vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Security group rule Create, Update, Delete Editor for the security group 
 Security group target View, List Viewer for the security group 
 Security group target Attach, Detach Operator for the security group<br><br>Editor for instance if the target is a network interface<br><br>Editor for load balancer if the target is a load balancer 
 ———————— ————————— ———————— 
 Snapshots View, List Viewer for snapshots 
 Snapshots Create Editor for creating snapshots 
 Snapshots Update, Delete Editor for updating and deleting snapshots 
 ———————— ————————— ———————— 
 SSH key Create Editor for SSH Key for VPC resources 
 SSH key Update, Delete Editor for the SSH key 
 SSH key View, List Viewer for the SSH key 
 ———————— ————————— ———————— 
 Subnet Create Editor for Subnet resources<br><br>Operator for the VPC and the public gateway, if it is to be associated<br><br>Viewer for the ACL 
 Subnet Update Editor for the subnet<br><br>Operator for the public gateway, if it is associated<br><br>Viewer for the ACL 
 Subnet Delete Editor for the subnet 
 Subnet View, List Viewer for the subnet 
 Subnet's ACL Attach, Detach Editor for the subnet<br><br>Viewer for the ACL 
 Subnet's ACL View, List Viewer for the subnet and ACL 
 Subnet's public gateway Attach, Detach Editor for the subnet<br><br>Operator for the public gateway 
 Subnet's public gateway View, List Viewer for the subnet and public gateway 
 Subnet's route Create, Update, Delete Editor for VPC routes 
 Subnet's route View, List Viewer of VPC routes 
 ———————— ————————— ————————
"port_max": 22
}'





 Step 3: Delete the security group (optional) 

To clean up the security group, it cannot be associated with any network interfaces, and it cannot be referenced by a rule in a different security group.

curl -X DELETE "$vpc_api_endpoint/v1/security_groups/$sg?version=$api_version&generation=2" -H "Authorization: $iam_token"

For more information on setting up your security group by using the API, see [Security groups](https://cloud.ibm.com/apidocs/vpc/latestlist-security-groups).
You can choose to send control plane logs to a file, user terminal, routing platform console, or remote machine. To generate control plane logs, use the syslog statement at the system hierarchy level.





 Data plane logs 

The data plane logs (also called security logs) primarily include security events that are handled inside the data plane. Security logs can be in text or binary format, and can be saved locally (event mode), or sent to an external server (stream mode). Binary format is required for stream mode and recommended to conserve log space in event mode.

Junos OS supports the forwarding of logs using stream mode and event mode. All categories can be configured for sending specific category logs to different log servers for stream-mode log forwarding.

Always use stream mode to save CPU resources. This is critical for other operations, such as internode communication within Highly Available (HA) or RPD operations.

Stream-mode log forwarding includes the following steps:



* The data plane generates an RTLOG system log message and sends it out from the packet forwarding engine.
* A PFE process generates an RTLOG system log message and sends it out from the packet forwarding engine.
* The routing engine unified threat management (UTMD) process generates an RTLOG system log message, and the routing engine sends it out using the RTLOGD process.



For stream-mode log forwarding, the transport protocol used between the packet forwarding engine and the log server can be UDP, TCP, or TLS. These transport protocols are configurable. The transport protocol used between the routing engine and the log server can only be UDP.

The following sample configuration provides an example of configuring a data plane log using stream mode.

set security log mode stream
set security log source-address 172.168.0.3
set security log stream S1 format syslog
set security log stream S1 category all
set security log stream S1 host 1.1.1.1







 Redundant system log server 

Security system logging traffic intended for remote servers is sent through the network interface ports, which support two simultaneous system log destinations. You must configure each system logging destination separately.
Security patches 

The IBM® Private Network uses dedicated services (Microsoft Server Update Services and Red Hat Network) for security updates. Upon delivery, all Bare Metal Servers are set, by default, to automatically update for security patches.
EXISTING Security group, previously created by the user in the same VPC. The list of available Security Groups: https://cloud.ibm.com/vpc-ext/network/securityGroups
 Example: SECURITY_GROUP = "ic4sap-securitygroup"

RESOURCE_GROUP = "wes-automation"
 EXISTING Resource group, previously created by the user. The list of available Resource Groups: https://cloud.ibm.com/account/resource-groups
 Example: RESOURCE_GROUP = "wes-automation"

SUBNET = "ic4sap-subnet"
 EXISTING Subnet in the same region and zone as the VSI, previously created by the user. The list of available Subnets: https://cloud.ibm.com/vpc-ext/network/subnets
 Example: SUBNET = "ic4sap-subnet"

SSH_KEYS = [ "r010-57bfc315-f9e5-46bf-bf61-d87a24a9ce7a", "r010-3fcd9fe7-d4a7-41ce-8bb3-d96e936b2c7e" ]
 List of SSH Keys UUIDs that are allowed to SSH as root to the VSI. The SSH Keys should be created for the same region as the VSI. The list of available SSH Keys UUIDs: https://cloud.ibm.com/vpc-ext/compute/sshKeys
 Example: SSH_KEYS = ["r010-8f72b994-c17f-4500-af8f-d05680374t3c", "r011-8f72v884-c17f-4500-af8f-d05900374t3c"]


 File Shares variables:


share_profile = "tier-5iops"
 Enter the IOPs (IOPS per GB) tier for File Share storage. Valid values are 3, 5, and 10.

 File shares sizes:
usrsap-as1 = "20"
JP-TOK ingest.jp-tok.security-compliance-secure.cloud.ibm.com 165.192.84.14 <br>128.168.75.14 <br>169.56.51.238 TCP 6443 
 US-EAST ingest.us-east.security-compliance-secure.cloud.ibm.com 169.60.112.74 <br>169.55.109.114 <br>169.62.3.82 TCP 6443 
 AU-SYD ingest.au-syd.security-compliance-secure.cloud.ibm.com 135.90.73.100 <br>130.198.80.155 <br>168.1.213.78 TCP 6443 
 CA-TOR ingest.ca-tor.security-compliance-secure.cloud.ibm.com 163.74.69.186 <br>158.85.94.130 <br>163.75.65.237 TCP 6443 
 BR-SAO ingest.br-sao.security-compliance-secure.cloud.ibm.com 163.107.66.98 <br>163.109.67.242 <br>169.57.141.43 TCP 6443 









 Subnets for webhook notifications from IBM Cloud Security and Compliance Center Workload Protection 

To receive alert notifications by using webhooks from the IBM Cloud Security and Compliance Center Workload Protection service, you may need to define firewall rules for the subnets that are invoking your webhooks.



Table 6. Source Subnets for Webhook notifications from IBM Cloud Security and Compliance Center Workload Protection

 Region Alert Notification Source Subnets
Managing security groups 

You can manage security groups by using the Security Groups page, or the Device Details page in the IBM Cloud® console.



 Managing security groups from the Security Groups page 

To manage security groups from the Security Groups page, complete the following steps:



1. From the [IBM Cloud console](https://cloud.ibm.com/), click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure to view the Classic Infrastructure landing page.
2. From the Classic Infrastructure menu, select Security > Network Security > Security Groups to view the Security Groups page.
3. On the Security Groups page, you can complete several management tasks.



* View a list of security groups.
* Create a group.
* Edit group information.
* Duplicate a group.
* Delete a group.









 Managing security group rules from the Security Groups page 

To manage security group rules from the Security Groups page, complete the following steps:



1. From the [IBM Cloud console](https://cloud.ibm.com/), click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure to get to the Classic Infrastructure landing page.
2. From the Classic Infrastructure menu, select Security > Network Security > Security Groups to get to the Security Groups page.
3. On the Security Groups page, click on a security group name to open the Details page.
4. On the Security Group Details page, you can complete several management tasks.



* View a list of rules that are defined for the security group.
* Create new rules.
* Edit a rule.
* Delete a rule.
* View the virtual server instances and the associated interfaces that are assigned to the security group.





If you delete the last rule in a security group, then inbound and outbound traffic is not allowed by this security group.





 Managing security groups from the Device Details page
ibmcloud is security-group GROUP [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* GROUP: ID or name of the security group.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is security-group-create 

Create a security group.

ibmcloud is security-group-create GROUP_NAME VPC [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is security-group-create my-sg 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3
* ibmcloud is security-group-create my-sg my-vpc
* ibmcloud is security-group-create my-sg 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --resource-group-id fee82deba12e4c0fb69c3b09d1f12345
* ibmcloud is security-group-create my-sg 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --resource-group-name Default
* ibmcloud is security-group-create my-sg 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --output JSON







 Command options 



* GROUP_NAME: Name of the security group.
* VPC: ID or name of the VPC.
* --resource-group-id: ID of the resource group.
If you provisioned a new security group for the VLAN interface e.g. with a name 'your-security-group', use can use following commands:

VMWARE_VM_FIP_SG=$(ic is bm-nic $ESX1 $VMWARE_VNIC_VM1 --output json | jq -r '.security_groups[] | select(.name == "your-security-group")'.id)

ibmcloud is sg-rulec $VMWARE_VM_FIP_SG inbound tcp --port-min <your_port_number> --port-max <your_port_number> --remote <add_your_IP_here>
* The <jmp_security_group_name> is the required name for the security group, such as sgjump.
* The sgid captures the security group ID for use in subsequent commands.
* The myip captures the external IP address of your laptop.
* The inbound rule allows TCP port 3389 to ingress from a known internet IP address.
* The outbound rule allows any protocol to egress to any IP address.
* When the jump server VSI is ordered, it is ordered attached to the security group.



export sgname=<jmp_security_group_name>
ibmcloud sl securitygroup create --name $sgname --description "Allow RDP from known external IP address"
export sgid=$(ibmcloud sl securitygroup list --output json | jq -r '.[] | select (.name==env.sgn) | .id')
export myip=$(curl -s ifconfig.me)
ibmcloud sl securitygroup rule-add $sgid --remote-ip $myip --direction ingress --port-max 3389 --port-min 3389 --protocol tcp
ibmcloud sl securitygroup rule-add $sgid --remote-ip 0.0.0.0/0 --direction egress
ibmcloud sl securitygroup rule-list $sgid





 Ordering a public VSI 

The jump server host is a small Microsoft Windows 2019 public VSI:



* The ibmcloud sl vlan list and ibmcloud sl subnet list need to be run first so that the IDs of the public and private VLANs and the primary subnets are captured for use in the ordering process.
* The <js_hostname> is the required hostname for the jump server, such as winjs01.
* The <root_domain> the required domain name, such as the matching root-domain name of your vCenter Server instance.
* The Linux® server is ordered with 2 vCPU and 4 GB RAM.
* The <dc_code> is the code for the data center in which the VSI is provisioned into, such as DAL10.
Creating security groups and rules 

You can create an IBM Cloud® security group and its associated rules and then assign it to the interfaces of one or more virtual server instances to enable a virtual firewall.



 Creating a security group 

To create a security group, complete the following steps:



1. From the [IBM Cloud console](https://cloud.ibm.com/), click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure to get to the Classic Infrastructure landing page.
2. From the Classic Infrastructure menu, select Security > Network Security > Security Groups to get to the Security Groups page.
3. On the Security Groups page, click the Create group + button.
4. Enter a name and description for the security group and click Create group.



Create group with a default rule to allow all outbound traffic is selected by default. You can clear this field to create the security group with no rules. A security group with no rules blocks all traffic (both inbound and outbound).





 Creating security group rules 

To create a security group rule, complete the following steps:



1. From the [IBM Cloud console](https://cloud.ibm.com/), click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure to get to the Classic Infrastructure landing page.
2. From the Classic Infrastructure menu, select Security > Network Security > Security Groups to get to the Security Groups page.
3. On the Security Groups page, click a security group name to open the Details page and click the Create rule + button.
4. On the Create Rule page, enter all appropriate attributes (such as direction, IP type, protocol, and source/destination information). When finished, click OK.



Selecting the optional source or destination fields restrict the new rule so it only applies to traffic to/from the specified source/destination.
Assigning instances to the security group 

You can assign IBM Cloud® security group objects to instances in one of two ways.



  Next step 

[Edit the security group](https://cloud.ibm.com/docs/security-groups?topic=security-groups-editing-a-security-group) to modify its parameters.
To take advantage of the dynamic routing and scaling features provided by the framework, Data Security Broker also advises customers to deploy Data Security Broker components in a Kubernetes or Red Hat OpenShift environment.

Data Security Broker suggests maintaining a standby Data Security Broker Manager instance with regular metadata synchronization for organizations that needs to shorten the time it takes to restore access to a Data Security Broker Manager instance.





 Deploying Data Security Broker Shields for High Availability 

Data Security Broker recommends deploying in Kubernetes or OpenShift clusters for use cases that demand high availability. You can find details on the Data Security Broker Shields deployments in Kubernetes or Red Hat OpenShift environment.





 Deploy across regions 

Every Data Security Broker Shields is typically deployed in a cluster as its own pod. It is not necessary for the Shield to have a constant connection to Data Security Broker Manager. To retrieve the configuration and data security policy information and to update configuration or policies, the Shields are needed to communicate with Data Security Broker Manager during initial registration. This helps to deploy the Data Security Broker Shields with little to no network proximity requirements.

As a result, Data Security Broker Shields must be installed in Kubernetes or Red Hat OpenShift clusters across a number of different geographical areas for a deployment that aims to achieve maximum availability. One active Data Security Broker Manager can still control every Shield deployed across all of the different regions as shown in Figure 2.

Zoom

![High availability deployment architecture](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/HA_arch.svg)

Figure 2: High availability deployment architecture of Data Security Broker

For applications in each region, one or more load balancers must be set up with routing rules that direct traffic to the shield connection with the lowest latency.





 Horizontal Pod Autoscaling (HPA) Configuration 

Data Security Broker advises using horizontal pod scaling for each cluster to increase service availability within the cluster. Data Security Broker Shield's deployment cluster's HorizontalAutoscaler (HPA) feature can be used to configure horizontal scaling.
SI-6 - Security Function Verification 



  Control requirements 

The information system:

SI-6 (a)
:   Verifies the correct operation of [Assignment: organization-defined security functions];

SI-6 (b)
:   Performs this verification [IBM Assignment: to include upon system startup and/or restart and at least monthly];

SI-6 (c)
:   Notifies [IBM Assignment: to include system administrators and security personnel] of failed security verification tests; and

SI-6 (d)
:   [Selection (one or more): shuts the information system down; restarts the information system; [IBM Assignment: to include notification of system administrators and security personnel]] when anomalies are discovered.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Compliance monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance)







  NIST supplemental guidance 

Transitional states for information systems include, for example, system startup, restart, shutdown, and abort. Notifications provided by information systems include, for example, electronic alerts to system administrators, messages to local computer consoles, and/or hardware indications such as lights.
* UI
* CLI
* API







 Updating a VPC's default security group rules 

The default security group is similar to any other security group, with the exception that it cannot be deleted.

Each VPC has a default security group, with rules to allow:



* Inbound traffic from all members of the group (that is, all other resources that are attached to this security group)
* All outbound traffic



You can modify the rules of the default security group by using the UI, CLI, or API.

If you edit the rules of the default security group, those edited rules then apply to all current and future servers in the group.

Inbound rules to allow pinging and SSH are not automatically added to the default security group.



 Updating the default security group in the UI 



1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login).
2. Select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg), then click VPC Infrastructure.
3. Click Security groups.
4. In the Security groups list, click the name of the default security group that you want to update.
5. On the default security group's details page, click the Rules tab.
6. Modify the rules as necessary:



* To edit a rule, click the Actions menu ![Actions menu](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/overflow.png), click Edit, make your changes, then click Save.
* To delete a rule, click the Actions menu !
r006-222aa2aa-2a2a-2a22-2222-a222aaa2a22a kube-a111a11a11aa1aa11a11 4 0 my-vpc default
r006-333aa3aa-3a3a-3a33-3333-a333aaa3a33a kube-r006-111a11aa-aaa1-1a1a-aa11-1a1a111aa11 4 0 my-vpc default
3. Get the details of a security group. Find the Rules section in the output to view the inbound and outbound rules attached to the security group.

ibmcloud is sg <security-group-name>

Example output.

...
Rules
ID Direction IP version Protocol Remote
r006-111bb1bb-1b1b-1b11-1111-b111bbb1b11b outbound ipv4 all 0.0.0.0/0
r006-222bb2bb-2b2b-2b22-2222-b222bbb2b22b inbound ipv4 all behind-unbuilt-guidable-anthill
r006-333bb3bb-3b3b-3b33-3333-b333bbb3b33b inbound ipv4 icmp Type=8 0.0.0.0/0
r006-444bb4bb-4b4b-4b44-4444-b444bbb4b44b inbound ipv4 tcp Ports:Min=22,Max=22 0.0.0.0/0







 Viewing the default VPC security groups in the UI 



1. From the [Security groups for VPC dashboard](https://cloud.ibm.com/vpc-ext/network/securityGroups), find the security groups that are attached to the VPC that your cluster is in. The VPC cluster security group is named in the format of kube-<cluster-ID>.
PS-7 - Third-party Personnel Security 



  Control requirements 

The organization:

PS-7 (a)
:   Establishes personnel security requirements including security roles and responsibilities for third-party providers;

PS-7 (b)
:   Requires third-party providers to comply with personnel security policies and procedures established by the organization;

PS-7 (c)
:   Documents personnel security requirements;

PS-7 (d)
:   Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [IBM Assignment: same day]; and

PS-7 (e)
:   Monitors provider compliance.





  NIST supplemental guidance 

Third-party providers include, for example, service bureaus, contractors, and other organizations providing information system development, information technology services, outsourced applications, and network and security management. Organizations explicitly include personnel security requirements in acquisition-related documents. Third-party providers may have personnel working at organizational facilities with credentials, badges, or information system privileges issued by organizations. Notifications of third-party personnel changes ensure appropriate termination of privileges and credentials. Organizations define the transfers and terminations deemed reportable by security-related characteristics that include, for example, functions, roles, and nature of credentials/privileges associated with individuals transferred or terminated.
Establish a Network Trust Link (NTL) 

A Network Trust Link (NTL) is a secure channel for the Hardware Security Module (HSM) and the client to communicate. NTLs use certificates in both directions to authenticate and encrypt data transmitted between HSM server partitions and clients.

Be advised that the trust link requires TCP port 1792 to be accessible in both the NTLS and NTLA (bi-directional) protocols to guarantee all processes and utilities work correctly.

To establish your NTL, perform the following procedure:



1. Navigate to the directory /var/safenet/safenet/lunaclient/bin and create the certificate using the VTL utility.

root@IBMADC690867-s6dr cd /var/safenet/safenet/lunaclient/bin
root@IBMADC690867-s6dr vtl createcert -n 10.121.229.224
Private Key created and written to: /var/safenet/safenet/lunaclient/cert/client/10.121.229.224Key.pem
Certificate created and written to: /var/safenet/safenet/lunaclient/cert/client/10.121.229.224.pem

The identifier used for the client certificate is the private IP assigned to it. This will later be used and referenced by the HSM.
2. Transfer the certificate file to the HSM server using SCP:

root@IBMADC690867-s6dr scp /var/safenet/safenet/lunaclient/cert/client/	10.121.229.224.pem hsm_admin@10.121.229.201:

The authenticity of host '10.121.229.201 (10.121.229.201)' can't be established.

ECDSA key fingerprint is SHA256:UBltOfaDojRlUVxDXh6zI3CPMF8FRaJnls0uxeWgrCY.

Are you sure you want to continue connecting (yes/no)? yes