vania-janet/multiturn-rag-retrieval-data huggingface dataset:
As of 28 October 2015, IBM Cloud® no longer allows outbound connections through TCP port 25 (SMTP) on new accounts.





By default, the standard SMTP TCP port 25 is blocked due to the large amount of abuse that is targeted at this port. IBM Cloud® offers a trusted third-party email relay service from SendGrid if you need to send outbound email from their domains or applications.





If you need send email from your servers, you need to use a smart host outside of IBM Cloud®. A smart host is a host that relays SMTP traffic from an SMTP server, mail client, or any other service or programming language capable of handling SMTP. Servers typically send this type of traffic by using the mail submission TCP ports 465 or 587. You can communicate with 465, 587, or any custom port other than TCP port 25. If you want to use your own email server on a custom port, use the documentation specific to your email service to configure a custom email port.





Your emails can be flagged as spam if you don't use authentication with RDNS, DMARC, BIMI, SPF, or DKIM. If your emails don't comply with internet privacy laws, then they might be blocked or flagged as spam. The following are some common privacy laws.



* Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM)
* Canada Anti-Spam Law (CASL)
* General Data Protection Regulation (GDPR)
* California Consumer Protection Act (CCPA)









* Your email size might be higher than threshold restrictions. Failure notices often give more details about size restrictions.
* The recipient server might block your emails because of compliance and regulation reasons. For more information, see [Why are my emails flagged as spam?](https://cloud.ibm.com/docs/faqswhy-emails-flagged-as-spam).







Internet traffic congestion and SMTP server configuration issues can cause delivery delays.
Paste the certificate content into the content field, provide a name for the Root CA, and add one or more fully qualified domain names (FQDN) of the endpoints that you want to use this certificate. These FQDNs are the hostnames that are used for the resources being protected by the application policy. You must associate the Root CA with the FQDN that the application being protected uses.
3. Click Save.

If your zone is using an intermediate certificate in addition to the root certificate, upload the entire chain.
4. In the MTLS access policies table, create a new access application that enforces mTLS authentication. The application must be built with a hostname that was associated in the certificate upload modal. The policy section is pre-set to enforce a decision of non_identity, and an include rule to match any valid certificate.







 Testing using curl 



1. Test for the site using mTLS by attempting to curl the site without a client certificate. This curl command example is for the site example.com that has an Access policy set for https://auth.example.com:

curl -sv https://auth.example.com

Without a client certificate in the request, a "403 forbidden" response displays and the site cannot be accessed.
2. Add your client certificate information to the request:

curl -sv https://auth.example.com --cert example.pem --key key.pem

When the authentication process completes successfully, a CF_Authorization Set-Cookie header returns in the response.







 Validating mutual TLS 

Follow this validation workflow when you enable this Access policy:



1. All requests to the origin are evaluated for a valid client certificate. The client device sends the client "hello". The access application responds with "hello" and a request for the client certificate.
2. The client returns a valid certificate.
3. Client authentication handshake is completed against the root certificate authority.
4. For chains, there is a check for expired certificates. Chain verification is applicable to certificate validation.
5.
As of 28 October 2015, IBM Cloud® no longer allows outbound connections through TCP port 25 (SMTP) on new accounts.





By default, the standard SMTP TCP port 25 is blocked due to the large amount of abuse that is targeted at this port. IBM Cloud® offers a trusted third-party email relay service from SendGrid if you need to send outbound email from their domains or applications.





If you need send email from your servers, you need to use a smart host outside of IBM Cloud®. A smart host is a host that relays SMTP traffic from an SMTP server, mail client, or any other service or programming language capable of handling SMTP. Servers typically send this type of traffic by using the mail submission TCP ports 465 or 587. You can communicate with 465, 587, or any custom port other than TCP port 25. If you want to use your own email server on a custom port, use the documentation specific to your email service to configure a custom email port.





Your emails can be flagged as spam if you don't use authentication with RDNS, DMARC, BIMI, SPF, or DKIM. If your emails don't comply with internet privacy laws, then they might be blocked or flagged as spam. The following are some common privacy laws.



* Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM)
* Canada Anti-Spam Law (CASL)
* General Data Protection Regulation (GDPR)
* California Consumer Protection Act (CCPA)









* Your email size might be higher than threshold restrictions. Failure notices often give more details about size restrictions.
* The recipient server might block your emails because of compliance and regulation reasons. For more information, see [Why are my emails flagged as spam?](https://cloud.ibm.com/docs?tab=faqswhy-emails-flagged-as-spam).







Internet traffic congestion and SMTP server configuration issues can cause delivery delays.
APIs supported Kafka API <br>Admin REST API <br>REST Producer API Kafka API <br>Admin REST API <br>REST Producer API Kafka API <br>Admin REST API <br>REST Producer API <br>Schema Registry API Kafka API <br>Admin REST API <br>REST Producer API <br>Schema Registry API <br><br>[10] 
 Deployment timeframe Instantaneous provisioning Instantaneous provisioning Expect provisioning to take up to 3 hours. As Enterprise has its own dedicated resources for each cluster, it requires more time for provisioning. If all your infrastructure is correctly in place, expect provisioning to take up to 1 hour because Satellite has its own dedicated resources for each instance. 
 Compliance GDPR <br>Privacy Shield GDPR <br>Privacy Shield <br>ISO 27001, 27017, 27018, 2701 <br>SOC 1 Type <br>SOC 2 Type 2 <br>SOC 3 <br>PCI DSS <br>ISMAP <br>C5 GDPR <br>Privacy Shield <br>ISO 27001, 27017, 27018, 2701 <br>SOC 1 Type 2 <br>SOC 2 Type 2 <br>SOC 3 <br>HIPAA ready <br>PCI DSS <br>ISMAP <br>C5 GDPR <br>ISO 27001, 27017, 27018, 2701 <br><br>[11] 
 Manage security and compliance No No Yes No 
 IAM address restrictions No Yes Yes No 
 IAM token authentication only No No Yes Yes 
 Mirroring No No Yes No 



For more information about limits, see [limits and quotas](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-kafka_quotas).
Configuring your Git Repos and Issue Tracking repository 

[DevSecOps](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-arch) requires you to configure the [branch protection rules](https://us-south.git.cloud.ibm.com/help/user/project/protected_branches) of your Git Repos and Issue Tracking repository (repo).

Add the required branch protection rules:



1.  On the Git Repos and Issue Tracking repo Settings page, in the Protected branches section, select the branch to protect.
2.  Select Maintainers to specify who is allowed to merge to the selected branch.
3.  Select Developers + Maintainers to specify who is allowed to push to the selected branch.
4.  Toggle Allow force push so that this option is unavailable.
5.  Click Protect.



Zoom

![Branch protection rules](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/grit-branch-protection-rules-screenshot.png)

Figure 1. Branch protection rules
[App ID backend flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/backend-flow.svg)

Figure 1. Backend application flow



1. A client makes a POST request to the App ID authorization server to obtain an access token. A POST request generally takes the following form:

POST /oauth/v4/<tenantID>/token HTTP/1.1
Content_type: application/x-www-form-urlencoded
Authorization header = "Basic" + base64encode(<clientID>:<secret>)
FormData = <grantType>
2. If the client meets the qualifications, the authorization server returns an access token.
3. The client sends a request to the protected resource. Requests can be sent in multiple ways, depending on which HTTP client library you're using but a request generally takes the following form:

curl -H 'Authorization: Bearer <accessToken>'
<https://my-protected-resource.com>
4. The protected resource or API validates the token. If the token is valid, access to the resource is granted for the client. If the token cannot be validated, access is denied.



For information about how to configure your app to use Liberty for Java, see [Quick start: Liberty for Java backend apps tutorial](https://cloud.ibm.com/docs/appid?topic=appid-backend-liberty).







 Protecting resources by using the Node.js SDK 

You can use the App ID SDKs to enforce authentication and authorization for your server-side applications. The ApiStrategy works to secure your backend resources by requiring that access and identity tokens are validated as part of the request. The App ID Node.js SDK works with the [Passport framework](http://www.passportjs.org/).
Created 2023-02-17T20:29:21+00:00
Href https://eu-de.iaas.cloud.ibm.com/v1/regions/eu-de/zones/eu-de-3

The snapshot clone appears as unavailable while the snapshot clone is created. Issue the ibmcloud is snapshot-cl command with the snapshot ID and the clone target zone to see the new snapshot clone as available.

cloudshell:$ ibmcloud is snapshot-cl r138-4463eb2c-4913-43b1-b9bf-62a94f74c146 eu-de-3
Getting zonal clone eu-de-3 of snapshot r138-4463eb2c-4913-43b1-b9bf-62a94f74c146 under account Test Account as user test.user@ibm.com...

Zone eu-de-3
Available true
Created 2023-02-17T20:29:21+00:00





 Creating cross-regional copy of a snapshot from the CLI 

New

To create a copy of a snapshot in another region, run the ibmcloud is snapshot-create command with the --source-snapshot-crn option and the source snapshot CRN.

If the source snapshot is not encrypted with a customer key, the encryption of the copy remains provider-managed. If the source snapshot is protected by a customer-managed key, you need to specify the customer-managed key that you want to use to encrypt the new copy.

The following example creates a snapshot in the target region (us-south) by using the CRN of a snapshot from the source region (us-east).
1.2.21 Ensure that the healthz endpoint is protected by RBAC. Automated 1 Missing 
 1.2.22 Ensure that the --audit-log-path option is set. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 
 1.2.23 Ensure that the audit logs are forwarded off the cluster for retention. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Automated 1 Pass 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Automated 1 Pass 
 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile options are set as appropriate. Automated 1 Pass 
 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Automated 1 Pass 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Automated 1 Pass 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Automated 1 Pass 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate.
* Initiator: The initiator is the resource that makes an API call and generates a CADF event. The event that is triggered depends on the action that is requested by the API call.
* Observer: The observer is the resource that creates and stores a CADF record from information available in a CADF event
* Outcome: The outcome is the status of the action against the target.
* Target: The target is the resource against which the action is performed, attempted to perform, or is pending to complete.







 Selecting your IBM Cloud Activity Tracker offering 

Depending on your compliance and organizational requirements, you can choose IBM Cloud Activity Tracker Event Routing or an IBM Cloud Activity Tracker hosted event search offering.



* Application environments seeking to maintain Financial Services (FS) validation status on IBM Cloud should use IBM Cloud Activity Tracker Event Routing.
* Application environments seeking compliance with PCI, SOC2, Privacy Shield and HIPAA should use an IBM Cloud Activity Tracker hosted event search offering.



[![Getting started with Event Routing](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/getting_started_routing.svg)](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started)[![Getting started with hosted event and search](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/getting_started_event.svg)](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started)



 Financial Services Validated status 

If you're the account owner, you can enable your IBM Cloud® account to be Financial Services Validated, which means your account stores and manages regulated financial services information.
1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Automated 1 Pass 
 1.2.16 Ensure that the admission control plug-in SecurityContextConstraint is set. Automated 1 Pass 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Automated 1 Pass 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Automated 1 Pass 
 1.2.19 Ensure that the --insecure-port option is set to 0. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.20 Ensure that the --secure-port option is not set to 0. Automated 1 Pass 
 1.2.21 Ensure that the healthz endpoint is protected by RBAC. Automated 1 Pass 
 1.2.22 Ensure that the --audit-log-path option is set. Automated 1 Pass 
 1.2.23 Ensure that the audit logs are forwarded off the cluster for retention. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass
1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Automated 1 Pass 
 1.2.16 Ensure that the admission control plug-in SecurityContextConstraint is set. Automated 1 Pass 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Automated 1 Pass 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Automated 1 Pass 
 1.2.19 Ensure that the --insecure-port option is set to 0. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.20 Ensure that the --secure-port option is not set to 0. Automated 1 Pass 
 1.2.21 Ensure that the healthz endpoint is protected by RBAC. Automated 1 Pass 
 1.2.22 Ensure that the --audit-log-path option is set. Automated 1 Pass 
 1.2.23 Ensure that the audit logs are forwarded off the cluster for retention. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass
1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Automated 1 Pass 
 1.2.16 Ensure that the admission control plug-in SecurityContextConstraint is set. Automated 1 Pass 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Automated 1 Pass 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Automated 1 Pass 
 1.2.19 Ensure that the --insecure-port option is set to 0. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 1.2.20 Ensure that the --secure-port option is not set to 0. Automated 1 Missing 
 1.2.21 Ensure that the healthz endpoint is protected by RBAC. Automated 1 Pass 
 1.2.22 Ensure that the --audit-log-path option is set. Automated 1 Pass 
 1.2.23 Ensure that the audit logs are forwarded off the cluster for retention. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass
1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Automated 1 Pass 
 1.2.16 Ensure that the admission control plug-in SecurityContextConstraint is set. Automated 1 Pass 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Automated 1 Pass 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Automated 1 Pass 
 1.2.19 Ensure that the --insecure-port option is set to 0. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.20 Ensure that the --secure-port option is not set to 0. Automated 1 Pass 
 1.2.21 Ensure that the healthz endpoint is protected by RBAC. Automated 1 Pass 
 1.2.22 Ensure that the --audit-log-path option is set. Automated 1 Pass 
 1.2.23 Ensure that the audit logs are forwarded off the cluster for retention. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass
Default deployment of a FortiGate Security Appliance 1 Gbps 

The FortiGate Security Appliance (FSA) 1 Gbps is deployed as a single Virtual Domain (typically firewall001) on a dedicated appliance. The customer has full access to the resources of the appliance (processors, memory, and so on), but access to device-level configuration is constrained to ensure IBM© Cloud can effectively support the device.

The FSA is deployed in NAT mode and resides in two VLANs within the public network infrastructure. The Outside VLAN is the IBM Cloud public VLAN where traffic enters the data center and is routed to the FSA. The inside VLAN is your protected public FCR (Frontend Customer Router) VLAN and is where the customer's server resources reside.

IBM Cloud deploys the FSA with two bonded 1G interfaces on each of these two networks during the provisioning process. IBM Cloud also deploys a single interface for provisioning and maintenance of the device that is not made available to customers.

The firewall is deployed with all IPv4 and IPv6 traffic that is allowed, including a specific rule designed to allow the IBM Cloud internal administration network to access devices through the firewall. Denial of Service protections and most other filters are configured not to enforce.
South America Sao Paulo (br-sao) ![Checkmark icon](https://cloud.ibm.com/images/checkmark-icon.svg) 



* What targets should I use based on my compliance needs?

There are two options available depending on your compliance needs:



* If you require Financial Services Validation.
* If you required PCI, SOC2, Privacy Shield and HIPAA compliance.





 Financial Services Validated status 

If you're the account owner, you can enable your IBM Cloud® account to be Financial Services Validated, which means your account stores and manages regulated financial services information. Services that are designated as IBM Cloud for Financial Services Validated leverage the industry’s highest levels of encryption certification, provide preventive and compensatory controls for financial services regulatory workloads, multi-architecture support and proactive, and automated security. For more information on how to enable your account, see [Enabling your account to use Finantial Services Validated products](https://cloud.ibm.com/docs/account?topic=account-enabling-fs-validated).

The IBM Cloud for Financial Services Validated designation is available for services that are operating in the Dallas (us-south), Washington DC (us-east), Frankfurt (eu-de), and London (eu-gb) multizone regions A region that is spread across data centers in multiple zones to increase fault tolerance..

Use Activity Tracker Event Routing to manage auditing events in your account whe requiring Financial Services Validated status.





 PCI, SOC2, Privacy Shield and HIPAA compliance 

Activity Tracker offers ready to run event search offerings that you can use to expedite your time to greater insights. You can choose to retain your events for 7, 14, or 30 days. In addition, a 30 day HIPAA compliant offering is also available. For more information about these offerings, see [Service plans](https://cloud.ibm.com/docs/atracker?topic=atracker-service_plan).

Use Activity Tracker hosted event search offerings to manage events using a UI or to manage auditing events that are not routed by Activity Tracker Event Routing.



* What are the different options to collect and monitor auditing events in my account?