unauthorized 

To protect against Man-in-the-middle attack, reject connections to the resource which is not authorized with the list of supplied CAs. On the Resource Authentication, check the box Reject unauthorized, then upload the certificate if the certificate of the resource is self-signed.
* [HTTPS only origin pull](https://cloud.ibm.com/docs/cis?topic=cis-cis-tls-optionstls-encryption-modes-origin-only-pull) (Enterprise only)





 Off 

No secure connection between your visitor and CIS, and no secure connection between CIS and your web server. Visitors can only view your website over HTTP, and any visitor attempting to connect using HTTPS receives an HTTP 301 Redirect to the plain HTTP version of your website.

Zoom

![Diagram of TLS Off](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/off.png)

Figure 1. A diagram of TLS Off





 Client-to-Edge 

A secure connection between your visitor and CIS, but no secure connection between CIS and your web server. You don't need to have a TLS certificate on your web server, but your visitors still see the site as being HTTPS-enabled. This option is not recommended if you have any sensitive information on your website. This setting only works for port 443->80. It should only be used as a last resort if you are not able to set up TLS on your own web server. It is less secure than any other option (even "Off"), and could cause you trouble when you decide to switch away from it.

Zoom

![Diagram of Client to edge TLS](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/client-to-edge.png)

Figure 2. A diagram of Client to edge TLS





 End-to-End flexible 

A secure connection between your visitor and CIS, and secure connection (but not authenticated) between CIS and your web server. You must have your server configured to answer HTTPS connections, with a self-signed certificate at least.
content-type: 'audio/l16;rate=22050'
};
websocket.send(JSON.stringify(message));
}

If it receives the request successfully, the service returns the following text message to indicate that it is listening. The listening state indicates that the service instance is configured (the JSON start message was valid) and is ready to accept audio for a recognition request.

{'state': 'listening'}

If the client specifies an invalid query parameter or JSON field for the recognition request, the service's JSON response includes a warnings field. The field describes each invalid argument. The request succeeds despite the warnings.





 Send audio and receive recognition results 

After it sends the initial start message, the client can begin to send audio data to the service. The client does not need to wait for the service to respond to the start message with the listening message. Once it begins listening, the service processes any audio that was sent before the listening message.

The client must send the audio as binary data. The client can send a maximum of 100 MB of audio data per send request. It must send at least 100 bytes of audio for any request. The client can send multiple requests over a single WebSocket connection. For information about using compression to maximize the amount of audio that you can pass to the service with a request, see [Data limits and compression](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-audio-formatsaudio-formats-limits).

The WebSocket interface imposes a maximum frame size of 4 MB. The client can set the maximum frame size to less than 4 MB. If it is not practical to set the frame size, the client can set the maximum message size to less than 4 MB and send the audio data as a sequence of messages. For more information about WebSocket frames, see [IETF RFC 6455](https://tools.ietf.org/html/rfc6455).

How the service sends recognition results over a WebSocket connection depends on whether the client requests interim results.
US-EAST https://us-east.security-compliance-secure.cloud.ibm.com/api 
 AU-SYD https://au-syd.security-compliance-secure.cloud.ibm.com/api 
 CA-TOR https://ca-tor.security-compliance-secure.cloud.ibm.com/api 
 BR-SAO https://br-sao.security-compliance-secure.cloud.ibm.com/api 









 Collector endpoints 

Collector endpoints are ingestion endpoints that you can use to send data.



 Private Collector endpoints 

To send metrics by using a private endpoint, you must [enable virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) for your account.

The following table lists the Private Collector endpoints that are available for each region:



Table 4. List of ingestion endpoints and private IP addresses to send data to the IBM Cloud Security and Compliance Center Workload Protection

 Region Private ingestion endpoint Private IP addresses IBM Cloud Security and Compliance Center Workload Protection agent ports 

 US-SOUTH ingest.private.us-south.security-compliance-secure.cloud.ibm.com 166.9.14.170 <br>166.9.48.41 <br>166.9.17.11 TCP 6443 
 EU-DE ingest.private.eu-de.security-compliance-secure.cloud.ibm.com 166.9.32.51 <br>166.9.30.53 <br>166.9.28.71 TCP 6443 
 EU-GB ingest.private.eu-gb.security-compliance-secure.cloud.ibm.com 166.9.34.56 <br>166.9.36.71 TCP 6443 
 JP-OSA ingest.private.jp-osa.security-compliance-secure.cloud.ibm.com 166.9.72.14 <br>166.9.71.15 <br>166.9.70.14 TCP 6443
* opportunistic_onion: Allow legitimate users of Tor Browser to access your websites.
* hotlink_protection: Protect your images from off-site linking.
* http2: Accelerate your website with HTTP/2.
* http3: Accelerate your website with HTTP/3.
* image_load_optimization: Improve load time for pages that include images on mobile devices with slow network connections.
* image_size_optimization: Improve image load time by optimizing images hosted on your domain.
* ip_geolocation: Include the country code of the visitor location with all requests to your website.
* ipv6: Enable IPv6 support and gateway.
* max_upload: The amount of data visitors can upload to your website in a single request.
* min_tls_version: Only allow HTTPS connections from visitors that support the selected TLS protocol version or newer.
* minify: Reduce the file size of source code on your website.
* mobile_redirect: Redirect visitors that are using mobile devices to a mobile-optimized website.
* opportunistic_encryption: Opportunistic Encryption allows browsers to benefit from the improved performance of HTTP/2 by letting them know that your site is available over an encrypted connection.
* origin_error_page_pass_thru: When Origin Error Page is set to On, CIS will proxy the 502 and 504 error pages directly from the origin (Enterprise plan only).
* prefetch_preload: CIS will prefetch any URLs included in the prefetch HTTP header (Enterprise plan only).
* pseudo_ipv4: Adds an IPv4 header to requests when a client is using IPv6, but the server only supports IPv4.
* response_buffering: Enable or disable buffering of responses from the origin server (Enterprise plan only).
* script_load_optimization: Improve the paint time for pages that include JavaScript.
* security_header: Enforce web security policy for your website.
* security_level: Choose the appropriate security profile for your website.
* server_side_exclude: Automatically hide specific content from suspicious visitors.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Vim (CVE-2022-1621)](https://www.ibm.com/support/pages/node/6843871)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow in Vim (CVE-2022-1629)](https://www.ibm.com/support/pages/node/6843873)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Vim (CVE-2022-1785, CVE-2022-1897, CVE-2022-1927)](https://www.ibm.com/support/pages/node/6843875)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in cURL libcurl (CVE-2022-22576)](https://www.ibm.com/support/pages/node/6843877)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to credential exposure in cURL libcurl (CVE-2022-27774)](https://www.ibm.com/support/pages/node/6843879)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to data information exposure in cURL libcurl (CVE-2022-27776)](https://www.ibm.com/support/pages/node/6843881)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in cURL libcurl (CVE-2022-27782)](https://www.ibm.com/support/pages/node/6843883)
Passing Watson Assistant Metadata in SIP Signaling 

To support loading the conversational history between the caller and Watson Assistant, the phone integration specifies a value for the User-to-User header as a key that can be used with the web chat integration. If User-to-User is specified in the transfer_headers list, the session history key is sent in the X-Watson-Assistant-Session-History-Key header.

The value of the SIP header is limited to 1024 bytes.

How this data is presented in the SIP REFER message also depends on the value of transfer_headers_send_method(as defined in [Generic Service Desk SIP Parameters](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-voice-actionsgeneric-service-desk-sip-parameters)).

The following example shows the data included as headers:

REFER sip:b@atlanta.example.com SIP/2.0
Via: SIP/2.0/UDP agenta.atlanta.example.com;branch=z9hG4bK2293940223
To: <sip:b@atlanta.example.com>
From: <sip:a@atlanta.example.com>;tag=193402342
Call-ID: 898234234@agenta.atlanta.example.com
CSeq: 23 REFER
Max-Forwards: 7
Refer-To: sip:user@domain.com
X-Watson-Assistant-Token: 8f817472-8c57-4117-850d-fdf4fd23ba7
User-to-User: dev::latest::212033::0a64c30d-c558-4055-85ad-ef75ad6cc29d::978f1fd7-4e24-47d8-adb0-24a8a6eff69e::b5ffd6c2-902f-4658-b586-e3fc170a6cf3::7ad616a350cc48078f17e3ee3df551de;encoding=ascii
* email_obfuscation: Encrypt email addresses on your web page from bots while keeping them visible to humans.
* opportunistic_onion: Allow legitimate users of Tor Browser to access your websites.
* hotlink_protection: Protect your images from off-site linking.
* http2: Accelerate your website with HTTP/2.
* http3: Accelerate your website with HTTP/3.
* image_load_optimization: Improve load time for pages that include images on mobile devices with slow network connections.
* image_size_optimization: Improve image load time by optimizing images hosted on your domain.
* ip_geolocation: Include the country code of the visitor location with all requests to your website.
* ipv6: Enable IPv6 support and gateway.
* max_upload: The amount of data visitors can upload to your website in a single request.
* min_tls_version: Only allow HTTPS connections from visitors that support the selected TLS protocol version or newer.
* minify: Reduce the file size of source code on your website.
* mobile_redirect: Redirect visitors that are using mobile devices to a mobile-optimized website.
* opportunistic_encryption: Opportunistic Encryption allows browsers to benefit from the improved performance of HTTP/2 by letting them know that your site is available over an encrypted connection.
* origin_error_page_pass_thru: When Origin Error Page is set to On, CIS will proxy the 502 and 504 error pages directly from the origin. (Enterprise plan only)
* prefetch_preload: CIS will prefetch any URLs included in the prefetch HTTP header (Enterprise plan only).
* pseudo_ipv4: Adds an IPv4 header to requests when a client is using IPv6, but the server only supports IPv4.
* response_buffering: Enable or disable buffering of responses from the origin server (Enterprise plan only).
* script_load_optimization: Improve the paint time for pages that include JavaScript.
* security_header: Enforce web security policy for your website.
* security_level: Choose the appropriate security profile for your website.
If you would like to send us feedback on the new experience, please use [this form](https://form.asana.com/?k=vvRdQAmGMFAeEGRryhTA2w&d=8612789739828).





 4 February 2022 

Fuzzy matching updates
: Interactions between the stemming and misspelling fuzzy matching features are not allowed. Improve fuzzy matching behavior by limiting the interactions between different fuzzy matching features. This change applies to the following languages: English, French, German, and Czech. For more information, see [How fuzzy matching works](https://cloud.ibm.com/docs/assistant?topic=assistant-entitiesentities-fuzzy-matching).





 13 January 2022 

New setting for options customer response type
: In actions, a new List options setting allows you to enable or disable the options customer response from appearing in a list. This can be useful to prevent a phone integration from reading a long list of options to the customer. As part of this change, all customer response types now have a Settings icon. Allow skipping has moved from Edit Response and is now found in the new settings.





 24 December 2021 

Apache Log4j security vulnerability updates
: Watson Assistant upgraded to using Log4j version 2.17.0, which addresses all of the Critical severity and High severity Log4j CVEs, specifically CVE-2021-45105, CVE-2021-45046, and CVE-2021-44228.





 10 December 2021 

Channel transfer in Phone integration
: The phone integration now supports the channel_transfer response type. For more information, see [Handling phone interactions](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-voice-actionsdialog-voice-actions-transfer-channel).





 3 December 2021 

Configure webhook timeout
: From the Pre-message webhook and Post-message webhook configuration pages, you can configure the webhook timeout length from a minimum of 1 second to a maximum of 30 seconds.