vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Evaluate and remediate 

Once you have reviewed the compliance findings for your environment, you need to evaluate those findings and take the appropriate actions either by resolving any violations or temporarily accepting them.



 Types of remediation 

The following types of remediation are supported:

Manual remediation
: The user is presented with text information on how to remediate the violation.

Automatic generation of a patch (with or without user input)
: Patch code is presented to the user, with input fields to be supplied if values are required. The user then needs to download the patch and add the patch to the application.

Risk is accepted
: The violation can be marked that the risk has been temporarily accepted.





 Source detection and patching 

IBM Cloud Security and Compliance Center Workload Protection attempts to identify the source file matching the violation in your integrated Git repositories. If there are multiple candidates, or if it is not possible to find the matching source file, you can search to find and select the relevant file from the connected Git repositories.

If remediation is possible using a patch, and Git integration is implemented, the Remediation page will be available. If multiple files match for the resource, all are displayed as "Suggested Sources". If no files are found, or if you want to remediate a different file, click Search Source and and select the file from the list. Files in connected Git repos will be included in the list.





 Reviewing issues 

When you click a zone or policy on the [Compliance page](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-compliance-understading) more information on the violations are displayed. By clicking a violation on the [control pane](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-compliance-cp) the issues comprising the violation are displayed. By clicking an issue the resources that are passing, failing, or have temporary accepted exceptions are displayed.

By clicking an issue the available remediation options are displayed.

You can see the impact of the remediation, review the resource attributes, and, if needed, enter required values into the patch code.
IBM Db2 is a mature database solution for SAP applications with many advantages, including: reduced total cost of ownership, excellent performance, and simplified administration. Over the past four decades, most of the benchmark tests by IBM Systems used IBM Db2, and we continue this tradition.





 Can I split my distributed SAP environment between different data centers? 

For a distributed SAP installation, it is best to have all nodes in the same location (for example, Availability Zone or Datacenter) and networking constructs (for example, Subnet and VPC/Subnet and VLAN). Deviation from this setup can cause latency and timeouts, which render your SAP system unresponsive.





 Can I split my distributed SAP environment between IBM Cloud® Bare Metal and IBM Cloud® Virtual Servers? 

RDBMs on Intel Bare Metal Servers in the older IBM Cloud Classic Infrastructure environment that comply to [SAP Note 2414097](https://launchpad.support.sap.com//notes/2414097), are supported when connected to the SAP AS on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment - when placed in the same location (i.e. Datacenter / Availability Zone) and using an IBM Cloud Transit Gateway local routing.





 Can I achieve SAP high availability as defined by SAP architecture? 

High availability for SAP can be achieved for:



* SAP NetWeaver High Availability
* SAP HANA High Availability
* SAP AnyDB High Availability (for example, IBM Db2, MS SQL etc.)



You can set up high availability at either the:



* SAP Technical Application layer (for example, system replication, system clustering)
* Hardware layer (for example, storage replication)



How you set up high availability differs depending on the infrastructure types and network types:



* For Intel Bare Metal that uses Classic Infrastructure network
* For Intel Virtual Servers that use VPC Infrastructure network (does not currently support SAP NetWeaver high availability or SAP HANA high availability)
* For IBM Power Virtual Servers, on IBM Cloud that use IBM Power Virtual Server Group network
* For VMware that uses Classic Infrastructure network



See the respective topics in the Get Started section for:
The testing of latency by using the Round Trip Time (RTT) metric is necessary when designing High Availability (HA) and Disaster Recovery (DR) for SAP HANA.

If a HA failover is being designed within one site location, in almost all cases this will be achievable for SAP HANA System Replication requirements.

However, if designing High Availability for SAP HANA across multiple sites within a Region, or if designing Disaster Recovery across multiple Regions then the latency that uses the Round Trip Time (RTT) metric must be carefully tested and considered.

This is because IBM Cloud seeks to ensure high availability of the platform, by using geographically dispersed site locations with fault tolerance (for example, different risk assessments). More information available on [How IBM Cloud ensures high availability and disaster recovery](https://cloud.ibm.com/docs/overview?topic=overview-zero-downtime).

In particular, for VPC Infrastructure the Availability Zones are geographically dispersed locations within the Region. For most workloads, this design provides more redundancy across the Region. However, SAP HANA System Replication requires low network latency, which can become difficult to meet the necessary Round Trip Time (RTT) metric due to current technology physical data transfer limitations of cabling from a physics perspective (that is, speed of light over fiber Optic cable).





 Networking Ports security considerations 

The following information is a brief summary of [SAP Help Portal - TCP/IP Ports of All SAP Products](https://help.sap.com/viewer/ports), which provides an example of the considerations that are required for the security of your SAP Systems and entire IT infrastructure landscape on IBM Cloud.

Depending on the SAP Technical Applications used and the business scenarios being addressed, different hosts will need ports to be opened. Typically, to meet this requirement, the Firewall Port Groups are combined with Firewall Rules. You can also use individual Firewall Rules per host, although is often becomes unmanageable.

The below table includes some of the key Ports to use with SAP Systems that use SAP NetWeaver and SAP HANA, which need correction, depending on the SAP Technical Application’s instance number; the instance numbers 00, 01, 02 are the defaults across the various SAP Technical Applications and will be in different patterns (these patterns are shown with code blocks highlighting):
The VMware Update Manager (VUM) log files are at /var/log/vmware/vmware-updatemgr/vum-server/vmware-vum-server-log4cpp.log.







 Manually initiating a scan of virtual machines and virtual appliances 

You can scan VMs and virtual appliances in the vSphere inventory against attached baselines and baseline groups. The VMs and appliances that you select are scanned against the attached baselines, depending on the options that you select. All child objects are scanned, so the larger the virtual infrastructure and the higher up in the object hierarchy that you initiate the scan, the longer the scan takes and the more accurate the compliance view is.



1. Using the vSphere Web Client, select Home > VMs and Templates.
2. Right-click a virtual machine, virtual appliance, or a folder of virtual machines and appliances and click Scan for Updates.
3. Select the types of updates to scan for. The options are Virtual Appliance upgrades, VM Hardware upgrades, and VMware Tools upgrades.
4. Click Scan.







 Manually initiating a scan of a container object 

Start a simultaneous scan of hosts, VMs, and virtual appliances, by scanning a container object that is a data center or a data center folder.



1. Using the vSphere Web Client, select Home > VMs and Templates.
2. Right-click a datacenter or datacenter folder and click Scan for Updates.
3. Select the types of updates to scan for. The options are Virtual Appliance upgrades, VM Hardware upgrades, and VMware Tools upgrades.
4. Click Scan.







 Scheduling a scan 

You can configure the vSphere Web Client to scan VMs, virtual appliances, and vSphere ESXi hosts at specific times or at intervals that are convenient for you.



1. Using the vSphere Web Client, select an object from the inventory. All child objects of the object that you select are also scanned.
2. Select the Monitor tab and click Task & Events.
3. Select Scheduled Tasks and click Schedule a New Task.
The source IP address of the packet is changed to the IP address of the worker node where the Ingress controller pod runs. If multiple app instances are deployed in the cluster, the Ingress controller load balances the requests between the app pods across all zones.
6. When the app returns a response packet, it uses the IP address of the worker node where the Ingress controller that forwarded the client request exists. The Ingress controller then sends the response packet through the VPC load balancer to the client.









 How can I customize routing? 

If you want to customize routing rules for your app, you can use [route-specific HAProxy annotations](https://docs.openshift.com/container-platform/4.11/networking/routes/route-configuration.htmlnw-route-specific-annotations_route-configuration) that manages traffic for your app.

These supported annotations are in the format haproxy.router.openshift.io/<annotation> or router.openshift.io/<annotation>.

IBM Cloud Kubernetes Service annotations (ingress.bluemix.net/<annotation>) and NGINX annotations (nginx.ingress.kubernetes.io/<annotation>) are not supported for the Ingress controller, or the Route resource in Red Hat OpenShift version 4.

To get started, see [Customizing Ingress routing with annotations](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-roks4).





 How can I enable TLS certificates? 

To load balance incoming HTTPS connections to your subdomain, you can configure the Ingress controller to decrypt the network traffic and forward the decrypted request to the apps that are exposed in your cluster.

When you configure the public Ingress controller, you choose the domain that your apps are accessible through.
* Are multiple users or applications encountering the same type of problem?
* Can the problem be re-created by running a single command, a set of commands, or a particular application?









 Cannot access the application 

Find out how to grant users access to Knowledge Studio, and address common access issues.



 Administrator 

Each Knowledge Studio instance has an administrator role associated with it. The person who originally signs up to use the application is given the administrator role automatically. The administrator can invite other people.

For information about how to invite people to use your instance of the application, see [Assembling the team](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-team).





 Human annotator 

If you have been invited to someone's instance of Knowledge Studio to serve as a human annotator, you likely received an email invitation. First, you must register with IBM if you do not have IBM registration credentials already. Once you register with IBM and accept the invitation, you are given access to the instance. However, after you are given access and before you can start to annotate documents, the administrator or a project manager of the instance must add you to a workspace and assign an annotation task to you. It is not until after you have been assigned a task that you can perform any actions in the Knowledge Studio instance. To annotate documents, use the ground truth editor. Use a Google Chrome browser for the best performance.

For help using the ground truth editor, see [Annotating documents](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-user-guide).







 Experimental services and features: What does experimental mean? 

IBM releases experimental services and features for you to try out. These services might be unstable, change frequently in ways that are not compatible with earlier versions, and might be discontinued with short notice. These services and features are not recommended for use in production environments.

For more information about experimental services, see the [IBM Cloud documentation !
Database details and connection credentials 

To configure your local development environment and to connect applications and tools to your Db2 on Cloud database, you need to know the database details and connection credentials.



 Database details 

There are important database details that are needed for connecting applications and tools to your database:



* Host name - The host name of the server.
* Port number - Used by the database manager for TCP/IP communication. (Note that your service is provisioned with connections that use Secure Socket Layer (SSL).)

If needed, you can get the IP address of your server by using the ping command or the nslookup command, specifying your host name.
* Database name - The Db2 database name, usually BLUDB.







 Connection credentials 

There are three types of credentials:



* IBMid - If you use IBM Cloud, this is the ID that you would use to log in to IBM Cloud. Only the IBMID can be used to manage users by accessing User Management in the web console. This is not what you use to connect applications or tools to your Db2 on Cloud database.
* Db2 database credentials - These credentials are generated when you create New credential under Service credentials for the service in IBM Cloud.
* IBMid-created users - These IBMid-created user IDs and passwords can be used to log directly into the web console URL and to connect to the Db2 database from applications or tools.







 Where to find database details and connection credentials 

You can collect this information from the following places:



* The Service Owner - If you are not the owner of your Db2 instance, you can get your database details and connect credentials from the owner.
* Db2 web console - Database details and credentials are available in the web console.
* If you are using IBM Cloud:



* IBM Cloud Dashboard - When you view your service on your IBM Cloud dashboard, you can view the database details, the database user ID, and password. To retrieve your service credentials, select the Service credentials tab from your service page, click the New credential button, then select View credentials.
* VCAP_SERVICES - VCAP_SERVICES is an environment variable in IBM Cloud that contains database details and credentials in JSON format.
* Your user is not authorized to access the specified target of the flow log collector.
* Your IBM Cloud® Object Storage bucket is missing the Identity Authorization Management (IAM) authorization to allow the flow logs service to write flow logs to your bucket.



* Can I create multiple flow log collectors?

You can create multiple flow log collectors on the condition that they are on different targets. Keep in mind that flow log collectors with different target scopes might overlap. You cannot create multiple flow log collectors on one single target.
* Can I modify the IBM Cloud Object Storage location for a flow log collector?

You cannot change the Object Storage bucket location for an existing flow log collector. You can delete the existing collector and create a new one with the Object Storage bucket location that you want to use.
* Are virtual appliances (IKS workers, ROKS, LBaaS, VPN gateway) included in the flow log collector data output?

Flow Logs for VPC supports:



* IBM Cloud Kubernetes Service (IKS) workers
* RedHat OpenShift Kubernetes Service (ROKS)
* Load Balancer as a Service (LBaaS)



VPN gateway is also available at a VPC and subnet level.

At this time, flow log collection does not include support for bare metal server network interfaces and endpoint gateways.
* Is there a viewer or filter for flow logs?

Flow Logs for VPC does not have a native viewer or filter. However, SQL Query is a viable option.
* Can I modify the target scope for a flow log collector?

You cannot change the target scope for an existing flow log collector. You can delete the existing collector and create a new one with the target scope that you want to use.
* Do I need to suspend a flow log collector before I delete it?

No, you can delete a flow log collector at any time, whether it is active or not.
* What is the instance metadata service?

The instance metadata service is free service that provides a REST API you invoke within an instance to get information about that instance. Access to the API is unavailable from outside the instance.
* Application partition: This is where cryptographic operations are performed by user applications. While it is only possible to have only one administrative partition in a given HSM, it is possible to have multiple application partitions to address multi-tenancy configurations. This is achieved by partitioning the key storage space into multiple application partitions, with the ability to set the size of each partition. A user of a tenant has no way to see the other application partitions. Each application partition is also encrypted using partition-specific encryption keys.



The A750 appliance supports by default the creation of up to five application partitions, and therefore the management of up to five different tenants. This can be increased for the A750 model up to 20 partitions by purchasing additional partition licenses.







 Configuring your HSM to produce the keys Key Protect needs 

For Key Protect to work with an HSM, several different keys must be created on the HSM and stored as persistent token objects in the partition memory. Each of these keys must be given a label, and these labels must be provided when deploying Key Protect on Satellite. These keys are:



 Key type Key role 

 Master Key Encryption Key (MKEK) (256bit AES key) A root level encryption key for wrapping and unwrapping instance keys in Key Protect. 
 Signing key (SKEY) (256bitsAES key) Used for signing and verification of instance and user keys in Key Protect. 
 Import Key (IKEY) (192bit DES3 key) Used to encrypt and unwrap the user's key materials be imported into Key Protect. 
 Transit Key Encryption Keys (TKEKs) 10 pairs of RSA asymmetric key pairs, which are used to securely Bring Your Own Keys (BYOK) into Key Protect. 



The specific parameters that must be set to produce the correct keys can be acquired by opening an IBM Cloud service ticket indicating your desire to purchase Key Protect on Satellite. A Key Protect representative will contact you and initiate the process for you to acquire the necessary configuration information.

Many different tools can be used to create these keys. Consult with Thales technical support to find a secure way to create these keys based on your organization's security policy and compliance requirements.
[Shows that PP3.docx is the document title and the main text panel shows the body field.](https://cloud.ibm.com/docs-content/v1/content/f16b1f78a92498247223b337bd9303c2758b9ba8/discovery-data/images/ee-title-body.png)

Figure 2. Label documents page
7. Click Create.



A document from the collection that you selected is displayed in the Label documents view. You will label occurrences of the entity types that you want Discovery to recognize from this and other documents in the collection.

If no text is displayed in the body of the page, start over now by creating a new entity extractor. This time, when you select a value for the Document body field, be sure to choose a field from your processed documents that contains text.





 Defining entity types 

Define entity types by completing the following steps:



1. Click Add an entity type.
2. Add the entity type name and an optional description.

Use a naming convention that works for your data. The built-in Entities enrichment uses initial capitals and no spaces, for example EmailAddress. To distinguish your entities from entities that are extracted by other enrichments, you might want to use a different convention.
3. Optional: Pick the color to use for highlighting text in the document that you want to label as an example of this entity type.

You can click a color from the Label color palette, click the Renew color icon to tab from one color to the next. To use a custom color, specify its hexadecimal color code (#fff0f7).
4. Click Create.
5. Repeat this process to add all of the entity types that you want the extractor to recognize.

If you aren't sure what to add for entity types, it might help to review the documents in the collection first. By reviewing the content, you can get a feel for which terms have significant meaning and look for logical ways to group such terms.







 Label significant terms
* once a day: runs every day between the hours of 00:00 and 06:00
* once a week: runs every week on Sunday between hours of 00:00 and 06:00
* once a month: runs every month on the first day of the month between the hours of 00:00 and 06:00



Example crawl status:

"crawl_status" : {
"source_crawl" : {
"status" : "completed",
"next_crawl" : "2019-02-10T05:00:00-05:00"
}
5. Click Save & Sync objects to start crawling your data source. You are then redirected to the collection status page, which updates as documents are added to the collection.



After the initial sync, all subsequent crawls run on the frequency that you specified. For information about managing a collection, see [Manage collections](https://cloud.ibm.com/docs/discovery?topic=discovery-sourcesmanage-collections).

In the tooling, the default time zone of the crawl schedule is set to America/New_York. Therefore, Discovery recrawls your collection at the interval that you specified for that time zone.

If you modify anything in the Sync settings screen and then click Save and Sync objects, a crawl starts at that time or restarts if one is already running.

When you connect to a data source, you can see document level errors under Errors and warnings on your collection page. There is a delay in publishing the errors and warnings that are related to a crawl.





 Creating a collection using the API 

Use the following process to create a collection connected to a data source, using the API.

When you create a collection by using the API, the default time setting for crawling and recrawling is set to UTC.

If you plan to connect to an on-premises data source, first, you must install IBM® Secure Gateway for IBM Cloud®. For more information, see [Installing IBM Secure Gateway for on-premises data](https://cloud.ibm.com/docs/discovery?topic=discovery-sourcesgateway).

The following example uses the SharePoint data source.



1.