vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Security Bulletin: A Cyrus SASL vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2022-24407)](https://www.ibm.com/support/pages/node/6575483)
* [Security Bulletin: A vulnerability with GNU wget affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2016-4971)](https://www.ibm.com/support/pages/node/6575485)
* [Security Bulletin: A vulnerability with GNU Wget affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2018-0494)](https://www.ibm.com/support/pages/node/6575487)
* [Security Bulletin: A vulnerability in 'GNU Wget' affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2018-20483)](https://www.ibm.com/support/pages/node/6575489)
* [Security Bulletin: A vulnerability in ISC BIND affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2018-5741)](https://www.ibm.com/support/pages/node/6575493)
* [Security Bulletin: A vulnerability in Python affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2019-20916)](https://www.ibm.com/support/pages/node/6575495)
* [Security Bulletin: A vulnerability with ISC BIND affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-25214)](https://www.ibm.com/support/pages/node/6575497)
* [Security Bulletin: A vulnerability in ISC BIND affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-25215)](https://www.ibm.com/support/pages/node/6575499)
Adding compliance details 

During the onboarding process, controls that are in your readme file, formatted correctly, and supported by Security and Compliance Center appear in the controls table in your private catalog. You can click Add controls to add additional controls to your version. After you share your product or publish to your account, users can view your controls on the About page for your product.

If you want to include custom controls with your product, see [Building custom profiles](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-custom-profiles).



 Formatting controls in your readme file 

To include controls with your product's information, include them in your readme file and make sure that the controls are listed in one table. The table must include the following columns:



* A Profile column
* An ID column



You can include more columns in the readme file's control table but this information might be overwritten or excluded.



 Examples 

For examples of how you can format your controls in your readme file, see the following tables:

 Profile ID 

 NIST SC-7(3) 

 Profile Category ID Description 

 NIST [SC-7](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) SC-7(3) Limit the number of external network connections to the system. 







 Managing compliance information for your product 

After you add your controls, you must run a Code Risk Analyzer scan and add a Security and Compliance Center scan.

You must validate your version before you can run a Code Risk Analyzer scan or add a Security and Compliance Center scan.



 Running Code Risk Analyzer scan 

Scan your source code with Code Risk Analyzer to identify any security vulnerabilities that you need to address.



1. Click Run scan.
2. Wait for scan to finish.







 Adding a Security and Compliance Center scan 

To include controls with your product, you must add scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls.
Formatting controls in your readme file 

During the onboarding process, controls that are in your readme file, formatted correctly, and supported by Security and Compliance Center appear in the controls table in your private catalog. You can click Add controls to add additional controls to your version. After you publish your product, users can view your controls on the About page for your product.

If you want to include custom controls with your product, see [Building custom profiles](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-custom-profiles).



 Formatting controls in your readme file 

To include controls with your product's information, include them in your readme file and make sure that the controls are listed in one table. The table must include the following columns:



* A Profile column
* An ID column



You can include more columns in the readme file's control table but this information might be overwritten or excluded.



 Examples 

For examples of how you can format your controls in your readme file, see the following tables:

 Profile ID 

 NIST SC-7(3) 

 Profile Category ID Description 

 NIST [SC-7](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search/control?version=4.0&number=SC-7) SC-7(3) Limit the number of external network connections to the system. 







 Managing compliance information for your product 

After you add your controls, you must run a Code Risk Analyzer scan and add a Security and Compliance Center scan.

You must validate your version before you can run a Code Risk Analyzer scan or add a Security and Compliance Center scan.



 Running Code Risk Analyzer scan 

Scan your source code with Code Risk Analyzer to identify any security vulnerabilities that you need to address.



1. Click Run scan.
2. Wait for scan to finish.







 Adding a Security and Compliance Center scan 

To include controls with your product, you must add scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls.
pipeline-debug 

If this is set to 1, the pipeline will run in debug mode, and the logs will show more information. By default, it is set to 0.





 priority 

This parameter is for the promotion pull request. The priority of the change request. By default it is 'Critical | High | Moderate | Low | Plan'. You can change it to one of these values.





 purpose 

This parameter is for the promotion pull request. The reason why the change is needed. By default it is empty.





 signing-key 

This parameter is for the CI pipeline. It is a secret type parameter that holds the base64-encoded private key for signing images by using .pfx file data.





 slack-notifications 

Switch to turn on/off the Slack Integration. This is turned off by default, so the value is 0. Set to 1 to turn it on, set to 0 to turn it off.





 sonarqube 

This parameter is for all the pipelines that use static scan stages. This is an integration type parameter. If you are using your own sonarqube integration, select that integration as value. By default, this parameter is empty.





 sonarqube-namespace 

This parameter is for all the pipelines that use static scan stages. This is the configured Kubernetes namespace to use with the SonarQube instance that is created by the pipeline, you can change it to any namespace that you want to use.





 sonarqube-scan-command 

This parameter is for the pipelines that use static scan stages. sonarqube-scan-command specifies the command to start the sonarqube scan. If this parameter is not set, the default is docker run --network host -v "$SONAR_DIR":/usr/sonar_scan -v "$WORKSPACE/$path":/usr/src "$sonarqube_scanner_image" sonar-scanner -Dsonar.working.directory=/usr/sonar_scan. The default parameter uses the Docker sonar-scanner image to perform the scan.
For a reference implementation that uses Protractor as the test framework, see [hello-compliance-app](https://us-south.git.cloud.ibm.com/open-toolchain/hello-compliance-app).





 Managing ZAP Scan results 

Based on the value of the parameters opt-in-dynamic-api-scan and opt-in-dynamic-ui-scan, we can choose to selectively run either the API scan or the UI scan or both.

Inside the trigger_zap_scans file, we can trigger individual scans based on the opt-in parameters as follows.

if [ -n "$(get_env opt-in-dynamic-api-scan "")" ]; then
 start the api scan
set_env "zap-ui-scan" "false"
source "${COMMONS_PATH}"/owasp-zap/run_scan.sh
fi

if [ -n "$(get_env opt-in-dynamic-ui-scan "")" ]; then
 set for zap-ui-scans and start zap-ui-scan
set_env "zap-ui-scan" "true"
source "${COMMONS_PATH}"/owasp-zap/run_scan.sh
fi

The COMMONS_PATH refers to a location that holds the build scripts and run scripts for various tools that are a part of the DevSecOps pipeline. For more information, see [Common scripts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-common-scripts).

You can compute the success of the ZAP scan by setting an exit code based on whether the API scan or the UI scan was run. Any vulnerabilities found are also reported. This can be checked by tapping into the variables api-scan-result and ui-scan-result.

The possible values that these parameters can take are success or failure, and defaults to notRun.

ZAP_API_RESULT=$(get_env api-scan-result "notRun")
From the Validate product tab, configure your validation target, and click Next. This step applies only to Helm charts and Operators.
2. Configure your workspace, and click Next. This step applies only to Helm charts, Operators, Terraform templates, and virtual server images with Terraform.
3. Click Validate.



To monitor the progress of the validation process, click View logs.





 Managing security and compliance controls 

Controls are safeguards that are used to meet security and compliance requirements. Only controls that are supported by Security and Compliance Center, formatted correctly, and validated by Code Risk Analysis and Security and Compliance Center scans appear in the catalog. For more information, see [Formatting controls in your readme file](https://cloud.ibm.com/docs/sell?topic=sell-sell-format-controls).



1. Click Add controls.
2. Choose a profile.
3. Select the controls that you want to add to your version.
4. Click Add.
5. In the Code Risk Analyzer scan section, click Run scan.
6. Wait for the scan to finish.
7. In the Security and Compliance Center scan section, select the profile that you scanned.
8. Select the Security and Compliance Center scan.
9. Click Add scan.
10. Click Next.







 Review requirements 

You must complete validation and any other requirements to publish your product.
6. Select Platform access as Compliance Management and click Authorize.



If you are scanning Satellite resources, you must also [enable an authorization for Satellite](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-assign-rolesassign-access-sat).





 Step 2: Install the OSCO 

Before you can start evaluating your resources, the OSCO must be installed to your cluster. For help with installing it, see [the documentation](https://docs.openshift.com/container-platform/4.8/security/compliance_operator/compliance-operator-installation.html). When you deploy the OSCO, a bundle of predefined profiles is automatically installed and available for you to scan your resources with. In the next section, you select the profile that you want to use.





 Step 3: Scan your resources 

To scan your resources, you create an attachment between the resource that you want to evaluate and the profile that you want to use to run the evaluation. To create an attachment, you can use the following steps.



1. In Profiles section of the UI, select IBM Cloud Red Hat OpenShift Kubernetes OCP4. A details page opens.

Optionally, you can use the IBM Cloud Red Hat OpenShift Kubernetes OCP4 profile to create a custom profile with a subset of the controls.
2. In the Attachments tab, click Create.
3. Target your resources by selecting a Scope. Optionally, you can choose to exclude portions of your selected scope to ensure that they are not included in your scan.
4. Click Next.
5. Unless your profile contains additional controls, you can skip the Parameters tab by clicking Next.
6. Toggle Enable scan to On to ensure that the scan runs.
7. Select the frequency at which you want to evaluate your resource. Options include, Every day, Every 7 days, and Every 30 days.
8. Optionally, you can enable notifications.
9. Click Next. Review your selections and click Create.







 Next steps
ibmcloud doi testrecord-publish --logicalappname="$MY_APP_NAME" --buildnumber="$MY_BUILD_NUMBER" --filelocation ./coverage/coverage-summary.json --type code
Show more

The command supports the following type values:



Table 1. Test record types

 Type Description 

 unittest Unit test results 
 fvt Functional verification test results 
 code Code coverage results 
 sonarqube SonarQube scan results 
 staticsecurityscan Static security scan results from IBM Application Security on Cloud 
 dynamicsecurityscan Dynamic security scan results from IBM Application Security on Cloud 



Test records must provide data in one of the following supported formats:



Table 2. Supported formats

 Test Type Supported Formats 

 Functional verification test Mocha, xUnit, Karma/Mocha 
 Unit test Mocha, xUnit, Karma/Mocha 
 Code coverage Cobertura, lcov, JaCoCo 
 Static AppScan Static App Scans that are provided by IBM Application Security on Cloud 
 Dynamic AppScan Dynamic App Scans that are provided by IBM Application Security on Cloud 
 SonarQube Scan data that is provided by SonarQube scans 







 Viewing test results 

When your CI/CD tool runs, it publishes the test result data to DevOps Insights. To view the test result data in DevOps Insights, go to the Quality Dashboard page. For more information, see [DevOps data aggregation](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-devops-data-aggregation).





 Next steps 

[Evaluate gates](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-evaluate-gates-cicd) by using other CI/CD tools.
ibmcloud-api-key String API Key to deploy ZAP on a cluster. Required if not running in DinD, that is, zap-dind is set to false. 
 iam-token-endpoint String The endpoint to retrieve the token for IAM authentication. Defaults to https://iam.cloud.ibm.com/identity/token Optional, but if provided, target-api-key must also be provided. 
 target-api-key String API Key for IAM authentication. Optional, but if provided, iam-token-endpoint must also be provided. 
 target-application-server-url String The base URL of the application server for zap to scan. It can be the same as the URL of the deployed application. Required 
 filter-options String Set it to filter out alerts based on severity. Possible values: Critical, High, Medium, Low, Informational. Defaults to Informational, can be a comma-separated list. Optional 
 zap-ui-scan String Flag to determine whether the scan is the UI scan or the API scan. Possible values: true, false. Setting this flag to true runs the UI scan, setting it to false runs the API scan. This parameter works with opt-in-dynamic-api-scan and opt-in-dynamic-ui-scan parameters. Required 
 zap_dind String Flag to switch between deploying ZAP to a cluster or running DinD. Default: true. Possible values: true, false. Setting it to true runs ZAP as DinD, setting it to false deploys ZAP to a cluster for which cluster-name, ibmcloud-api, and ibmcloud-api-key must be set. Optional 
 zap-dind-localhost String Hostname for ZAP Scanners when running in DinD, default: localhost. Optional 
 zap-namespace String Namespace to deploy ZAP API and UI scanners in the cluster, default: zap. Optional for running ZAP in cluster, Not required for ZAP running in DinD.
For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. Select the profile that you scanned.
2. Select the Security and Compliance Center scan.
3. Click Add scan.
4. Click Next.









 Review requirements 

You must complete validation and any other requirements to publish your bundle.





 Next steps 

Go to Partner Center and submit your request to [publish your Operator bundle](https://cloud.ibm.com/docs/sell?topic=sell-bundle-publish) to the IBM Cloud catalog.
sonarqube-scan-command specifies the command to start the sonarqube scan. If this parameter is not set, the default is docker run --network host -v "$SONAR_DIR":/usr/sonar_scan -v "$WORKSPACE/$path":/usr/src "$sonarqube_scanner_image" sonar-scanner -Dsonar.working.directory=/usr/sonar_scan. The default parameter uses the Docker sonar-scanner image to perform the scan.

For a Maven Java project, set this parameter to mvn -Dmaven.repo.local="${WORKSPACE}/.m2" -Dsonar.login="$(cat /tmp/sonarqube-token)" -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.projectKey="$SONAR_PROJECT_KEY" -Dsonar.projectName="$SONAR_PROJECT_KEY" -Dsonar.working.directory="$SONAR_DIR" sonar:sonar to use the Maven computed classpath for sonar scan.





 source-environment 

The source environment that the app is promoted from, which is the source inventory branch of the promotion. The default value is master. This value can be overwritten with the usage of a webhook trigger by adding the source-environment property to the payload.





 static-scan-retry-count 

This parameter is for any static scan that you want to run in a pipeline. These scans use API calls, which can take a short time to work. Therefore, retry these calls if needed. You can change the times of retries with this parameter. By default, this parameter is set to 30.





 static-scan-retry-sleep 

This parameter is for any static scan that you want to run in a pipeline. These scans use API calls, which can take a short time to work. Therefore, retry these calls if needed. You can change the amount of seconds to wait with this parameter. By default, this parameter is set to 10.





 summary-retry-attempts 

Use a retry method to upload the evidence summary to make sure it is successful.
You don't need to add those stages inline to the pipeline, and you don't need to modify the pipeline. For triggering the stage, a webhook trigger is created with a webhook secret. Know more about [Triggering a stage by using async sub pipelines](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-async-sub-pipelines).



Zoom

![CC pipeline triggers](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-cc-toolchain-explore-triggers.png)

Figure 15. DevSecOps Continuous Compliance pipeline triggers



 Update the app URL to run dynamic scan 

To run dynamic scan on the target environment, we need to provide application URL to the CC pipeline.

Dynamic scan might run some tests that are intrusive in nature. It is recommended to use a staging environment to run dynamic scan. So, provide the application URL that is running in the staging environment.

To get the application URL:



* Go to a successful CI pipeline run
* Go to stage deploy-dev
* Click the task run stage
* Under Logs look for App URL



A sample app URL looks like this:

Zoom

![Sample application URL from CI Pipeline](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-cc-toolchain-explore-app-url.png)

Figure 16. Sample application URL from CI Pipeline

We need to supply this application URL to the CC pipeline. It can be achieved by:



* Go to the CC pipeline from the newly created CC toolchain tiles
* Click Environment Properties
Configuring Mend Unified Agent scans 

The Mend script runs the Mend Unified Agent dependency scan in your DevSecOps pipeline and collects evidence based on the scan results.

The Mend Unified Agent dependency scan runs for each source repository in your pipeline that is returned by the list_repos method. For more information, see [list_repos](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-pipelinectllist_repos).

The script searches for an existing configuration file in the root of each source repository that is scanned. For more information, see [Unified Agent Configuration Parameters](https://docs.mend.io/bundle/unified_agent/page/unified_agent_configuration_parameters.html). If the configuration file is not found, a default configuration file is created for each pipeline run at execution time but is not persisted in the source code repository. If the configuration file is found, the script passes that configuration file when the scan is performed. The pipeline overrides the apiKey and userKey properties in the configuration file at execution time with the values of the mend-org-token and mend-user-key pipeline environment properties.

Install all of the build dependencies required for your source repositories to build before you run the script to ensure that the Mend Unified Agent dependency scan returns accurate results.



 Running the script 

You must use save_repo to have at least one source repository registered in pipelinectl.



 Required Mend Unified Agent parameters 



Table 1. Required Mend Unified Agent parameters

 Parameter name Description 

 mend-server-url The base URL of the Mend server. 
 mend-org-token The identifier of the organization. Use the org token returned by the onboarding request in the Org Token text field. 
 mend-user-key A secret Product ServiceUser that is created after ServiceNow onboarding. 
 mend-product-name Use the product name that is returned by the onboarding request in the Product Name on Mend text field. 
 mend-product-token Use the product token that is returned by the onboarding request in the Product Token text field
Options include every day, every 7 days, and every 30 days. Additionally, you can now pause your scans if you need to.
7. Optional: Configure notifications.



1. If you want to receive notifications, toggle Notify me to On.
2. By default, when notifications are enabled, you are alerted when 15% or more of your controls fail in a single scan. You can change this by adjusting the Threshold percentage.

For example, if you have a profile with 100 controls and you want to be notified if 5 of them fail, you would select 5% as your threshold.
3. Select specific controls that you want to be notified about.

If there are high priority controls that pertain specifically to your job role, you might want to be notified every time they fail. You can identify up to 15 controls per scan that you can receive individual notifications for. These notifications are sent regardless of whether the threshold identified in the previous step has been met.



1. Click Select control.
2. Select the controls that you want to be notified about by checking the box next to the control.
3. Click Ok.





8. Review your choices and click Create.



When you create your attachment, a scan is scheduled. When the scan completes, your results are available in the Security and Compliance Center dashboard.





 Next steps 

While you wait for your scan to complete, learn more about [the way the service works](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-posture-management) or try [creating your own rule](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-rules-define).