vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Best practices for working with Security and Compliance Center 

As you start working with Security and Compliance Center, there are a few best practices that you can follow to have the best experience meeting your goal of continuous compliance and being audit ready.



 Providing the correct access to the correct people 

There are several people in your organization who might require varying levels of access to Security and Compliance Center or integrations. To ensure that you're following best practices, be sure that you create access groups and assign only the minimum required permissions for team members to perform their duties. To manage compliance for an individual account, a compliance focal needs access to the Security and Compliance Center service, Event Notifications, and Cloud Object Storage by using IAM access policies assign to the access group. To manage compliance for an enterprise, additional permissions are required. For more information, see [Assigning access](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-assign-roles).





 Managing profiles 

In Security and Compliance Center, a [profile](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-posture-management) is the collection of controls that you use to evaluate your compliance. When you work with Security and Compliance Center, you have the option to use a predefined profile or create a custom profile. There are pros and cons to both.



 Working with predefined profiles 

Predefined profiles are versioned and periodically updated with bug fixes, more checks, or changes to the compliance program. If you are monitoring compliance for a specific program, such as IBM Cloud for Financial Services, it is recommended that you work with a predefined profile. This way you can take advantages of new versions of the profile as they become available. [Learn more about versioning](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-predefined-profilesprofile-update-levels).

To avoid having to create and maintain a fully customized profile, you can customize a predefined profile by using [parameters](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-posture-management).
A unit that contains ordered transactions in a blockchain network. Blocks are immutable and contain the cryptographic hash of the previous block to create a chain of blocks. This iterative process confirms the integrity of the previous block, all the way back to the initial block. See also [genesis block](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx9076628).





 blocklist 

A list of items, such as usernames, email addresses, or IP addresses, that are denied access to a certain system or function. When a blocklist is used for access control, all entities are allowed access, except for those that are included in the blocklist. See also [allowlist](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx3954001).





 BLU Acceleration 

A collection of IBM Db2 technologies designed to work primarily with read-mostly business intelligence query processing. BLU Acceleration consists of four major database design advances: dynamic in-memory columnar processing, actionable compression, parallel vector processing, and data skipping.





 blue-green deployment 

A deployment technique that enables continuous delivery and minimizes downtime by running two nearly identical production environments called Blue and Green. While one of the environments (for example, Blue) is the live production environment, the other (for example, Green) can be used for final testing and deployment. After the application is deployed in Green, Green becomes the production environment and Blue becomes idle. See also [red-black deployment](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx8439181).





 boilerplate 

A template that includes one application and its associated runtime environment and predefined services for a particular domain.





 borderless 

Pertaining to an open, non-proprietary development platform that includes public cloud, dedicated cloud, and local cloud deployment models.
Storage 

IBM Cloud® for VMware® Regulated Workloads employs multiple storage types.



 Management cluster 

The management cluster storage is vSAN™. Security requirements mandate that multitenant shared storage is not permissible and in such cases the use of vSAN is necessary. vSAN requires deploying a minimum of four VMware ESXi™ hosts to the management cluster.





 Gateway cluster 

The gateway cluster uses only local data stores. Local data stores are suited to support the vSRX nodes since they do not require any vSphere DRS functions. The resiliency of the vSRX HA cluster is a function of the clustering mechanism that is used by the vSRX and is not reliant on the underlying hosts.





 Workload cluster 

The workload clusters require the use of vSAN. vSAN is the only storage option on IBM Cloud that keeps all workload data within the account and delivers resiliency to the applications deployed to the workload clusters. All workload clusters are formed by using a minimum of four ESXi hosts to meet vSAN requirements.





 Bare metal storage design 

Physical storage design consists of the configuration of the physical disks that are installed in the physical hosts and the configuration of the shared network-attached storage if applicable. It includes the operating system (vSphere ESXi) and the disks that are used for storage of the virtual machines (VMs). Storage for VMs consists of local disks that are virtualized by VMware® vSAN.

Zoom

![Storage options](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-v2-baremetal.svg)

Figure 1. Storage options



 Operating system disks 

The vSphere ESXi hypervisor is installed in a persistent location. The physical hosts' boot drive consists of a single M.2 solid-state drive.





 vSAN disks 

VMware vSAN is the required storage platform. vSAN uses an all–flash configuration.
repo_name optional, immutable String repo_name The name of the GitHub repo to create. This parameter is required when you create a repo, or clone or fork a repo. This value is computed when you link to an existing repo. 
 repo_url optional, immutable String repo_url The URL of the GitHub repo for this tool integration. This parameter is required when you link to an existing repo. This value is computed when you create a repo, or clone or fork a repo. 
 source_repo_url optional, immutable String source_repo_url The URL of the repo that you are forking or cloning. This parameter is required when you fork or clone a repo. It is not used when you create a repo or link to an existing repo. 
 token_url optional, updatable String token_url The token URL that is used to authorize with the GitHub server. 
 type required, immutable String type The operation to perform to initialize the new tool integration. Use new to create a Git repo, clone to clone an existing repo into a new Git repo, fork to fork an existing Git repo, or link to link to an existing Git repo. 







 Learn more about GitHub 

To learn more about GitHub, see the [GitHub article](https://www.ibm.com/garage/method/practices/culture/tool_github/) and the [GitHub and Issue Tracking: Social coding hosted by IBM article](https://www.ibm.com/garage/method/practices/code/tool_git_repos_and_issue_tracking) on the IBM Cloud Garage Method or take the [Ensure quality deployments by using the "Deployment Risk Analytics with GitHub and Jenkins" toolchain](https://www.ibm.com/cloud/architecture/tutorials/ensure-quality-deployment-risk-analytics-with-github-and-jenkins-toolchain) tutorial.
In network mode, the backup proxy uses VMware Virtual Disk Development Kit (VDDK) to communicate with the ESXi host, which produces extra load on the vSphere ESXi host.
* Backup from storage snapshots mode allows the backup proxy to access VM disks when they are on a supported storage system and the storage system is managed by Veeam Backup and Replication. This method is not available if the production environment is in IBM Cloud®.



For more information, see [Transport modes](https://helpcenter.veeam.com/docs/backup/vsphere/transport_modes.html?ver=120).

When you use a VM based backup proxy:



* If the production environment is not on IBM Cloud, then the most efficient transport mode depends on the storage architecture.
* If the production environment is on IBM Cloud and the vCenter Server instance is using NFS, then Direct NFS access mode is the most efficient.
* If the production environment is on IBM Cloud and the vCenter Server instance is using vSAN, then the Virtual appliance (HotAdd) is the most efficient.





 Backup proxy in the immutable backup solution architecture 

As the Veeam service deploys the Veeam simple deployment scenario, the backup proxy is deployed on the Veeam backup server alongside the other Veeam components. For the immutable backup solution architecture, the existing backup proxy is used. Depending on the scale of the production environment, you can deploy one or more backup proxies.





 Backup proxy in the isolated recovery environment solution architecture 

For the isolated recovery environment solution architecture, backup proxies that are registered with the isolated recovery environment Veeam backup server must be deployed on the production vSphere environment.





 Related links 



* [Backup proxy](https://helpcenter.veeam.com/docs/backup/vsphere/backup_proxy.html?ver=120)
* [Transport modes](https://helpcenter.veeam.com/docs/backup/vsphere/transport_modes.html?ver=120)
[COS on Satellite Architecture](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/satellite-arch.png)

Figure 1. Object Storage for Satellite Architecture



1. A Satellite administrator needs to configure a new "Location" using the Satellite console and assigns hosts for the Satellite Control Plane.
2. After the new location is created and accessible, an Object Storage administrator provisions the Object Storage instance in the new location.
3. The Satellite administrator assigns the appropriate hosts and block storage to the new Object Storage for Satellite cluster.
4. The new instance is available for both Object Storage bucket configuration and data operations.







 Connecting to Object Storage for Satellite 

In order to interact with object storage, a client makes API calls to a service endpoint. In a Satellite configuration, these should not be confused with [link endpoints](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) which are used for communication between services.

The service endpoint that is used for reading and writing data typically takes the form of https://s3.{cos-instance-uuid}.{location-id}.cloud-object-storage.appdomain.cloud and can be found under the Endpoints section of the object storage console.

Zoom

![COS on Satellite Endpoints](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/satellite_endpoints.png)

Figure 2. Object Storage for Satellite Endpoints

Keep in mind that requests made to Object Storage for Satellite infrastructure must originate within the satellite location as the service endpoint may not be accessible from the outside of that location.





 What features are currently supported?
Getting the most from Discovery 

Discovery was redesigned to introduce new features and a simpler way to build solutions.

The redesigned product is referred to as Discovery v2. When you create an instance on IBM Cloud or install and provision an instance on IBM Cloud Pak for Data, you get the new and improved version of Discovery.



 Advantages of using the latest version 

Discovery v2 offers the following features and enhancements:



* A project-based experience that supports many different use cases within a single environment.
* Built-in customization tools for adding dictionaries, patterns, and classifiers to help business users build projects that understand the language of their domain.
* Connectors to popular data sources that can quickly access valuable data where it resides.
* Smart Document Understanding that learns from the structure of human-readable documents, such as PDFs.
* Natural language query support across all document types, optimized with machine learning to find targeted answers.
* Advanced search capabilities, such as answer finding, curations, and table retrieval.
* An out-of-the-box contract understanding function that helps you search and interpret legal contracts.
* A full-featured Content Mining application that you can use to conduct in-depth analysis of unstructured text.
* Customizable user interface components that help you to deploy custom applications.



For more information, see [Migrating to Discovery v2](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-migrate-to-v2).





 Comparing v1 and v2 features 

If you are already familiar with Discovery v1, learn more about how Discovery v2 compares.

Discovery v2 has new features that were previously unavailable. The following table describes feature support in both versions.



Feature support details
This table has row and column headers. The row headers identify features. The column headers identify the different versions of the product. To understand which features are supported by a product version, go to the row that describes the feature, and find the column for the product version that you are interested in.

 Feature Product redesign (v2) Earlier version (v1) 

 Use projects to organize your work !
Applications that direct traffic to an access point instead of the geo endpoint must implement appropriate failover logic internally to achieve the availability advantages of the cross-region storage.

One reason for using an access point is to control where data ingress and egress occurs while still dispersing the data across the widest possible area. Imagine an application running in the us-south region that wants to store data in a US cross-region bucket but wants to ensure that all read and write requests remain in the Dallas area:



1. The application creates a client using the https://s3.private.dal.us.cloud-object-storage.appdomain.cloud endpoint.
2. The COS service in Dallas suffers an outage.
3. The application detects a persistent failure trying to use the access point.
4. The application recognizes the need to fail over to a different access point, such as San Jose.
5. The application creates a new client using the https://s3.private.sjc.us.cloud-object-storage.appdomain.cloud endpoint.
6. Connectivity is resumed, and access can be re-routed to Dallas when service is restored.



For contrast, imagine another application using the normal US cross-region endpoint:



1. The application creates a client using the https://s3.us.cloud-object-storage.appdomain.cloud endpoint.
2. The COS service in Dallas suffers an outage.
3. All COS requests are automatically rerouted to San Jose or Washington until service is restored.







 Network type 

Traffic directed to COS can come from one of three networks: Public, Private, or Direct. The network that is targeted is defined by the COS service endpoint used to access a bucket. While a bucket is created in a single location (be that Cross Region, Regional, or Single Site) it is still possible to access that same bucket via any of the three network types described.

Public traffic traverses the public Internet until it reaches the IBM Cloud and is routed to a load balancer that directs traffic into the COS distributed storage network.
Required for all CI, CD, and CC pipelines to persist new evidence into buckets.



When you use the Cloud Object Storage bucket as the evidence storage, the recommended permissions are Reader and Object writer. Permissions that have higher privileges might be harmful.





 Storage classes 

Costs vary for teams with different setups and deployment frequency. It is not recommended that you use the free tier as Cloud Object Storage buckets because the free tier cannot be configured to be immutable.



 Sample estimation 

If you are working with a reference continuous integration or continuous deployment pipeline with six evidence in each, a single continuous integration and continuous deployment run pair makes 37 class A requests and six class B requests.



* Continuous integration writes six logs, six artifacts, and six evidence, which equals 18 PUT - Class A.
* continuous deployment reads six evidence (six GET - Class B), writes six evidence, six logs, six artifacts, and a summary, which equals 19 PUT - Class A.



With an average of five microservices (five x continuous integration) and four deployment regions (four x continuous deployment), one full deployment equals 166 Class A and 24 Class B requests.

With one full deployment per week (four per every month), you can calculate 664 Class A and 96 Class B requests per month.

The data amount that is collected varies by use-case, but with average sizes for evidence (1 kB), test artifacts (100 kB), and logs (15 kB), you can calculate 0.01 GByte of data that is created and transferred per month.







 Resiliency 

It is recommended that you use Cross-Region or Regional resiliency, if it needs to be kept in-boundary. For more information about these regions, see [Endpoints and storage locations](https://cloud.ibm.com/docs/cloud-object-storage/basics?topic=cloud-object-storage-endpoints).





 Bucket name 

Cloud Object Storage bucket names must be globally unique and DNS-compliant. Names must be 3 - 63 characters in length and must contain lowercase letters, numbers, and dashes. Bucket names must begin and end with a lowercase letter or number. Names that resemble IP addresses are not allowed.
The process of starting and initializing a smart contract container on a channel with peers running Fabric v1.4.x and v1.4 capabilities. After a smart contract is installed on the peers and every peer has joined the channel, the smart contract must be instantiated on the channel. Instantiation performs any necessary initialization of the smart contract, which includes setting the key value pairs that comprise a smart contract's initial world state. After instantiation, peers that have the smart contract installed can interact with the data governed by the smart contract. Starting in Fabric v2.x, the instantiation process has been replaced with a [propose, approve, and commit model](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-smart-contracts-v2).





 Kafka 

A consensus plug-in implementation for Hyperledger Fabric that results in a cluster of ordering service nodes in the blockchain network. Kafka implementations and Raft implementations are intended for production networks. However, only Raft ordering service clusters are natively supported and can be created using the IBM Blockchain Platform.





 Ledger 

Comprised of a literal "chain of blocks" that store the immutable, sequenced record of transactions, as well as a state database to maintain current state. There is one ledger per channel, and updates to it are managed by the consensus process according to the policies of a particular channel.





 LevelDB 

A key-value store that can be used as an option for the state database for your peers. LevelDB stores the current state as key-value pairs, and does not support the use of indexes or rich queries.





 Lifecycle endorsement policy 

On a channel, the lifecycle endorsement policy specifies which organizations can approve a smart contract definition and how many of them are required to approve the definition or update. The default lifecycle endorsement policy requires a majority of all organizations on the channel to approve.





 Member 

Also known as "organizations", members in a blockchain network, similar to the members of any group, form the structure of the network. A member can be as large as a multi-national corporation or as small as an individual.
Select System Settings and verify that all network settings are correct and adjust the time zone to reflect the time zone of your environment.
4. Select Next > Save and Apply > Exit. You return to the Wizard Dashboard and are logged out of your current browser session.
5. Log back in to the AltaVault appliance and click Settings > Setup Wizard > Import Configuration and specify the location of the configuration file of the on-premises AltaVault appliance.
6. Select Import Shared Data Only, which imports only settings that are shared, such as cloud and email settings.
7. Enter the passphrase for the encryption key that is specified during the creation of the on-premises AltaVault appliance, if one was set, in the Key Passphrase text box.
8. Click Import Configuration > Exit.



You successfully imported the on-premises AltaVault appliance configuration to the IBM Cloud AltaVault appliance.

Use the following steps to modify the cloud settings of the {{site.data.keywrod.cloud_notm}} AltaVault appliance to give it access to the IBM Cloud Object Storage service through the private network.



1. In AltaVault, go to Storage > Cloud Settings > Cloud and modify the hostname to reflect the private address of the IBM Cloud Object Storage service.



* The private network name syntax is .objectstorage.service.networklayer.com, where designates the shortened data center name (example: mel01 for the Melbourne 01 data center).



2. Click Apply. The AltaVault appliance attempts to connect to the IBM Cloud Object Storage service. If this connection attempt fails, verify that the cloud provider settings are correct before you try to connect again.



After you connect to IBM Cloud Object Storage, the appliance needs to be placed in recovery mode to sync the metadata content of the original backup data from IBM Cloud Object Storage.

Use the following steps to place the AltaVault appliance in recovery mode.

The AltaVault appliance syncs data from IBM Cloud Object Storage. Note: The time it takes to complete the sync depends on the size and number of backups that are being restored.



1.
Contract term pricing for bare metal servers 

IBM Cloud® Bare Metal Servers gives you the option to lock-in a lower price by signing a contract term. You choose between either a 1-year or a 3-year contract. A contact term bare metal server is a great option if you know that you need hardware for the long term and makes sure that your resources are available throughout your term. When your term is over, you keep your contracted price on a month-to-month basis.



 Advantages 

Contract term pricing offers many conveniences, including the following advantages:



* Guaranteed availability

Your bare metal capacity is maintained in the data center and POD that you selected for the life of your contract term.
* Global availability

Your contract term bare metal servers are available globally.







 Limitations 

Consider the following limitations before you provision a contract term bare metal server:



* Your contract term bare metal server configuration can't be changed after your order is complete.
* Your contract term can't be canceled.
* Available on only Intel® dual processors from Skylake to the most recent and AMD EPYC™ offerings when you convert an existing server.
* Not available for enterprise-bundled solutions.







 Ordering a contract term bare metal server 

To order a bare metal server with a 1 or 3-year contract, click one of the following links and lock-in your lower price. For more information about ordering a bare metal server, see [Building a custom Bare Metal Server](https://cloud.ibm.com/docs/bare-metal?topic=bare-metal-ordering-baremetal-server).



* [1-year term](https://cloud.ibm.com/gen1/infrastructure/provision/bm?type=oneYearTerm)
* [3-year term](https://cloud.ibm.com/gen1/infrastructure/provision/bm?type=threeYearTerm)







 Converting to a contract term bare metal server 

Are you ready to take your eligible, existing monthly server and turn it into a 1 or 3-year bare metal server? Use the following steps to make the change.



1.