vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* For more information see [What's new in MQ 9.2.1](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.2.0/com.ibm.mq.pro.doc/q134930_.html)









 9.2.0 r1 



 Available from 25th July 2020 



* Updated to MQ version 9.2.0
* For more information see [What's new in MQ 9.2.0](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.2.0/com.ibm.mq.pro.doc/q134120_.html)









 9.1.5 r2 



 Available from 9th June 2020 



* Required security and vulnerability fixes









 9.1.5 r1 



 Available from 2nd April 2020 



* Updated to MQ version 9.1.5
* For more information see [What's new in MQ 9.1.5](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.pro.doc/q128110_.htm)









 9.1.4 r3 



 Available from 6th February 2020 



* Improved REST messaging performance
* Protection against published security vulnerabilities









 9.1.4 r1 



 Available from 5th December 2019 



* Updated to MQ version 9.1.4
* For more information see [What's new in MQ 9.1.4](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.pro.doc/q133200_.htm)









 9.1.3 r5 



 Available from 26th November 2019 



* Fix for an issue experienced by some customers when upgrading older queue managers









 9.1.3 r4 



 Available from 22nd November 2019 



* Fix for users experiencing unexpected unauthorised errors when using the messaging REST API









 9.1.3 r3 



 Available from 4th November 2019
Adding a predefined security group during ordering 

This step-by-step procedure shows you how to add existing or predefined IBM Cloud® security groups to instances during the ordering process.

You can use security groups to enact a set of IP filter rules that define how to handle incoming and outgoing traffic to both the public and private interfaces of a virtual server instance.

Zoom

![Custom security group](https://cloud.ibm.com/docs-content/v1/content/f3a430977b1e79176682f947de41fc02945c41e7/security-groups/images/goal2.png)

Figure 1. Custom security group



 What you'll need 

For this example the following objects and items are used:



What you'll need

 Resource Name Operating System Type Location/DC IP/Subnet 

 allow_ssh1 Not Applicable Security Group Not Applicable/Any 0.0.0.0/0 
 jpmongevsi2.testing.com Ubuntu 16.04 Virtual server instance Dallas 10 Pod 01 10.0.0.21 
 jpmongevsi4.testing.com Ubuntu 16.04 Virtual server instance Dallas 10 Pod 01 10.0.2.219 







 Ordering a security group 

To order a virtual server instance and assign a security group, follow these steps:



1. From your browser, open the [IBM Cloud Catalog](https://cloud.ibm.com/catalog) and log in to your account.
2. Select Compute on the left side of the page, then click on the Virtual Server tile to get to the Virtual Server page.
3. Configure your virtual server based on your requirements.

For complete information on provisioning a virtual server instance, refer to the [Virtual Server Instance documentation](https://cloud.ibm.com/docs/virtual-servers).
4. From the Network Interface section, use the menus to select any predefined private or public security groups for your virtual server instance.

Only predefined security groups display in these menu lists.
Alternatively, you can use [IBM Cloud VPC APIDOCS](https://cloud.ibm.com/apidocs/vpccreate-security-group) to create a security group.

To create a security group using the UI:



1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login) and log in to your account.
2. Select the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) from the upper left, then click VPC Infrastructure > Security Groups in the Network section.
3. Click Create.
4. Provide a unique name for your security group.
5. Select the VPC for your security group. The security group must be created in the same VPC as the load balancer.
6. Click Add to configure inbound and outbound rules that define what type of traffic is allowed to and from the security group. For each rule, complete the following information:



* Specify a CIDR block or IP address for the permitted traffic. Alternatively, you can specify a security group in the same VPC to allow traffic to or from all sources that are attached to the selected security group.
* Select the protocols and ports to which the rule applies. For best practices about network rules, see [Network traffic rules](https://cloud.ibm.com/docs/vpc?topic=vpc-alb-integration-with-security-groupsalb-traffic).



Tips:



* All rules are evaluated, regardless of the order in which they're added.
* Rules are stateful, which means that return traffic in response to allowed traffic is automatically permitted. For example, if you create a rule that allows inbound TCP traffic on port 80, that rule also allows replying outbound TCP traffic on port 80 back to the originating host, without the need for another rule.



7. Optional: Edit the interfaces if you're planning to apply this security group to your other instances.
Identity and access management includes tasks such as authentication, authorization, access control policies, as well as approving, granting, and revoking access.



Table 4. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 IBM Cloud IAM IBM provides the function to restrict access to resources through the IBM Cloud console and REST APIs. The Customer is responsible for managing access to resources through IBM Cloud Identity and Access Management (IAM). 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security control implementation and compliance certification.



Table 5. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Compliance IBM maintains controls commensurate to current industry compliance standards. IBM also maintains General Data Protection Regulation (GDPR) readiness for customer compliance. See [Understanding IBM Cloud compliance](https://cloud.ibm.com/docs/overview?topic=overview-compliance) for details. The Customer is responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. 
 Security features IBM enables security features, such as encrypted disks. The Customer uses the provided security features, such as restricting user access to the appropriate resources and resource groups. 
 Vulnerabilities IBM continuously monitors stock images to detect vulnerability and security compliance issues. The Customer is responsible for their education on possible vulnerabilities and security issues through security bulletins that describe actions to remediate any vulnerabilities. A Customer can use the [IBM Cloud status](https://cloud.ibm.com/docs/get-support?topic=get-support-viewing-cloud-status) website to find announcements and security bulletin notifications about key events that affect the IBM Cloud platform, infrastructure, and major services. 
 Audit records IBM provides audit records of the VPC resource lifecycle through IBM Cloud Activity Tracker. The Customer uses IBM Cloud Activity Tracker tooling to monitor audit records. 
 Security groups and ACLs IBM provides the ability to restrict access to virtual server instances by using security groups and networks ACLs. The Customer uses security groups and network ACLs to secure their virtual server instances, such as restricting what IP addresses can SSH into the instance. 
 Public Network Access IBM provides options to use a public gateway or floating IP addresses.
Policy (ibmcloud workload-protection policy & policies) CLIs 

The IBM Cloud® Security and Compliance Center Workload Protection policy CLI lets you create and manage compliance policies.

You can use wp, sysdig-secure, security-compliance-secure, or scs as aliases for the workload-protection commands. For example, you can run ibmcloud wp policy create ..., ibmcloud sysdig-secure policy create ..., ibmcloud security-compliance-secure policy create ..., or ibmcloud scs policy create ... for ibmcloud workload-protection policy create ....



 Concepts 

To use this CLI you will need to understand the following IBM Cloud Security and Compliance Center Workload Protection concepts. For more information on IBM Cloud Security and Compliance Center Workload Protection, see the [IBM Cloud Security and Compliance Center Workload Protection documentation.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started)



* You can configure a policy on a resource and define what to do when 1 or more rules that are included in the policy are non-compliant.
* IBM Cloud Security and Compliance Center Workload Protection includes a number of pre-defined policies that you can use.
* The policy CLI lets you manage and create policies. The policies CLI list information about policies configured in the service instance.







 Command options 

The following are the available options for all ibmcloud workload-protection policy and ibmcloud workload-protection policies commands.

--instance-id ID (required), exclusive with --instance-name
: The ID of the IBM Cloud Security and Compliance Center Workload Protection instance. The ID can be obtained by running the [ibmcloud resource service-instance command.](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_instance) One of --instance-id or --instance-name must be specified. The --instance-id and --instance-name options cannot be specified together on the same command invocation.
About IBM Cloud Security and Compliance 

In IBM Cloud, IBM Cloud® Security and Compliance Center is a unified and centralized framework to manage the security and compliance of applications, workloads and infrastructure in IBM Cloud, in other clouds, and on-prem. It includes a workload protection platform (WPP) that focuses on management and security controls for workloads. It also includes a compliance platform (CP) that focuses on management and compliance controls that are required to meet industry standards and laws. Both platforms offer alerting on violations, and assist with remediation tasks.

Cloud Security defines the collection of policies and controls, practices, and technologies that are designed to address unauthorized access, online attacks, and threats. For more information, see [An overview of cloud security](https://www.ibm.com/topics/cloud-security).

Cloud Compliance defines the collection of policies and controls, practices, and technologies that are designed to address industry regulatory standards, and national and international laws.

Across all industries, in particluar highly regulated industries such as financial services, achieving continuous security and compliance within a cloud environment is an important step toward protecting resources, data and workloads. By default, IBM Cloud follows best practices for security and compliance, and takes active steps to protect the integrity of their servers and services. But what else can you do to protect your infrastructure and your workloads?

You can use the IBM Cloud Security and Compliance Center Workload Protection service to protect and gain visibility of resources, data, applications, and workloads across multiple environments. You can manage workloads and resources that run on IBM Cloud, on other clouds, and on-prem. You can use this service to secure your builds, detect and respond to runtime threats, and continuously manage cloud configurations, permissions, and compliance.

The IBM Cloud Security and Compliance Center Workload Protection service is a cloud workload protection tool (CWPT) that helps you monitor and protect your organization. Includes Cloud security posture management (CSPM), Kubernetes Security Posture Management (KSPM) and more. Use cloud security posture management features to secure the infrastructure where workloads are deployed.
Requests from sources that are connected to the IBM Cloud private network are made to the Satellite Link tunnel server host name and this port, such as c-01.us-east.link.satellite.cloud.ibm.com:30819. This Link host name and port are mapped to the destination resource's domain and port.
2. The Satellite Link tunnel server resolves the request to the Satellite Link connector host name and endpoint port, and forwards the request to the Satellite Link connector over a secured TLS connection.
3. The Satellite Link connector resolves the request to the destination's IP address and port, and forwards the request to the destination resource.



What happens if Satellite Link becomes unavailable?
: Your on-location workloads continue to run independently even if the location's connectivity to IBM Cloud is unavailable. However, if any applications use a Link endpoint to communicate with IBM Cloud, communication between those apps and IBM Cloud is disrupted. Additionally, any requested changes to your Satellite location, such as adding hosts or access control requests to IBM services through Cloud Identity and Access Management, are disrupted. After connectivity is restored, logs and events are sent to your [IBM Log Analysis and IBM Cloud Activity Tracker instances](https://cloud.ibm.com/docs/satellite?topic=satellite-health). Note that Satellite Link depends on the underlying connectivity of your hosts' local network to monitor and maintain the managed services for your Satellite location.







 External network requirements and security 

Your Satellite location infrastructure is a part of your local network (on-prem hosts) or the network of another cloud provider, but is managed remotely via secure access from IBM Cloud. Review the following frequently asked questions about Satellite Link network security. For more information about all security options for IBM Cloud Satellite, see [Security and compliance for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-compliance).



 Do I need to allow any unique inbound traffic from internet-facing ports through firewalls to my location? 

No. Satellite Link uses standard web security ports to originate encrypted communication from your location to IBM Cloud for location management.
* [Viewing IBM Cloud Kubernetes Service created priority level configurations](https://cloud.ibm.com/docs/containers?topic=containers-kubeapi-prioritykube-api-prioritylevelconfig)





[Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admissionpod-security-admission)



* [Understanding security profiles](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admissionpod_security_profiles)
* [What if Pod Security Admission isn't the right choice for me?](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admissionwhat-if-psa)
* [Configuring Pod Security admission namespace labels](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admissionpsa-namespace-labels)
* [Default Pod Security Admission plug-in configuration](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admissionpsa-plugin-config-default)
* [Customizing the Pod Security Admission plug-in configuration](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admissionpsa-plugin-config-custom)



[Migrating from PSPs to Pod Security Admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migrationpod-security-admission-migration)



* [Upgrade requirements](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migrationpsa-upgrade-reqs)



* [Step 1: Check that all pods run under the ibm-privileged-psp PSP](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migrationpsa-migration-pod-check)
Subnets 10.0.0.0/24 and 10.0.2.0/24 belong to the same CPA private network, which would be the equivalent of having a regular account with two or more virtual server instances connected to the same private subnet/VLAN.





 What you'll accomplish 

In this tutorial, learn how to...



 Task Description 

 [Create a security group](https://cloud.ibm.com/docs/security-groups?topic=security-groups-creating-a-security-group) Create and configure a custom security group, as opposed to using one predefined by the IBM Cloud platform. 
 [Create a rule](https://cloud.ibm.com/docs/security-groups?topic=security-groups-creating-a-new-rule) Create a rule to allow incoming requests (SSH & ICMP) and their related (outgoing) traffic flows. 
 [Assign instances to the security group](https://cloud.ibm.com/docs/security-groups?topic=security-groups-assigning-instances-to-the-security-group) Assign security group objects to instances using either the Security menu or the Device menu. 
 [Edit a security group and its rules](https://cloud.ibm.com/docs/security-groups?topic=security-groups-editing-a-security-group) Modify the parameters of the security object and its rules.
Product guide 

 Content Delivery Network (CDN) 

--------------------



* Get started



* [Getting started with Content Delivery Network (CDN)](https://cloud.ibm.com/docs/CDN?topic=CDN-getting-started)
* [About Content Delivery Networks](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-)
* [About HTTPS](https://cloud.ibm.com/docs/CDN?topic=CDN-about-https)
* [Video - What is a Content Delivery Network?](https://cloud.ibm.com/docs/CDN?topic=CDN-content-delivery-network-video)
* [Video - Setting up a web app with security groups, load balancer & CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-set-up-web-app-video)
* [Release notes for CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-release-notes)



* Tutorials



* Classic infrastructure



* [Accelerate delivery of static files using a CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-static-files-cdn)
* [Accelerate a dynamic website using Dynamic Content Acceleration](https://cloud.ibm.com/docs/CDN?topic=CDN-dynamic-content-cdn)





* How to



* Creating a CDN



* [Ordering a CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-order-a-cdn)
* [Getting to Running status](https://cloud.ibm.com/docs/CDN?topic=CDN-next-steps-after-ordering)
Configuring and tuning SSL Offload with Citrix Netscaler VPX 

This step-by-step guides you through configuring and tuning SSL Offload in Citrix Netscaler VPX, which is done by using the certificate and cryptographic material generated using the Hardware Security Monitor (HSM) link.

This step-by-step assumes you have completed the steps in [Deploying and Configuring the IBM© Hardware Security Module (HSM) with Citrix Netscaler VPX](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-deploying-and-configuring-the-ibm-hardware-security-module-hsm-with-citrix-netscaler-vpx) to order and create your VPX/HSM pairing.



 About the deployment 

This deployment was built and tested with the following component specifications:



Component specifications

 NetScaler VPX Version & Build HSM Software Version HSM Firmware version HSM Client Version 

 NS12.1: Build 48.13.nc 6.2.2-5 6.10.9 6.2.2 







 Logical topology 

The following diagram shows the network traffic flow for the SSL offload use case. This provides a visual and logical perspective of the trust link and the configuration between the Citrix VPX and the HSM appliance.

Zoom

![Network flows logical topology](https://cloud.ibm.com/docs-content/v1/content/e8ff9d475c01bcec23b567bb9ca41b247bc46dbb/citrix-netscaler-vpx/images/network-flows-logical-topology.jpg)

Network flows logical topography

If you are not familiar with SSL offload, review this [Citrix article](https://docs.citrix.com/en-us/netscaler/12-1/ssl.html).





 What you'll accomplish 

In this step-by-step guide you'll learn how to configure SSL for a Citrix Netscaler VPX:



 Task Description
* For more information see [What's new in MQ 9.1.4](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.pro.doc/q133200_.htm)









 9.1.3 r5 



 Available from 26th November 2019 



* Fix for an issue experienced by some customers when upgrading older queue managers









 9.1.3 r4 



 Available from 22nd November 2019 



* Fix for users experiencing unexpected unauthorised errors when using the messaging REST API









 9.1.3 r3 



 Available from 4th November 2019 



* Improved queue manager deployment and startup time









 9.1.3 r2 



 Available from 22nd October 2019 



* Single sign on support for the MQ Console
* Fix to the error log viewer for displaying entries from larger error logs
* Improved queue manager deployment and startup time
* Improved handling of large FDC files
* Protection against published security vulnerabilities









 9.1.3 r1 



 Available from 11th July 2019 



* Updated to MQ version 9.1.3
* For more information see [What's new in MQ 9.1.3](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.pro.doc/q132800_.htm)









 9.1.2 r1 



 Available from 27th March 2019 



* Updated to MQ version 9.1.2
* For more information see [What's new in MQ 9.1.2](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.pro.doc/q132380_.htm)









 9.1.1 r2 



 Available from 5th February 2019 to 22nd April 2019 



* Required security and vulnerability fixes.
* Reduced queue manager deploy time.
* Improved resilience and performance when authenticating clients.









 9.1.1 r1 



 Available from 2nd January 2019 to 5th March 2019
Set up IBM Cloud Activity Tracker or other capabilities to track user activity in the cluster. 







 Security and regulation compliance 

IBM is responsible for the security and compliance of Red Hat OpenShift on IBM Cloud. Compliance to industry standards varies depending on the infrastructure provider that you use for the cluster, such as classic or VPC. You are responsible for the security and compliance of any workloads that run in the cluster and your application data. For more information, see [What standards does the service comply to?](https://cloud.ibm.com/docs/containers?topic=containers-faqsstandards).



Table 5. Responsibilities for security and regulation compliance

 Resource IBM responsibilities Your responsibilities 

 General <br><br> * Maintain controls commensurate to [various industry compliance standards](https://cloud.ibm.com/docs/containers?topic=containers-faqsstandards), such as PCI DSS.
What if the HTTPS certificate is not added? 

If you get error messages or warnings during the initialization or the set up of Data Security Broker, check for the following troubleshooting tips:

Message: Untrusted certificate browser warning

HTTPS certificate has not been updated. This warning occurs when the Data Security Broker Manager's pre-scanned certificate does not match the hostname of the Manager server. Upload an HTTPS certificate by following the instructions in [Adding HTTPS certificate](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_add_https) section.