vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Only for deployments that have dedicated CPU.



Table 35. Used CPU for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_cpu_used_percent 
 Metric Type gauge 
 Value Type percent 
 Segment By Service instance 







 Used disk space for an instance 

How much disk your deployment is using.



Table 36. Used disk space for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_disk_used_bytes 
 Metric Type gauge 
 Value Type byte 
 Segment By Service instance 







 Used memory for an instance 

How much memory your deployment is using.



Table 37. Used memory for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_memory_used_bytes 
 Metric Type gauge 
 Value Type byte 
 Segment By Service instance 







 WAL logs used bytes 

How much wal log file uses, in bytes



Table 38: WAL logs used bytes metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_wal_used_bytes 
 Metric Type gauge 
 Value Type count 
 Segment By Service instance 









 Attributes for Segmentation 



 Global Attributes 

The following attributes are available for segmenting all of the metrics listed.



Table 39. Global Attributes Metadata

 Attribute Attribute Name Attribute Description 

 Cloud Type ibm_ctype The cloud type is a value of public, dedicated, or local. 
 Location ibm_location The location of the monitored resource - this can be a region, data center, or global. 
 Resource ibm_resource The resource being measured by the service - typically an identifying name or GUID. 
 Resource Type ibm_resource_type The type of the resource being measured by the service. 
 Scope ibm_scope The scope is the account, organization, or space GUID associated with this metric. 







 More Attributes 

The following attributes are available for segmenting one or more attributes as described in the reference above. See the individual metrics for segmentation options.



Table 40. Additional Attributes Metadata

 Attribute Attribute Name Attribute Description
Metric Name ibm_databases_for_etcd_memory_limit_bytes 
 Metric Type gauge 
 Value Type byte 
 Segment By Service instance 







 Total disk space for an instance 

Represents the total amount of disk available to your deployment.



Table 10. Total disk space for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_etcd_disk_total_bytes 
 Metric Type gauge 
 Value Type byte 
 Segment By Service instance 







 Used CPU for an instance 

How much CPU is used as a percentage of total CPU available. Only for deployments that have dedicated CPU.



Table 11. Used CPU for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_etcd_cpu_used_percent 
 Metric Type gauge 
 Value Type percent 
 Segment By Service instance 







 Used disk space for an instance 

How much disk your deployment is using.



Table 12. Used disk space for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_etcd_disk_used_bytes 
 Metric Type gauge 
 Value Type byte 
 Segment By Service instance 







 Used memory for an instance 

How much memory your deployment is using.



Table 13. Used memory for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_etcd_memory_used_bytes 
 Metric Type gauge 
 Value Type byte 
 Segment By Service instance 









 Attributes for segmentation 



 Global Attributes 

The following attributes are available for segmenting all of the metrics that are listed above



Table 14. Global Attributes metadata

 Attribute Attribute Name Attribute Description 

 Cloud Type ibm_ctype The cloud type is a value of public, dedicated, or local. 
 Location ibm_location The location of the monitored resource - this might be a region, data center, or global. 
 Resource ibm_resource The resource being measured by the service - typically an identifying name or GUID. 
 Resource Type ibm_resource_type The type of the resource being measured by the service. 
 Scope ibm_scope The scope is the account, organization, or space GUID associated with this metric. 







 More Attributes
If log sharing is enabled, only someone with Manager service access to the current instance can view logs. The person can view logs from all of the instances that are being shared. Logs from across all of the participating instances are displayed, regardless of the current user's service level access to the other instances. Similarly, when someone with Manager service access to an instance sends a GET request to the v1 /logs API endpoint, logs from all instances that participate in log sharing are returned, regardless of the user's service level access to each instance.







 Making training data improvements 

Use insights from real user conversations to correct the model associated with your dialog skill.

If you use data from another data source, any improvements you make to the model are applied to the current dialog skill only. The Data source field shows the source of the messages you are using to improve this dialog skill, and the header of the page shows the dialog skill you are applying changes to.



 Correcting an intent 



1. To correct an intent, select the ![Edit](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/edit_icon.png) edit icon for the chosen #intent.
2. From the list provided, select the correct intent for this input.



* Begin typing in the entry field and the list of intents is filtered.
* You can also choose Mark as irrelevant from this menu. (For more information, see [Teaching your assistant about topics to ignore](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-logslogs-mark-irrelevant).) Or, you can choose Do not train on intent, which does not save this message as an example for training.



![Select intent](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/select_intent.png)
3.
/etc/logdna/config.yaml 
 LOGDNA_PLATFORM Log source type. k8s 
 LOGDNA_INGESTION_KEY Reference to the logging ingestion key. secretKeyRef 
 LDLOGHOST IBM Log Analysis ingestion endpoint. logs.us-south.logging.cloud.ibm.com 
 LDAPIHOST IBM Log Analysis API ingestion endpoint. api.us-south.logging.cloud.ibm.com 
 LDLOGPATH Ingestion log path. /logs/agent/ 
 LOGDNA_HOSTNAME Log Source name. MyCluster 
 LOG_DIRS Defines custom paths that you want the agent to monitor. <br>Separate multiple paths by using commas. <br>You can use glob patterns. Use double quotation marks to add a globe pattern. var/log /output/,/mylogs/myapplogs/ 
 LOGDNA_INCLUDE Custom rules that you can define to configure what log files to monitor. <br>These files can be located in any of the paths that are defined through the logdir parameter. <br>You can use glob patterns. For more information, see [Glober rules](https://github.com/CJP10/globber) .json,.test 
 LOGDNA_INCLUDE_REGEX Regex custom rules that you can define to configure what log files to monitor. For more information, see [regex syntax](https://docs.rs/regex/1.2.1/regex/syntax) <br>These files can be located in any of the paths that are defined through the logdir parameter. 
 LOGDNA_EXCLUDE Custom rules that you can define to configure what log files to exclude from being monitored. <br>These files can be located in any of the paths that are defined through the logdir parameter. <br>Separate multiple files by using commas. You can use glob patterns. You can configure specific files.
AC-8 - System Use Notification 



  Control requirements 

The information system:

AC-8 (a)
:   Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:



1.  Users are accessing a U.S. Government information system;
2.  Information system usage may be monitored, recorded, and subject to audit;
3.  Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and
4.  Use of the information system indicates consent to monitoring and recording;



AC-8 (b)
:   Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

AC-8 (c)
:   For publicly accessible systems:



1.  Displays system use information [Assignment: organization-defined conditions], before granting further access;
2.  Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
3.  Includes a description of the authorized uses of the system.







  NIST supplemental guidance 

System use notifications can be implemented using messages or warning banners displayed before individuals log in to information systems. System use notifications are used only for access via logon interfaces with human users and are not required when such human interfaces do not exist. Organizations consider system use notification messages/banners displayed in multiple languages based on specific organizational needs and the demographics of information system users. Organizations also consult with the Office of the General Counsel for legal review and approval of warning banner content.
IP Address Policy 



  1. IP Address Ownership 

International Business Machines Corporation or its subsidiaries that (IBM®) own any IP addresses assigned to Client, which are to be used only with the Cloud Services. Use of the IP addresses terminates upon expiration or termination of a service, at which time the IP addresses will be reclaimed and may be re-issued to other customers in the future.





  2. Client-Provided IP Addresses 

Clients may provide their own Regional Internet Registry (RIR) issued IP addresses, subject to certain technical limitations and verification of ownership, by submitting a support case and providing a Letter of Authority to specify Client-owned IP prefixes. If IBM approves a request those IP addresses will be announced via Border Gateway Protocol (BGP) on the Client's behalf and routed to identified Client servers. Client retains ownership of those IP addresses. At Client's request, or upon cancellation of the services, IBM will cease to announce and route those IP addresses. While IBM will make reasonable efforts to ensure that BGP prefixes are accepted by all upstream ISPs, we cannot guarantee global reachability for Client-owned IPs.





  3. Review / Justification / Efficiency Guidelines 

Because IPv4 addresses are a scarce resource, RIRs require ISPs to document that they are efficiently utilizing existing assigned addresses and are planning efficient utilization of any addresses being requested. RIR policies and RFC2050 promote conservation and deter wasteful use or stockpiling of IP space. IBM is required to abide by these policies when IBM requests additional IP addresses to allocate. Therefore, when requested by IBM, Client provides information necessary to enable IBM to obtain RIR-issued IP addresses to support the Cloud Services.

All Client IP address requests are subjected to review by IBM to ensure efficient utilization and are not guaranteed to be approved. During the review, Client is required to provide details about how each IP address would be utilized and technical justification as to why additional IP addresses are needed. IBM may take steps to validate such information, including network scanning and server configuration inspection.

An initial review may take up to 2 business days, and depending on size and complexity, may require additional time for completion. Accounts with open abuse tickets will have their IP requests held for processing until all abuse issues have been resolved.
All communications that cross this boundary are controlled and monitored.

The IBM Cloud network ports are protected with firewalls, which serve as intrusion detection (IDS) and intrusion prevention (IPS) agents. Details regarding on IBM Cloud intrusion detection management is IBM Confidential information and covered under IBM Cloud SOC2 compliance (see compliance section below).

All IBM Maximo environments are configured for Anti-Malware (Anti-Virus) protection and Endpoint Detection and Response (EDR) technology with associated telemetry. Status and alerts are monitored continuously.

IBM Trust Center - Enterprise IT Security and Trust: [https://www.ibm.com/trust/security](https://www.ibm.com/trust/security)

Physical Security for IBM Cloud:

[https://www.ibm.com/cloud/architecture/architectures/physical-security-arch/](https://www.ibm.com/cloud/architecture/architectures/physical-security-arch/)

On site customer visits to IBM Cloud data centers are not allowed for security reasons. Street address locations of data centers are not disclosed. This is in accordance to IBM's NIST guidelines and AICPA Trust Services criteria.

Physical Security for AWS Cloud:

[https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)





 Customer Access 

IBM Maximo Application Suite Dedicated Service are public internet based offerings. Customers connect to IBM Cloud using HTTPS encryption over the internet.

There is no direct link, peering or private cloud option available for the IBM Maximo Application Suite Dedicated Service offering.

Every IBM Maximo Application Suite Dedicated customer environment is delivered in a single tenant instance of the application, running on the Openshift platform.

All IBM Maximo Application Suite Dedicated customers use HTTPS (SSL) encryption (256 bit) at the browser level to access IBM hosted applications. Connections are SHA-2 and TLS v1.2 compatible.

IBM obtains and implements externally facing SSL certificates from a trusted Certificate Authority (CA).

All databases use native AES-256 encryption (data is encrypted at rest).
Access management tags for file shares 

Access management tags help organize access control by creating flexible resource groupings, enabling your file storage resources to grow without requiring updates to IAM policies.

You can create access management tags and then apply them to new or existing file shares and replica file shares. Use the IAM UI or the Global Search and Tagging API to create the access management tag. Then, from the VPC UI or API, add the tags to a file share. After the tags are added, you can manage access to them using the IAM policies. For more information, see [Add access management tags to a file share](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=uifs-add-access-mgt-tags).







 File storage data eradication 

When you delete a file share, that data immediately becomes inaccessible. All pointers to the data on the physical disk are removed. If you later create a file share in the same or another account, a new set of pointers is assigned. The account can't access any data that was on the physical storage because those pointers are deleted. When new data is written to the disk, any inaccessible data from the deleted file storage is overwritten.

IBM guarantees that data deleted cannot be accessed and that deleted data is eventually overwritten and eradicated. When you delete a file share, those blocks must be overwritten before that file storage is made available again, either to you or to another customer.

Further, when IBM decommissions a physical drive, the drive is destroyed before their disposal. Decommissioned physical drives are unusable and any data on them is inaccessible.





 File share lifecycle states 

Table 1 describes the states in the file share lifecycle.



Table 1. File storage lifecycle states

 Status Explanation 

 Stable The file share or mount target is stable and available for use. 
 Pending The file share or mount target is being created. 
 Failed The file share or mount target failed to be created. You can delete the failed share and try creating another one. 
 Deleting The file share or mount target is being deleted. 
 Deleted The file share or mount target is deleted.
* IBM Maximo Application Suite SaaS SRE personnel are required to use privileged access workstations to connect and work with our customer's IBM systems. These workstations meet IBM's highest and most stringent security guidelines.



IBM Maximo Application Suite SaaS SRE personnel who are granted O/S or console level access to customer servers are required to use multi-factor authentication. Unique 2048-bit ssh keys are issued to each IBM user in order to connect to the IBM Cloud VPN. Phone based authentication via PIN is also required each time an IBMer connects. These factoring mechanisms are maintained, managed and issued by IBM Cloud Security and the IBM Maximo Application Suite SaaS Environment Operations Manager.

IBM's internal network prevents employees from accessing malicious websites using Symantec Bluecoat and ProofPoint Targeted Attack Protection (TAP)

IBM Maximo Application Suite SaaS SRE personal access credentials are role based and managed using an IBM internal access management system.

Access is based by job duties (least privilege principal) in accordance with IBM IT Security Policy. The IBM Cloud Delivery Services security team performs the following processes to ensure only those individuals who require access to systems have it, and to ensure the right privileges are in place:

Every quarter, a separation of duties review is performed by the IBM Maximo Application Suite SaaS SRE management team to ensure no one individual has a conflict of roles without adequate safeguards beings in place

Every quarter, a review of user access is performed to ensure existing users and privileges are still required

A defined process is in place to ensure individuals who leave the IBM SRE team, even if to other areas within IBM, have their UserID and privileges revoked

The IBM Maximo Application Suite SaaS SRE team performs proactive management and deployment of patches, updates and fixes to the Application, Middleware, Database and O/S layers via a planned Maintenance & Outage Calendar

IBM Cloud Delivery Services employs a defense in depth strategy (DiD) for boundary protection that includes firewalls and encrypted communications for remote connectivity to access the environment. All communications that cross this boundary are controlled and monitored.

The IBM Cloud network ports are protected with firewalls, which serve as intrusion detection (IDS) and intrusion prevention (IPS) agents.
IBM Maximo Application Suite Dedicated Service personnel who are granted O/S or console level access to customer servers are required to use multi-factor authentication. Unique 2048-bit ssh keys are issued to each IBM user in order to connect to the IBM Cloud VPN. Phone based authentication via PIN is also required each time an IBMer connects. These factoring mechanisms are maintained, managed and issued by IBM Cloud Security and the IBM Maximo Application Suite Dedicated Environment Operations Manager.

IBM's internal network prevents employees from accessing malicious websites using Symantec Bluecoat and ProofPoint Targeted Attack Protection (TAP).

IBM Maximo Application Suite Dedicated Service personal access credentials are role based and managed using an IBM internal access management system.

Access is based by job duties (least privilege principal) in accordance with IBM IT Security Policy. The IBM SRE security team performs the following processes to ensure only those individuals who require access to systems have it, and to ensure the right privileges are in place.

Every quarter, a separation of duties review is performed by the IBM Maximo Application Suite Dedicated Service management team to ensure no one individual has a conflict of roles without adequate safeguards beings in place.

Every quarter, a review of user access is performed to ensure existing users and privileges are still required.

A defined process is in place to ensure individuals who leave the IBM SRE team, even if to other areas within IBM, have their UserID and privileges revoked.

The IBM Maximo Application Suite Dedicated team performs proactive management and deployment of patches, updates and fixes to the Application, Middleware, Database and O/S layers via a planned Maintenance & Outage Calendar

IBM SRE team employs a defense in depth strategy (DiD) for boundary protection that includes firewalls and encrypted communications for remote connectivity to access the environment. All communications that cross this boundary are controlled and monitored.

The IBM Cloud network ports are protected with firewalls, which serve as intrusion detection (IDS) and intrusion prevention (IPS) agents. Details regarding on IBM Cloud intrusion detection management is IBM Confidential information and covered under IBM Cloud SOC2 compliance (see compliance section below).

All IBM Maximo environments are configured for Anti-Malware (Anti-Virus) protection and Endpoint Detection and Response (EDR) technology with associated telemetry.
All security group interactions are logged to an account's audit log. The entries track specific security group changes as well as which user requested the change. Logs are written for the following interactions:



* A security group is added to or removed from a virtual server's network interface.
* A security group's rules are changed by add rule, edit rule, or remove rule.



For each of those interactions, one log is written for each affected object. A log is always written against the security group being changed. Additional logs are written for each virtual server network interface attached to the security group. Filtering audit logs on a specific security group shows all security group related changes for the group. Likewise, filtering logs on a specific virtual server shows all security group related changes for the virtual server.

Since security group changes can result in a number of virtual servers being updated in the background, audit logs can be used to determine precisely when a change went into effect. Security group APIs that generate audit logs return a request identifier. That identifier can be used to correlate API calls with their resulting audit logs.





 Security group example 

In the following diagram, virtual server instances are associated with a set of security groups to restrict network traffic. The arrows represent network traffic flow. The application developer has restricted access to the various infrastructure layers, as follows:



* The application developer can access only the web layer on TCP port 443 (HTTPS).
* Only web layer instances can access the application layer instances.
* Only the application layer instances can access the database layer instances.



Zoom

![Security group image](https://cloud.ibm.com/docs-content/v1/content/f3a430977b1e79176682f947de41fc02945c41e7/security-groups/images/SecurityGroups.png)

Figure 1. Security group image