vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Scanning and review 

When you scan hosts, virtual machines (VMs), and virtual appliances (VAs), you evaluate them against baselines and baseline groups to determine their levels of compliance. Inventory objects are scanned, and the results are reviewed to determine how they comply with the baselines and baseline groups. Scan results can be filtered by text search, group selection, baseline selection, and compliance status selection. You can initiate the following scans:



* Manually Initiate a Scan of vSphere ESXi Hosts - You can scan vSphere® ESXi™ hosts in the vSphere inventory against attached baselines and baseline groups.
* Manually Initiate a Scan of Virtual Machines and Virtual Appliances - You can scan VMs and VAs in the vSphere inventory against attached baselines and baseline groups.
* Manually Initiate a Scan of a Container Object - Starts a simultaneous scan of hosts, VMs, and VAs, by scanning a container object that is a data center or a data center folder.
* Schedule a Scan - You can configure the vSphere Web Client to scan VMs, VAs, and ESXi hosts at specific times or at intervals as needed.





 Manually initiating a scan of vSphere ESXi hosts 



1. Click Scan for Updates, select Patches and Extensions and Upgrades, then click OK.
2. When the scan completes, select Critical Host Patches. In the lower pane, review the patch details for each host by clicking the number in Number of Patches. A window shows the patch information.
3. Review and repeat for Non-Critical Patches.

The VMware Update Manager (VUM) log files are at /var/log/vmware/vmware-updatemgr/vum-server/vmware-vum-server-log4cpp.log.







 Manually initiating a scan of virtual machines and virtual appliances 

You can scan VMs and virtual appliances in the vSphere inventory against attached baselines and baseline groups. The VMs and appliances that you select are scanned against the attached baselines, depending on the options that you select.
RvVRAyhPP9civbU=

 encrypt the nonce
$ ibmcloud kp import-token nonce-encrypt -k $KEY_MATERIAL -n $NONCE

Encrypted Nonce IV
nrrCczvYXvc6T7J2G+EOLjHZO1cpPyu/nhsIlA== N6oLJnUqaKF3v5Sd

 Normally, you would capture the last encrypted nonce and the initialization
 vector (IV) (from the import token). Then use those new values with the
 "key restore" command.

 To force an error we are using the old (original) encrypted nonce and IV to
 restore the key, which fails because the ENCRYPTED_NONCE does not match the
 value in the import token

 we skipped these steps to force an error
 $ ENCRYPTED_NONCE=nrrCczvYXvc6T7J2G+EOLjHZO1cpPyu/nhsIlA==
 $ IV=N6oLJnUqaKF3v5Sd

 use the CLI to restore the deleted key
 this fails because the ENCRYPTED_NONCE does not match the value in the import token
$ ibmcloud kp key restore $KEY_ID -k $ENCRYPTED_KEY -n $ENCRYPTED_NONCE -v $IV --output json

FAILED
kp.Error:
correlation_id='a9412941-7986-421d-a67f-b22892e7634d',
msg='Bad Request:
Key could not be restored.
Please see reasons for more details.',
reasons='[INCORRECT_NONCE_ERR:
The encrypted nonce given does not match existing record,
please ensure the correct nonce was given in the request -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'
Show more







 23 - The import token has expired 



 Message 

The import token has expired
If you have a problem when you try to push a Docker image, see [Why can't I push or pull a Docker image?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-push-pull-docker) for assistance.
* If you are using Podman, run the following command.

podman push <region>.icr.io/<my_namespace>/<image_repo>:<tag>

Example, where <region> is uk, <my_namespace> is namespace1, <image_repo> is hw_repo, and <tag> is 1:

podman push uk.icr.io/namespace1/hw_repo:1









 Step 6: Verify that the image was pushed 

Verify that the image was pushed successfully by running the following command.

ibmcloud cr image-list

You set up a namespace in IBM Cloud Container Registry and pushed your first image to your namespace.





 Next steps in Container Registry 



* [Manage image security with Vulnerability Advisor.](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=ui)
* [Review your service plans.](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_plans)
* [Store and manage more images in your namespace.](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_)
* [Define access policies.](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser)
* [Set up clusters and worker nodes.](https://cloud.ibm.com/docs/containers?topic=containers-clustersclusters)
Development processes and software integrity 

Development processes and ensuring system and software integrity are key parts of the IBM Cloud Framework for Financial Services. You must manage changes to the information system by using a defined system development life cycle (SDLC) that incorporates information security considerations.

You should ensure that security engineering principles are applied in the design, development, implementation, and modification of the system. During the ongoing development, implementation, operations, maintenance, and continuous monitoring of the overarching information system lifecycle, you must develop, implement, operate, and maintain the system in accordance with the security processes and technical requirements that are detailed in the IBM Cloud Framework for Financial Services and the accompanying operational plans and policies.

You must ensure that developers:



* Perform configuration management during system/component/service development, implementation, and operation.
* Document change approvals and security impact analyses for all system changes.
* Perform unit, integration, system, regression testing/evaluation.
* Perform static and dynamic code analysis.
* Use development testing processes that provide coverage for the entire component and explicitly reviews, evaluates, and tests all security functions.
* Control consumer data so that it is never placed into nonproduction environments. Consumer data must not be consumed or used for the purposes of testing services.
* Enable integrity verification of software components to detect unauthorized changes to system software, firmware, and information:



* All applicable software components must be cryptographically signed by the manufacturer or developer to ensure you can perform integrity checks and verify that the component that is deployed in the system is the same component that the manufacturer or developer evaluated and certified.
* Deploy only signed and approved builds within the environment.



* Ensure only the approved, tested changes/code gets promoted to production and no vulnerabilities are introduced.
* Document and evidence the execution of the system/service and security testing/scanning along with the results.
* Track security flaws and flaw resolution within the system and report findings to designated personnel.





 Red Hat OpenShift on IBM Cloud 

When using Red Hat OpenShift on IBM Cloud to host workloads, you must use Container Registry and the Vulnerability Advisor component it contains. Red Hat OpenShift on IBM Cloud provides a multi-tenant, highly available, scalable, and encrypted private image registry that is hosted and managed by IBM®.
SA-10 (1) - Software / Firmware Integrity Verification 



  Control requirements 

SA-10 (1) - 0
:   The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Development processes and software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processes)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)
*  Check whether DevSecOps Toolchain signs build artifacts to attest their provenance







  NIST supplemental guidance 

This control enhancement allows organizations to detect unauthorized changes to software and firmware components through the use of tools, techniques, and/or mechanisms provided by developers. Integrity checking mechanisms can also address counterfeiting of software and firmware components. Organizations verify the integrity of software and firmware components, for example, through secure one-way hashes provided by developers. Delivered software and firmware components also include any updates to such components.
The following table details actions that are mapped to platform management roles. Platform management roles enable users to perform tasks on service resources at the platform level, for example assign user access for the service, and create or delete service IDs.



Table 2. IAM user roles and actions

 Platform management roles Description of actions Example actions 

 Viewer Not supported 
 Editor Not supported 
 Operator Not supported 
 Administrator Configure access for other users.<br><br>Apply pull secrets to clusters. For more information about assigning user roles in the UI, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).<br><br>To create clusters in IBM Cloud Kubernetes Service that have pull secrets to access images in Container Registry, you must have the Administrator role. To use the [ibmcloud ks cluster pull-secret apply](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_pull_secret_apply) command to configure the pull secrets for an existing cluster, you must have the Administrator role. For more information, see [Preparing to create clusters](https://cloud.ibm.com/docs/containers?topic=containers-clusterscluster_prepare). 







 Service access roles 

The following table details actions that are mapped to service access roles. Service access roles give users access to Container Registry as well as the ability to call the Container Registry API.



Table 3. IAM service access roles and actions

 Service access role Description of actions Example actions 

 Reader The Reader role can view information. View, inspect, and pull images.<br><br>View and analyze namespaces.<br><br>View quotas.<br><br>View vulnerability reports.<br><br>View image signatures.<br><br>View retention policies.<br><br>View the contents of the trash.<br><br>View the contents of the manifest for an image.<br><br>List Vulnerability Advisor security exemption policies and types of security exemptions. 
 Writer The Writer role can edit information.
{
"name": "rule2",
"description": "Unit Test Rule without regression",
"stage": "integrationtest",
"percentPass": 98,
"criticalTests":
"'Get Weather with incomplete zip code'"
],
},
{
"name": "rule3",
"description": "Functional test Rule",
"stage": "fvt",
"percentPass": 98,
"criticalTests":
"'Get Weather with incomplete zip code'"
],
},
{
"name": "rule4",
"description": "Code Coverage rule",
"stage": "code",
"codeCoverage": 98,
},
{
"name": "rule5",
"description": "Custom dataset rule",
"stage": "covtest",
"codeCoverage": 60,
},
{
"name": "rule6",
"description": "Static Security Scan rule",
"stage": "staticsecurityscan",
"highSeverity": 40,
"mediumSeverity": 5,
"lowSeverity": 9
},
{
"name": "rule7",
"description": "Dynamic Security Scan rule",
"stage": "dynamicsecurityscan",
"highSeverity": 40,
"mediumSeverity": 5,
"lowSeverity": 9
},
{
"name": "rule8",
"description": "Sonarqube rule",
"stage": "sonarqube"
},
{
"name": "rule9",
"description": "Vulnerability rule",
"stage": "vulnerabilityadvisor"
}
]
},
{
"name": "UI",
If you're logging in with a federated ID, run the ibmcloud login --sso command. For more information, see [Logging in with a federated ID](https://cloud.ibm.com/docs/account?topic=account-federated_id&interface=cli).



2. Specify the region and resource group in which to create an instance of the software:



ibmcloud target -r <region_name> -g <resource_group_name>



3. Create an API key:



ibmcloud iam api-key-create <API_key_name>
[-d, --description <description>]
[--file <API_key_file_name>]



4. Retrieve your access token:



curl --location --request GET '<source URL>' 
-- header 'Authorization: bearer <token>' -o <filename>
4. Enter the source URL that you copied in the previous step in the GET request. If you're working with OVA images, you can skip this step.
5. Press Enter to download the source package.
6. Use a vulnerability scanning tool of your choice to review the contents of the software and associated images for any issues.



After you run the scan and address any reported issues, you can return to the console and install the software.
field value 

 tool type mend 
 evidence type com.ibm.code_vulnerability_scan 
 asset type repo 
 attachments <scan report containing detected libraries and list of vulnerabilities in JSON> 
 attachments <scan summary report in text format> 







 Debugging and logging 



Table 4. Debug parameters

 Parameter name Default value Description 

 pipeline-debug 0 Debug flag 0 off 1 on 







 Accessing your scan results 

You can access your scan results using any of the following methods:



* Viewing them on the Mend UI.
* Setting the mend-print-scan-results pipeline environment property to instruct the pipeline to print the scan report JSON to the stage log.
* Setting the mend-print-scan-summaries pipeline environment property to instruct the pipeline to print the scan summary text to the stage log.
* Using the [DevSecOps/CoCoa CLI](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cli) command line tool to download your scan results from the evidence locker by using the information printed in the stage log. For more information see the following resources:



* [cocoa locker evidence get](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-clilocker-evidence-get)
* [cocoa locker attachment get](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-clilocker-attachment-get)
For more information, see [NeuVector Container Security](https://cloud.ibm.com/catalog/services/neuvector-container-security-platform). Yes Yes 
 IBM Cloud Secrets Manager Ingress secrets and certificates You can use Secrets Manager to store and manage your Ingress secrets and certificates. For more information, see [Setting up Secrets Manager in your Kubernetes Service cluster](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgr). Yes 
 Twistlock As a supplement to [Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index), you can use [Twistlock](https://www.paloaltonetworks.com/prisma/cloud) to manage firewalls, threat protection, and incident response. Yes Yes 







 Storage services 



Table 6. Storage services

 Service Description Classic VPC 

 Heptio Velero You can use [Heptio Velero](https://github.com/vmware-tanzu/velero) to back up and restore cluster resources and persistent volumes. For more information, see the Heptio Velero [Use cases for disaster recovery and cluster migration](https://github.com/vmware-tanzu/velero/blob/release-0.9/docs/use-cases.md). Yes Yes 
 IBM Cloud Classic Block Storage [IBM Cloud Classic Block Storage](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-getting-startedgetting-started) is persistent, high-performance iSCSI storage that you can add to your apps by using Kubernetes persistent volumes (PVs). Use block storage to deploy stateful apps in a single zone or as high-performance storage for single pods. For more information about how to provision block storage in your cluster, see [Setting up IBM Cloud Block Storage](https://cloud.ibm.com/docs/containers?topic=containers-block_storageblock_storage) Yes
: To get the version locator for the product, run the ibmcloud catalog offering list command and locate the specified version that you want to use.

--output FORMAT (optional)
: Specifies output format. The default is terminal compatible and the only supported alternative is JSON, for example, --output json.







 ibmcloud catalog offering version scc 

Run the following command to add a scan that you previously ran in Security and Compliance Center to a version. Each scan is limited to a single profile. For more information, see [What is a profile?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-profiles).

You must add controls and validate your version before you can add a scan.

ibmcloud catalog offering version scc [--profile PROFILE] [--scan SCAN] [--version-locator VERSION_NUMBER]



 Command options 

--profile PROFILE
: Specifies the ID of the profile that you scanned.

--scan SCAN
: Specifies the ID of the Security and Compliance Center scan that you previously ran in Security and Compliance Center.

--version-locator VERSION_NUMBER
: To get the version locator for the product, run the ibmcloud catalog offering list command and locate the specified version that you want to use.







 ibmcloud catalog offering get-scan-results 

Run the following command to generate a report of your version's Code Risk Analyzer and Security and Compliance Center scan results. To generate a full report, you must run the Code Risk Analyzer and Security and Compliance Center scans. For more information, see [ibmcloud catalog offering version cra](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-manage-catalogs-pluginversion-cra) and [ibmcloud catalog offering version scc](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-manage-catalogs-pluginversion-scc).

ibmcloud catalog offering get-scan-results [--version-locator LOCATOR]



 Command options
: To get the version locator for the product, run the ibmcloud catalog offering list command and locate the specified version that you want to use.

--output FORMAT (optional)
: Specifies output format. The default is terminal compatible and the only supported alternative is JSON, for example, --output json.







 ibmcloud catalog offering version scc 

Run the following command to add a scan that you previously ran in Security and Compliance Center to a version. Each scan is limited to a single profile. For more information, see [What is a profile?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-profiles).

You must add controls and validate your version before you can add a scan.

ibmcloud catalog offering version scc [--profile PROFILE] [--scan SCAN] [--version-locator VERSION_NUMBER]



 Command options 

--profile PROFILE
: Specifies the ID of the profile that you scanned.

--scan SCAN
: Specifies the ID of the Security and Compliance Center scan that you previously ran in Security and Compliance Center.

--version-locator VERSION_NUMBER
: To get the version locator for the product, run the ibmcloud catalog offering list command and locate the specified version that you want to use.







 ibmcloud catalog offering get-scan-results 

Run the following command to generate a report of your version's Code Risk Analyzer and Security and Compliance Center scan results. To generate a full report, you must run the Code Risk Analyzer and Security and Compliance Center scans. For more information, see [ibmcloud catalog offering version cra](https://cloud.ibm.com/docs/cli?topic=cli-manage-catalogs-pluginversion-cra) and [ibmcloud catalog offering version scc](https://cloud.ibm.com/docs/cli?topic=cli-manage-catalogs-pluginversion-scc).

ibmcloud catalog offering get-scan-results [--version-locator LOCATOR]



 Command options 

--version-locator LOCATOR
: To get the version locator for the product, run the ibmcloud catalog offering list command and locate the specified version that you want to use.

--output FORMAT (optional)
: Specifies output format. The default is terminal compatible and the only supported alternative is JSON, for example, --output json.







 ibmcloud catalog offering version scc 

Run the following command to add a scan that you previously ran in Security and Compliance Center to a version. Each scan is limited to a single profile. For more information, see [What is a profile?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-profiles).

You must add controls and validate your version before you can add a scan.

ibmcloud catalog offering version scc [--profile PROFILE] [--scan SCAN] [--version-locator VERSION_NUMBER]



 Command options 

--profile PROFILE
: Specifies the ID of the profile that you scanned.

--scan SCAN
: Specifies the ID of the Security and Compliance Center scan that you previously ran in Security and Compliance Center.

--version-locator VERSION_NUMBER
: To get the version locator for the product, run the ibmcloud catalog offering list command and locate the specified version that you want to use.







 ibmcloud catalog offering get-scan-results 

Run the following command to generate a report of your version's Code Risk Analyzer and Security and Compliance Center scan results. To generate a full report, you must run the Code Risk Analyzer and Security and Compliance Center scans. For more information, see [ibmcloud catalog offering version cra](https://cloud.ibm.com/docs/account?topic=account-manage-catalogs-pluginversion-cra) and [ibmcloud catalog offering version scc](https://cloud.ibm.com/docs/account?topic=account-manage-catalogs-pluginversion-scc).

ibmcloud catalog offering get-scan-results [--version-locator LOCATOR]



 Command options 

--version-locator LOCATOR
* Incident issues that are created during the CI pipeline do not carry a due date, while incident issues that are created during the CC pipeline do.
* Incident issues that are created during the CI pipeline are found during the build, while incident issues that are created during the CC pipeline are found in the production environment.



Figures 1 - 6 show the possible use cases that are based on these differences.



 DevSecOps/one pipeline lifecycle 

The DevSecOps/one pipeline lifecycle extends from code PRs to production scans.

Zoom

![Vulnerability use cases flow](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/vuln-uc-0.svg)

Figure 1. DevSecOps/one pipeline lifecycle





 Use case 1: vulnerability found in the build 

The new build introduces a vulnerability, which is not accepted. Deployment is blocked unless the change request is an emergency CR that is manually approved.

Zoom

![Vulnerability found in the build](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/vuln-uc-1.svg)

Figure 2. Vulnerability found in the build





 Use case 2: vulnerability found in the build that is also in production 

The new build contains a vulnerability that is also in the currently deployed production. Teams have a timeline to fix the issue, but new features or fixes can still be deployed.

Zoom

![Vulnerability found in the build that is also in production](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/vuln-uc-2.svg)

Figure 3.