vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For a detailed configuration guide on VPN, refer to the links provided in [Working with VPN](https://cloud.ibm.com/docs/vsrx?topic=vsrx-working-with-vpnworking-with-vpn).





 Network address translation (NAT) 

With the vSRX gateway appliance, you can provision application and database servers without public network interfaces, and still allow your servers access to the internet using source NAT. For enhanced security, you can protect your servers behind the gateway device, using destination NAT.





 Enterprise-grade routing 

The vSRX empowers you with greater flexibility to build connectivity between multi-tiered applications running on different isolated networks. You can set up dynamic routing using BGP, which allows you to announce your own public IP space to the IBM Cloud routers. BGP also offers more flexibility for custom private network configurations, when you're using a mix of tunnels and [Direct Link solutions](https://test.cloud.ibm.com/docs/dl).





 Concepts about VLANs and the gateway appliance's role 

A VLAN (virtual local area network) is a mechanism that segregates a physical network into many virtual segments. For convenience, traffic from multiple selected VLANs can be delivered through a single network cable, using a process commonly called "trunking."

vSRX is managed in two different interfaces: The vSRX server(s) and the Gateway Appliance fixture. The gateway appliance provides an interface (GUI and API) for selecting the VLANs you want to associate with your vSRX. Associating a VLAN with a gateway appliance reroutes (or "trunks") that VLAN and all of its subnets to your vSRX, giving you control over filtering, forwarding, and protection. Servers in an associated VLAN can be reached from other VLANs only by going through your vSRX; it is not possible to circumvent the vSRX unless you bypass or disassociate the VLAN.

By default, a new gateway appliance is associated with two non-removable "transit" VLANs, one each for your public and private networks.
* Canada Anti-Spam Law (CASL)
* General Data Protection Regulation (GDPR)
* California Consumer Protection Act (CCPA)







 Why are my emails not being delivered? 



* Your email size might be higher than threshold restrictions. Failure notices often give more details about size restrictions.
* The recipient server might block your emails because of compliance and regulation reasons. For more information, see [Why are my emails flagged as spam?](https://cloud.ibm.com/docs/email-delivery?topic=email-delivery-email-delivery-faqwhy-emails-flagged-as-spam).







 Why do emails take a long time to deliver? 

Internet traffic congestion and SMTP server configuration issues can cause delivery delays. For more information, see [SendGrid - Troubleshooting Delays and Latency](https://docs.sendgrid.com/ui/account-and-settings/troubleshooting-delays-and-latency) or check with your email vendor.





 Why do recipients not see emails in the inbox, but I see that they show as delivered? 

The recipient might have filters set up that move emails into folders other than the inbox. For more information, see [SendGrid - Troubleshooting Email Messages Marked "Delivered", But Not Appearing in Inbox](https://support.sendgrid.com/hc/en-us/articles/4408443310619-Troubleshooting-Email-Messages-Marked-Delivered-But-Not-Appearing-in-Inbox).





 Does IBM Cloud® offer a smart host service? 

IBM Cloud® now offers an email delivery service that is powered by SendGrid that allows clients to use a smart host to relay your outbound mail services. This service has many other functions such as generating metrics, tracking email lists, tracking email activity, assisting with newsletters, and authenticating.





 Why do I need to warm up an IP address? 

Warming up an IP address gradually increases the volume of email that is sent from a dedicated IP address that follows a predetermined schedule. The gradual increase helps establish a good reputation with ISPs as a legitimate email sender.
In addition, it offers a common and unified solution to monitor these services in any IBM Cloud account. Services generate auditing events automatically in the IBM Cloud platform. These events comply with the Cloud Auditing Data Federation (CADF) standard. You can monitor the activity of your IBM Cloud account through these events. Furthermore, you can analyze the information provided in each event through continuous security audits; you can investigate abnormal activity and critical actions; and you can use them to comply with regulatory audit requirements in your organization and in the industry. IBM Cloud administrators can configure an IBM Cloud account to collect auditing events automatically for most enabled-services. However, some services might require an upgrade of the service plan, a configuration setting, or both, for you to be able to collect and analyze them due to the high volumes of data that they generate. [Learn more about enabling Activity Tracker events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-events-opt-in).

For information on the services sending events to Activity Tracker, see [IBM Cloud services that generate Activity Tracker events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-cloud_service).



 CADF standard 

The CADF standard defines a full event model that includes the information that is needed to certify, manage, and audit security of applications and services in cloud environments. The CADF event model includes the following components:



* Action: The action is the operation or activity that an initiator performs, attempts to perform, or is waiting to complete.
* Initiator: The initiator is the resource that makes an API call and generates a CADF event. The event that is triggered depends on the action that is requested by the API call.
* Observer: The observer is the resource that creates and stores a CADF record from information available in a CADF event
* Outcome: The outcome is the status of the action against the target.
* Target: The target is the resource against which the action is performed, attempted to perform, or is pending to complete.







 Selecting your IBM Cloud Activity Tracker offering
Secure Gateway Change Log 

Our regression tests only cover last 3 versions.

Please ensure your Secure Gateway Client does not fall more than 3 versions behind, or you might get unexpected behaviour.

If you are using DataPower as the Secure Gateway Client, please ensure it is a currently supported DataPower version as well.



 v1.8.9 

Published date: 2023-04-12



 Features 



* Upgrade Node.js to 16.19.1
* Resolve potential vulnerabilities
* Enhance logging related to gateway connection
* Fix error related to gateway connection in different region









 v1.8.8fp2 

Published date: 2022-11-02



 Features 



* Upgrade Node.js to 14.20.1
* Resolve potential vulnerabilities









 v1.8.8fp1 

Published date: 2022-07-27



 Features 



* Upgrade Node.js to 14.20.0
* Resolve potential vulnerabilities









 v1.8.8 

Published date: 2022-04-20



 Features 



* Upgrade Node.js to 14.19.1
* Resolve potential vulnerabilities
* Fix connection error in slow network









 v1.8.7fp2 

Published date: 2021-12-02



 Features 



* Upgrade Node.js to 12.22.7
* Resolve potential vulnerabilities









 v1.8.7fp1 

Published date: 2021-08-19



 Features 



* Upgrade Node.js to 12.22.2
* Resolve potential vulnerabilities









 v1.8.7 

Published date: 2021-04-14



 Features 



* Upgrade Node.js to 12.21.0
* Resolve potential vulnerabilities









 v1.8.6fp1 

Published date: 2020-11-18



 Fixes 



* Resolve unexpected error when there is network latency between SG client and SG server
* Resolve error when using RPM installer with upgrade operation
* Enhance the handling when both side close the connection in the same time









 v1.8.6 

Published date: 2020-09-22



 Fixes
Navigating to the web UI 

After you provision an instance of the IBM Cloud Security and Compliance Center Workload Protection service in the IBM Cloud, you can launch the IBM Cloud Security and Compliance Center Workload Protection web UI from the IBM Cloud Observability Security dashboard.



  Grant IAM policies to a user to view data 

Note: You must be an administrator of the IBM Cloud Security and Compliance Center Workload Protection service, an administrator of the IBM Cloud Security and Compliance Center Workload Protection instance, or have account IAM permissions to grant other users policies.

The following table lists the minimum policies that a user must have to be able to launch the IBM Cloud Security and Compliance Center Workload Protection web UI, and view data:



Table 1. IAM policies

 Service                                                         Role                   Permission granted                                                                              

 IBM Cloud Security and Compliance Center Workload Protection    Platform role: Viewer  Allows the user to view the list of service instances in the Observability Security dashboard.  
 IBM Cloud Security and Compliance Center Workload Protection    Service role: Writer   Allows the user to launch the Web UI and permissions to operate the service.                    



For more information on how to configure these policies for a user, see [Granting permissions to launch the monitoring UI or to make REST API calls](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-iam_grant).





  Launch the Secure web UI through the IBM Cloud UI 

You launch the Web UI within the context of an IBM Cloud Security and Compliance Center Workload Protection instance, from the IBM Cloud UI.

Complete the following steps to launch the web UI:



1.  Log in to your IBM Cloud account.

Click [IBM Cloud dashboard](https://cloud.ibm.com/login) to launch the IBM Cloud dashboard.

After you log in with your user ID and password, the IBM Cloud Dashboard opens.
2.  In the navigation menu, select Observability.
3.  Select Security.

The list of instances that are available on IBM Cloud is displayed.
4.  Select one instance. Then, click Open dashboard.

The Web UI opens.
[A visual representation of a process that includes continuous integration, deployment, and compliance](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/images/cd.svg)

Figure 3. Continuous integration, deployment, and compliance





 Staying compliant 

After you deploy resources that you know are compliant, you can ensure that you remain compliant in two ways. First, by validating your resource configurations with Security and Compliance Center. Security and Compliance Center regularly scans your configurations of the resources in your account to ensure that there hasn't been a drift in compliance.

Zoom

![A visual representation of the Security and Compliance Center dashboard](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/images/dashboard.svg)

Figure 4. Example Security and Compliance Center dashboard

Second, you can ensure that you're deploying your code through the DevSecOps. When you use the continous compliance toolchain, scans are reexecuted against your current production code artifacts. This continuous scanning helps to ensure that any code that is deployed in to production is checked for the latest known vulnerabilities allowing for regular revalidation of deployed code and remediation of any new issues discovered since the last scan.

Staying compliant and audit-ready is of the utmost importance. Security and Compliance Center allows you to define the controls you need to meet by using pre-defined or custom profiles, attach the profiles to a group of resources, or scope, and [perform regularly scheduled evaluations](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-scan-resources). As evaluations are completed, the results are displayed in a dashboard so you can get an overarching view of your current compliance posture against the controls that are important for your use case and download compliance reports.
Getting started with IBM Cloud for Education Virtual Course Credit 

IBM Cloud for Education Virtual Course Credit allows users to utilize lab hours from services supporting Course Credit transactions . Users can purchase IBM Cloud for Education Virtual Course Credit by selecting the IBM Course Credit Subscription Plan



  How to purchase Course Credits 

Credits can be purchased as via the IBM Cloud for Education Virtual Course Credit plan of the IBM Cloud for Education service on IBM Cloud. The plan offers tiered pricing based on the Amount of the credit purchased. The credits purchased are valid for a 1 year term.

To purchase credits:



1.  Go to the Cloud for Education service
2.  Select the IBM Cloud for Education Virtual Course Credit plan
3.  Provide a relevant service name. This will be used at a later stage to uniquely identify this instance of your credits when being applied against your lab.
4.  Enter the amount of credits to be purchased in the Virtual Course Credit Amount field. Make sure to take note of the pricing tiers when entering the amount to get the best value.







  How to activate Course Credits 

Once the IBM Cloud for Education Virtual Course Credit plan is purchased, follow the steps on the resource details page to activate your credit. Copy the token provided on the resource details page, go to Credit Manager, paste the token , hit the Activate button and you are all set!





  Next steps 

Redeem your credits against labs hours on supported services.
Update default rules and policies Update the default rules and policies as requirements change. Update custom policies and track changes by using your own change management process. 
 Update pre-defined alert definitions Update the default alert definitions as requirements change. Update custom alert definitions and track changes by using your own change management process. 
 Track versions of custom rules, policies, notifications, and teams Use your own change management process to control versions of monitoring resources such as rules, policies, teams, and notifications. 







 Identity and access management 

IBM is responsible for the security and compliance of IBM Cloud Security and Compliance Center Workload Protection. You are responsible for defining the IBM Cloud Identity and Access Management (IAM) policies to control which users within your account have access to the monitoring data.



Table 3. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 Manage platform permissions Allow administrators to control access to manage resources in the IBM Cloud. Grant, revoke, and manage access to service instances by using IAM. 
 Manage service permissions Allow administrators to control access to work with the IBM Cloud Security and Compliance Center Workload Protection. Grant, revoke, and manage access to monitoring features by using IAM. 
 Control data access Allow administrators to control access to data and metadata through Workload Protection teams. Grant, revoke, and manage access to data by using IAM and team definitions. 



[Learn more about controlling access through IAM](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-iam). [Learn more about controlling access using Workload Protection teams](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-iam_grant_team).





 Security and regulation compliance 

IBM is responsible for the security and compliance of IBM Cloud Security and Compliance Center Workload Protection. You are responsible for ensuring that regulated data is not provided to the IBM Cloud Security and Compliance Center Workload Protection service.



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Meet security and compliance objectives Maintain controls that are commensurate to supported industry compliance standards, such as SOC.
* Parameters: A collection of type SoftLayer_Container_Network_CdnMarketplace_Configuration_Input. You can view all of the attributes in the Input container here:

[Input container](https://cloud.ibm.com/docs/CDN?topic=CDN-input-container)

The following attributes are part of the Input container and are required when creating a new Hotlink Protection:



* uniqueId - Provide the unique ID of the mapping from which to remove the behavior.



* Returns - null



--------------------





 getHotlinkProtection 

Retrieves a mapping's current Hotlink Protection behavior.



* Parameters: * uniqueId - Provide the unique ID of the mapping to which the behavior belongs.
* Returns - An object of type SoftLayer_Network_CdnMarketplace_Configuration_Behavior_HotlinkProtection.

[Hotlink Protection class](https://cloud.ibm.com/docs/CDN?topic=CDN-hotlink-protection-class)



--------------------







 API for Token Authentication 



 createTokenAuth 

Creates a Token Authentication path for a domain mapping and returns the newly created behavior.



* Parameters: A collection of type SoftLayer_Container_Network_CdnMarketplace_Configuration_Behavior_TokenAuth. You can view all of the attributes in the Input container here:

[Token authentication input container](https://cloud.ibm.com/docs/CDN?topic=CDN-token-auth-container)

The following attributes are part of the Token Authentication container input, which can be provided when creating a new Token Authentication. Attributes are optional unless otherwise noted.



* uniqueId - (Required) The unique ID of the mapping to which the existing behavior belongs.
* path - (Required) The path, relative to the domain that is accessed through token authentication.
* name - The token name. If this value is empty, then it is set to the default value __token__.
Compliance (ibmcloud workload-protection compliance) CLI 

The IBM Cloud® Security and Compliance Center Workload Protection compliance CLI lets you determine the available frameworks, platforms, and scope options as well as create and manage benchmark and compliance tasks.

You can use wp, sysdig-secure, security-compliance-secure, or scs as aliases for the workload-protection commands. For example, you can run ibmcloud wp policy create ..., ibmcloud sysdig-secure policy create ..., ibmcloud security-compliance-secure policy create ..., or ibmcloud scs policy create ... for ibmcloud workload-protection policy create ....



 Concepts 

To use this CLI you will need to understand the following IBM Cloud Security and Compliance Center Workload Protection concepts. For more information on IBM Cloud Security and Compliance Center Workload Protection, see the [IBM Cloud Security and Compliance Center Workload Protection documentation.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started)



* Compliance frameworks provide guidelines and structures to maintain security and help meet regulatory requirements.
* Compliance platforms include the available platforms to be monitored including platforms such as Kubernetes, Docker, and so on.
* Scope options are the available scope labels and operators that can be used when creating a benchmark or compliance task.
* Tasks allow you to create benchmarks or compliance tasks.







 Command options 

The following are the available options for all ibmcloud workload-protection compliance commands.

--instance-id ID (required), exclusive with --instance-name
: The ID of the IBM Cloud Security and Compliance Center Workload Protection instance. The ID can be obtained by running the [ibmcloud resource service-instance command.](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_instance) One of --instance-id or --instance-name must be specified. The --instance-id and --instance-name options cannot be specified together on the same command invocation.
* Secure customer-managed ESG for outbound and inbound HTTPS workload traffic. The ESG is deployed by IBM as a template that can be modified by you to provide VPN access or public access. For NSX-V, one ESG is deployed. For NSX-T, two ESGs are deployed on the datastore with the highest IOPS.



For more information, see [Does the customer-managed NSX Edge pose a security risk?](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutionsfaq-customer-nsx)







 Virtual Server Instances 

The following virtual server instances (VSIs) are ordered:



* A VSI for IBM CloudDriver, which is deployed as needed for initial deployment and for Day 2 operations.
* Choose to deploy a single Microsoft® Windows® Server VSI for Microsoft Active Directory™ (AD) or two high availability Microsoft Windows VMs on the management cluster to help enhance security and robustness.







 Storage 

During initial deployment, you can choose between NFS and vSAN storage options.

After deployment, you can add NFS storage shares to an existing NFS or vSAN cluster. For more information, see [Adding NFS storage to vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingnfs).



 NFS storage 

The NFS option offers customized shared file-level storage for workloads with various options for size and performance:



* Size - 20 GB to 24 TB
* Performance - 0.25, 2, 4, or 10 IOPS/GB. The 10 IOPS/GB performance level is limited to a maximum capacity of 4 TB per file share.
* Individual configuration of file shares

(NSX-V only) If you choose the NFS option, one 2 TB and four IOPS/GB file share for management components are ordered.







 vSAN storage 

The vSAN option offers customized configurations, with various options for disk type, size, and quantity:



* Disk quantity - 2, 4, 6, 8, or 10
Without multizone-capable storage, if an entire zone goes down, any blockchain nodes in that zone cannot automatically come up in another zone because their associated persistent storage is unavailable in the failed zone. When multizone-capable storage is configured, if a zone failure occurs, peers and ordering nodes can come up in another zone, with their associated storage intact, ensuring high-availability. In order to leverage this capability with the IBM Blockchain Platform, you need to configure your cluster to use SDS (Portworx) storage. To learn more about multizone-capable storage, see the Comparison of persistent storage options for multizone clusters on [OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_planningpersistent_storage_overview) or [IBM Cloud Kubernetes service](https://cloud.ibm.com/docs/containers?topic=containers-storage_planningpersistent_storage_overview). When you deploy a peer, ordering service, or ordering node, select the advanced deployment option labeled Deployment zone selection and then select Across all zones.

This scenario uses redundant peers, ordering nodes, and CAs across multiple worker nodes and multiple zones, which protect against zone failure, but does not protect from an unlikely entire region failure.

If you choose to use a multi-zone configuration for CA, peers, or ordering nodes, then you are responsible for configuring the storage for each zone and set the node affinity to zones.







 Multi-region HA 

This scenario offers the highest level of HA possible.

Zoom

![Blockchain HA multi-region options](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/HA-Diagram3.png)

Figure 3. Blockchain HA multi-region options

Region failure.

Multi-region clusters with multiple work nodes and anti-affinity:

The likelihood of a full regional failure is low. However, to account for this failure, you can set up multiple clusters in different regions where each cluster has its own linked console.