vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Figure 21. Starting URL field

You will add only one starting URL. In a real scenario, you might add multiple URLs that go to other pages with information about the same topic. By adding more URLs, you can expand the breadth of the expertise of your assistant.
4. Click Add.
5. Click the Edit icon for the URL that you just added.

Zoom

![Shows the Starting URLs field](https://cloud.ibm.com/docs-content/v1/content/f16b1f78a92498247223b337bd9303c2758b9ba8/discovery-data/images/tut-convo-web-crawl-3.png)

Figure 22. Edit starting URL
6. In the Maximum number of links to follow field, change the value to 5.

Zoom

![Shows the Starting URLs field](https://cloud.ibm.com/docs-content/v1/content/f16b1f78a92498247223b337bd9303c2758b9ba8/discovery-data/images/tut-convo-web-crawl-4.png)

Figure 23. Starting URL settings

By changing the value to 5, you indicate that you want the service to process the page that you specified plus you want it to follow up to 5 links from the starting page.
7. Click Save, and then click Finish.



The Discovery service crawls the web page that you specified starting with the page that you specified as the starting URL.

While the website is being crawled and the data indexed, let's go back to our Watson Assistant service instance. It's time to connect the action that we created to this Discovery project.





 Step 5: Add a search extension 

Let's connect your assistant to your Discovery data.



1. From the navigation panel in Watson Assistant, click Environments.

Zoom

![Shows the Environments menu item in the navigation panel.]
What are context-based restrictions? 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on a rule's criteria. The criteria include the network location of access requests, the endpoint type from where the request is sent, and sometimes the API that the request tries to access. These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Since both IAM policies and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials.

Zoom

![A diagram that shows how context-based restrictions work.](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/CBR-diagram.svg)

Figure 1. A diagram that shows how context-based restrictions work.

For an example scenario on creating context-based restrictions, follow the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).

For more information about implementing context-based restrictions in your security strategy, see the solution tutorial [Enhance cloud security by applying context-based restrictions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cbr-enhanced-security).



 Rules 

A rule associates an IBM Cloud resource with a set of contexts:



* The cloud resource is specified by resource attributes similar to IAM access policies.
* A context is a combination of network zones and endpoint types.



The contexts that you configure define the boundary for the associated resources.

The necessary resource attributes in context-based restrictions rules are accountId and serviceName. Rules must be scoped to an account and a specific service.

Context-based restriction rules are applied by the following logic:



* Access is granted by a rule only when at least one of the rule's contexts allows access.
This field indicates the IBM Cloud resource on which the action is executed.

The format of this field is a CRN. For more information, see [CRN format](https://cloud.ibm.com/docs/account?topic=account-crn).





 target.name (string) 

This field indicates the human readable name of the IBM Cloud resource on which the action is executed.

Make sure that the name of resources does not include sensitive or PII data.





 target.alias (string) 

Set this value to the alias of the cloud resource that is used in the request and on which the action is executed.

This field is optional.





 target.typeURI (string) 

This field indicates the type of the target of the event.

The format of this field is:

serviceName/objectType/attribute

Where



* servicename is the name of the service.
* objectType is the resource on which the action is run.



For example:



Table 6. target.typeURI examples

 action target.typeURI 

 cloudcerts.certificate.import cloudcerts/certificate 
 container-registry.namespace.create container-registry/namespace 
 kms.secrets.read kms/secrets 
 cloud-object-storage.instance.create cloud-object-storage/instance 
 cloud-object-storage.object-multipart.create cloud-object-storage/object/multipart 







 target.resourceGroupId (string) 

Set to the resource group CRN that is associated with the resource on which the action is requested.

This field only applies to events that are generated by services whose resources are associated with a resource group. For example, services that are global and cannot be provisioned within the context of a resource group do not include this field.





 target.host.address (string) 

This field defines the IP Address or URL of the target service.

This field is optional.







 Labels and line identifiers 

Labels and line identifiers provide information about the service that is generating the event.

The following table outlines common labels and line identifiers that you can find in events:



Table 7. labels and line identifiers
The format of this field is a CRN. For more information, see [CRN format](https://cloud.ibm.com/docs/account?topic=account-crn).





 target.name (string) 

This field indicates the human readable name of the IBM Cloud resource on which the action is executed.

Make sure that the name of resources does not include sensitive or PII data.





 target.alias (string) 

Set this value to the alias of the cloud resource that is used in the request and on which the action is executed.

This field is optional.





 target.typeURI (string) 

This field indicates the type of the target of the event.

The format of this field is:

serviceName/objectType/attribute

Where



* servicename is the name of the service.
* objectType is the resource on which the action is run.



For example:



Table 6. target.typeURI examples

 action target.typeURI 

 container-registry.namespace.create container-registry/namespace 
 kms.secrets.read kms/secrets 
 cloud-object-storage.instance.create cloud-object-storage/instance 
 cloud-object-storage.object-multipart.create cloud-object-storage/object/multipart 







 target.resourceGroupId (string) 

Set to the resource group CRN that is associated with the resource on which the action is requested.

This field only applies to events that are generated by services whose resources are associated with a resource group. For example, services that are global and cannot be provisioned within the context of a resource group do not include this field.





 target.host.address (string) 

This field defines the IP Address or URL of the target service.

This field is optional.







 Labels and line identifiers 

Labels and line identifiers provide information about the service that is generating the event.

The following table outlines common labels and line identifiers that you can find in events:



Table 7. labels and line identifiers

 Area Label Description Event field name that you can use to search 

 IBM platform-service Service that generates the event _platform
initiator.authnName (string) 

Username of the user that logs in to IBM Cloud.





 initiator.typeURI (string) 

This field defines the type of the source of the event.

Valid values are:



* service/security/account/user
* service/security/account/serviceid,
* service/security/client/certificateid
* service/security/clientid







 initiator.credential.type (string) 

This field defines the type of credential that is used by the initiator to run the action.

Valid values are:



* token
* user
* apikey
* certificate
* public-access
* hmac
* compute-resource
* instance-identity-token
* apikey-serviceid
* s2s-authorization







 initiator.host.address (string) 

This field provides information about the address where the request came from.

The format of this field is:

xxx.xxx.xxx.xxx

For example, a sample initiator.host.address is 15.234.123.12.

When the initiator of an action is an IBM Cloud service, this field is set empty.





 initiator.host.addressType (string) 

This field provides information about the type of IP address where the request came from.

Valid values are:



* IPv4
* IPv6
* CSE



The default value is IPv4.





 initiator.host.agent (string) 

This field provides information that you can use to identify where the request originated.







 logSourceCRN (string) 

This field defines the Cloud Resoiurce Name (CRN) of the resource on which the action is requested. For more information about the CRN format, see [Cloud Resource Names](https://cloud.ibm.com/docs/account?topic=account-crn).





 message (string) 

This field is set to the human-readable description of the event.

The format of this field is:

serviceName: {event description} [outcome]
* The responseData.revocationSignatureThreshold field includes the [revocation signature threshold](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptssignature-thresholds-concept) that is successfully set on the crypto unit.







 Load the new master key register 



* The requestData.masterKeyIds field lists the SHA-256 hashes of all the master key parts files that you select to load to the crypto unit.
* The responseData.verificationPattern field includes the SHA-256 hash of the master key that is composed of the selected master key parts and is loaded to the new master key register.







 Commit the new master key register 



* The requestData.verificationPattern field includes the SHA-256 hash of the master key that is loaded to the new master key register.
* The responseData.masterKeyIds field lists the SHA-256 hashes of all the master key parts files that compose the master key.







 Activate the current master key register 



* The requestData.verificationPattern field includes the SHA-256 hash of the master key that is loaded and committed to the new master key register.
* The responseData.verificationPattern field includes the SHA-256 hash of the master key that is activated.









 Certificate manager events 

The following table lists the returned values that indicate a successful certificate manager event.



Table 15. Returned values of a successful mTLS certificate manager event

 Field name Returned value 

 outcome success 
 reason.reasonCode 200 
 reason.reasonType OK 



The following common fields for certificate manager events include extra information:



* The target.id field includes the [Cloud Resource Name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn) of the event.
* The target.name field indicates the target name of the event, such as "mtlscert-admin-key" or "mtlscert-cert".
* The target.typeURI field includes the URI of the object that the action is targeting at.
* The responseData.revocationSignatureThreshold field includes the [revocation signature threshold](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-signature-thresholds-concept) that is successfully set on the crypto unit.







 Load the new master key register 



* The requestData.masterKeyIds field lists the SHA-256 hashes of all the master key parts files that you select to load to the crypto unit.
* The responseData.verificationPattern field includes the SHA-256 hash of the master key that is composed of the selected master key parts and is loaded to the new master key register.







 Commit the new master key register 



* The requestData.verificationPattern field includes the SHA-256 hash of the master key that is loaded to the new master key register.
* The responseData.masterKeyIds field lists the SHA-256 hashes of all the master key parts files that compose the master key.







 Activate the current master key register 



* The requestData.verificationPattern field includes the SHA-256 hash of the master key that is loaded and committed to the new master key register.
* The responseData.verificationPattern field includes the SHA-256 hash of the master key that is activated.









 Certificate manager events 

The following table lists the returned values that indicate a successful certificate manager event.



Table 14. Returned values of a successful mTLS certificate manager event

 Field name Returned value 

 outcome success 
 reason.reasonCode 200 
 reason.reasonType OK 



The following common fields for certificate manager events include extra information:



* The target.id field includes the [Cloud Resource Name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn) of the event.
* The target.name field indicates the target name of the event, such as "mtlscert-admin-key" or "mtlscert-cert".
* The target.typeURI field includes the URI of the object that the action is targeting at.
What are context-based restrictions? 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on a rule's criteria. The criteria include the network location of access requests, the endpoint type from where the request is sent, and sometimes the API that the request tries to access. These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Since both IAM policies and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials.

Zoom

![A diagram that shows how context-based restrictions work.](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/includes/account/includes/account/images/CBR-diagram.svg)

Figure 1. A diagram that shows how context-based restrictions work.

For an example scenario on creating context-based restrictions, follow the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).

For more information about implementing context-based restrictions in your security strategy, see the solution tutorial [Enhance cloud security by applying context-based restrictions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cbr-enhanced-security).



 Rules 

A rule associates an IBM Cloud resource with a set of contexts:



* The cloud resource is specified by resource attributes similar to IAM access policies.
* A context is a combination of network zones and endpoint types.



The contexts that you configure define the boundary for the associated resources.

The necessary resource attributes in context-based restrictions rules are accountId and serviceName. Rules must be scoped to an account and a specific service.

Context-based restriction rules are applied by the following logic:
Migration from Maximo SaaS Flex or On-Premise 



 Migration of Maximo to MAS-SaaS) 

This page covers migration of an existing Maximo application, either on the IBM Maximo EAM SaaS Flex offering or a client-managed installation to Maximo Application Suite SaaS (MAS-SaaS). This document focuses on the MAS Manage (Maximo EAM) application. There are two paths that can be followed:



1. Migration of client from the IBM Maximo EAM SaaS Flex offering
2. Migration of client from an on-premise or 3rd party Cloud provider



The steps are similar for both, but the responsibilities vary as to which team is responsible for some of the tasks. This diagram represents a high-level overview of the migration path to MAS-SaaS:

Zoom

![MAS-Migration-Steps](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas//images/MAS-Migration-Steps.png)

Figure 1. MAS Migration Steps





 Planning 

The planning stage is driven by the customer and covers the internal processes and approvals needed for the migration project. This step requires collaboration with IBM to understand the complexity of the migration, timeframes, level of effort, and personnel needed to perform the migration. In this step the customer determines if they have the necessary expertise and capacity internally to perform the migration or engage IBM GBS, IBM Expert Services or a Business Partner to perform this work.





 Pre-Conditions 

There are several preconditions that need to be met in order to migrate to the new MAS-SaaS offering:



1. A new Maximo Application Suite SaaS (MAS-SaaS) contract is in place.
2. The source version of Maximo must be v7.6.1.2 or greater. For SaaS Flex (IBM hosted) clients, the technical upgrade is performed by the IBM SRE Team as part of the SaaS Flex offering per normal upgrade procedures. For on-premise clients, the technical upgrade is the responsibility of the client or business partner.
Migration from Maximo SaaS Flex or On-Premise 



 Migration of Maximo to Dedicated (MAS-Dedicated) 

This page covers migration of an existing Maximo application, either on the IBM Maximo EAM SaaS Flex offering or a client-managed installation to Maximo Application Suite Dedicated (MAS-Dedicated). This document focuses on the MAS Manage (Maximo EAM) application. There are two paths that can be followed:



1. Migration of client from the IBM Maximo EAM SaaS Flex offering
2. Migration of client from an on-premise or 3rd party Cloud provider



The steps are similar for both, but the responsibilities vary as to which team is responsible for some of the tasks. This diagram represents a high-level overview of the migration path to MAS MS:

Zoom

![MAS-Migration-Steps](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms//images/MAS-Migration-Steps.png)

Figure 1. MAS Migration Steps





 Planning 

The planning stage is driven by the customer and covers the internal processes and approvals needed for the migration project. This step requires collaboration with IBM to understand the complexity of the migration, timeframes, level of effort, and personnel needed to perform the migration. In this step the customer determines if they have the necessary expertise and capacity internally to perform the migration or engage IBM GBS, IBM Expert Services or a Business Partner to perform this work.





 Pre-Conditions 

There are several preconditions that need to be met in order to migrate to the new MAS-Dedicated offering:



1. A new Maximo Application Suite Dedicated (MAS-Dedicated) contract is in place.
2. The source version of Maximo must be v7.6.1.2 or greater. For SaaS Flex (IBM hosted) clients, the technical upgrade is performed by the IBM SRE Team as part of the SaaS Flex offering per normal upgrade procedures. For on-premise clients, the technical upgrade is the responsibility of the client or business partner.
3.
Some common fields are available for Hyper Protect Crypto Services to use outside of the CADF event model to provide more insight into your data.



Table 13. Common fields in Activity Tracker events for Hyper Protect Crypto Services service actions

 Field Description 

 requestData.requestURI The URI of the API request that was made. 
 requestData.instanceID The unique identifier of your Hyper Protect Crypto Services service instance. 
 correlationId The unique identifier of the API request that generated the event. Note: This field is not supported in TKE events. 



For more information about the event fields in the Cloud Auditing Data Federation (CADF) event model, see [Event Fields](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-event).

While initiator.host.address is a field that is part of the Cloud Auditing Data Federation model, the host address field is not shown for requests made through private networks.





 Key action events 

Because of the sensitivity of the information about an encryption key, the event that is generated does not include detailed information about the key, such as the payload and encrypted nonce.

The responseData.keyState field is an integer and corresponds to the Pre-activation = 0, Active = 1, Suspended = 2, Deactivated = 3, and Destroyed = 5 values. For more information about key states, see [Key states and transitions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-stateskey-transitions).



 Create key 

The following fields include extra information:



* The requestData.keyType field includes the type of key that was created.
* The responseData.keyId field includes the unique identifier that is associated with the key.
* The responseData.keyVersionId field includes the unique identifier of the current key version that is used to wrap input ciphertext on wrap requests.
* The responseData.keyVersionCreationDate field includes the date that the current version of the key was created.
* The responseData.keyState field includes the integer that correlates to the state of the key.







 Delete key
initiator.authnId (string) 

ID of the user that logs in to IBM Cloud.





 initiator.authnName (string) 

Username of the user that logs in to IBM Cloud.





 initiator.typeURI (string) 

This field defines the type of the source of the event.

Valid values are:



* service/security/account/user
* service/security/account/serviceid,
* service/security/client/certificateid
* service/security/clientid







 initiator.credential.type (string) 

This field defines the type of credential that is used by the initiator to run the action.

Valid values are:



* token
* user
* apikey
* certificate
* public-access
* hmac
* compute-resource
* instance-identity-token
* apikey-serviceid
* s2s-authorization







 initiator.host.address (string) 

This field provides information about the address where the request came from.

The format of this field is:

xxx.xxx.xxx.xxx

For example, a sample initiator.host.address is 15.234.123.12.

When the initiator of an action is an IBM Cloud service, this field is set empty.





 initiator.host.addressType (string) 

This field provides information about the type of IP address where the request came from.

Valid values are:



* IPv4
* IPv6
* CSE



The default value is IPv4.





 initiator.host.agent (string) 

This field provides information that you can use to identify where the request originated.







 logSourceCRN (string) 

This field defines the Cloud Resoiurce Name (CRN) of the resource on which the action is requested. For more information about the CRN format, see [Cloud Resource Names](https://cloud.ibm.com/docs/account?topic=account-crn).





 message (string)