vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To ensure your Security and Compliance Center features are functioning correctly, you must add Security and Compliance Center as a service reference in network zones for rules that target Cloud Object Storage. You must use the same process for rules that target Event Notifications.

Context-based restrictions are available only for the updated architecture.

Context-based restrictions protect only the actions associated with the [Security and Compliance Center API](https://cloud.ibm.com/apidocs/security-compliance/posture-v2.0). Actions that are associated with the following platform APIs are not protected by context-based restrictions. Reference the API docs for the specific action IDs.



* [Resource Instance APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-instances)
* [Resource Keys APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-keys)
* [Resource Bindings APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-bindings)
* [Resource Aliases APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-aliases)
* [IAM Policy APIs](https://cloud.ibm.com/apidocs/iam-policy-managementlist-policies)
* [Global Search APIs](https://cloud.ibm.com/apidocs/search)
* [Global Tagging Attach](https://cloud.ibm.com/apidocs/taggingattach-tag) and [Detach](https://cloud.ibm.com/apidocs/taggingdetach-tag) APIs
* [Context-based Restriction Rule APIs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule)
* [Secrets Manager APIs](https://cloud.ibm.com/apidocs/secrets-manager)







 Creating network zones 

A network zone represents an allowlist of IP addresses where an access request is created.
1.0.197 18 Nov 2020 Adds the --endpoint option to the [ibmcloud oc cluster config command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_cluster_config) to use the Link endpoint URL for the cluster context. 
 1.0.178 06 Oct 2020 <br><br>1. Adds http-tunnel as a supported source or destination protocol in the ibmcloud sat endpoint create and ibmcloud sat endpoint update commands.<br>2. Updates the Go version to 1.15.2.<br>3. Updates the help text in various languages.<br><br><br>
For more information on how to use exclusion rules, see [Excluding data by using exclusion rules](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-exclusion_rules), [Configuring conditional streaming](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-streaming-conditional) and [Configuring usage quota exclusion rules](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-control_usage_quotasrules_usage_quota). 







 Change management 



Table 2. Responsibilities for change management

 Task IBM Responsibilities Your Responsibilities 

 Updates to Activity Tracker Provide major, minor, and patch version updates for IBM Cloud Activity Tracker interfaces. <br>Document changes in the [Release notes](https://docs.mezmo.com/changelog) N/A 
 Track versions of custom views, dashboards, screens, parsing templates, and alerts for Activity Tracker N/A Use your own change management process to control versions of metadata resources such as views, dashboards, screens, parsing templates, and alerts`. <br>To learn how to export metadata, see [Export the configuration of resources in an auditing instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-reuse_resource_definitionsrrd_export_config). 







 Identity and access management 



Table 3. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 Manage permissions for Activity Tracker Provide the ability to restrict access to resources. <br>IBM is responsible for the security and compliance of IBM Cloud Activity Tracker. Restrict access to resources by using Cloud IAM access policies by defining IAM policies to control which users within your account have access to the data. <br>[Learn more about controlling access through IAM](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam). 







 Security and regulation compliance 



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities
[Learn more about usage quotas](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-control_usage_quotas).





 4 October 2021 

API for archiving
: Documentation of API changes supporting archiving is generally available. [Learn more about the archiving API](https://cloud.ibm.com/apidocs/log-analysisget-v1-config-archiving).





 30 September 2021 

API for data streaming
: Documentation of API changes supporting data streaming is generally available. [Learn more about the streaming API](https://cloud.ibm.com/apidocs/log-analysispost-v1-config-stream).





 31 August 2021 

Support to stream data is generally available
: Streaming data from an IBM Log Analysis instance to other corporate tools such as Security Information and Event Management (SIEM) tools is generally available. [Learn more about streaming](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-streaming).





 2 July 2021 

Support to stream data is available in beta
: New beta feature that is released in US-South and Frankfurt to stream data from an IBM Log Analysis instance to other corporate tools such as Security Information and Event Management (SIEM) tools. [Learn more about streaming](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-streaming).





 31 March 2021 

New CLI support
: New CLI added that can be used to list instances and export data from an instance. [Learn more about the CLI](https://cloud.ibm.com/docs/log-analysis?topic=logdna-cli-plugin-logdna-cli).

New API support
: New API added that can be used to export data from an instance, and manage views and alerts. [Learn more about the API](https://cloud.ibm.com/apidocs/logdna?code=pythonintroduction).





 31 January 2021 

Changes to archiving frequency
About IBM Cloud Juniper vSRX 

The IBM Cloud® Juniper vSRX provides performance, ease of configuration, and maintenance advantages with the simplicity of running on a bare metal server. The hardware is sized to handle the routing and security load associated with multiple VLANs, and it can be ordered with redundant network links and redundant RAID arrays. All vSRX features are customer-managed.

The IBM Cloud® Juniper vSRX is offered in two different modes: standalone mode or High Availability (HA) cluster.

Additional documentation for IBM Cloud® Juniper vSRX can be found in [Supplemental vSRX documentation](https://cloud.ibm.com/docs/vsrx?topic=vsrx-supplemental-ibm-cloud-juniper-vsrx-documentation).



 Firewall 

The vSRX deploys to protect your environment from external and internal threats by filtering private- and public-facing traffic. Customers can manage the vSRX themselves by defining policies and rules that allow or deny (among other actions) inbound or outbound network traffic, thereby protecting their applications from internal and external approaches. Both IPv4 and IPv6 stacks are supported in a stateful manner.





 Virtual private network (VPN) gateway 

Connect your on-site data center or office to the IBM Cloud using VPN tunneling by provisioning your vSRX as a network gateway device. You can use an IPsec site-to-site VPN tunnel for secure communication from your enterprise data center or office to your IBM Cloud network. Remote access IPsec VPN also is supported.

For a detailed configuration guide on VPN, refer to the links provided in [Working with VPN](https://cloud.ibm.com/docs/vsrx?topic=vsrx-working-with-vpnworking-with-vpn).





 Network address translation (NAT) 

With the vSRX gateway appliance, you can provision application and database servers without public network interfaces, and still allow your servers access to the internet using source NAT. For enhanced security, you can protect your servers behind the gateway device, using destination NAT.





 Enterprise-grade routing
Deployment values 

When you install the WebSphere products, select the parameter values for deployment.



 Parameters for Passport Advantage entitlement 

ibm_id
: This offer is Bring Your Own License. To deploy this offer, you must enter your registered IBMid and your IBMid must have active WebSphere entitlements associated with it. You can check your entitlements at [Passport Advantage Online for customers](https://www.ibm.com/software/passportadvantage/pao_customer.html).

ibm_id_password
: IBMid password.





 Parameters for Virtual Private Cloud (VPC) setup 

Region
: The region and zone where the VPC is created, such as us-south-1 or us-east-2. For the latest list of IBM Cloud regions, see the [Virtual Private Cloud (VPC) documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-in-a-different-regionget-zones).

vpc_name
: The unique name for this VPC. The name must start with a lowercase letter, use only lowercase alphanumeric characters and hyphens (without spaces), and cannot end with a hyphen. This offer creates a ([VPC](https://cloud.ibm.com/vpc-ext/network/vpcs)) and one or more [virtual server instances (VSIs)](https://cloud.ibm.com/vpc-ext/compute/vs)) where WebSphere is installed."

vpc_sshkey_name
: The name of the SSH key in your IBM Cloud account. Use this key to [SSH log in to VSIs](https://cloud.ibm.com/vpc-ext/compute/sshKeys). Make sure SSH key exists in the same region where VPC is created.





 Required parameters for WebSphere Application Server 

deploy_was_topology
: The topology to install. Specify a supported topology, WAS.Base or WAS.Cell.

vsi_os_admin_password
About the VRA 

The IBM Cloud® Virtual Router Appliance (VRA) provides the latest Vyatta 5600 operating system for x86 bare metal servers. It is offered as a High Availability (HA) or stand-alone configuration.

The IBM Cloud® Virtual Router Appliance allows you to route private and public network traffic selectively, through a full-featured enterprise router that has firewall, traffic shaping, policy-based routing, VPN, and other features. The VRA offers performance with ease of configuration. It has the maintenance advantages of running on a normal hardware server. The VRA hardware appliance is sized to handle the routing load for multiple VLANs, and it can be ordered with redundant network links and redundant RAID arrays. All VRA features are managed by you, the customer.

Alternatives: The FortiGate Security Appliance (FSA) 10 Gbps is a single-tenant (dedicated), high-throughput (10 Gbps) hardware firewall with next-generation features, such as AntiVirus (AV), Intrusion Prevention (IPS), and web filtering. It might be an alternative to VRA for achieving similar goals. For more information, see the [FSA documentation](https://cloud.ibm.com/docs/fortigate-10g?topic=fortigate-10g-getting-started).



 Firewall 

To protect your environment from external threats, the IBM Cloud® Virtual Router Appliance can be leveraged as a firewall. You can add firewall rules to allow or deny inbound or outbound network traffic to the ports on which your application runs, and you can filter the traffic within your own networks. The IBM Cloud® Virtual Router Appliance also can be configured to perform stateful IPv4 and IPv6 filtering to protect your critical data.





 Virtual Private Network (VPN) gateway 

Connect your on-site data center or office to the IBM Cloud using VPN tunneling by provisioning your IBM Cloud® Virtual Router Appliance as a network gateway device. You can use an IPsec site-to-site VPN tunnel for secure communication from your enterprise data center or office to your IBM Cloud network.
* UI
* Terraform







 Automating SAP NetWeaver 7.x and SAP HANA 3-tier distributed architecture on IBM Cloud® VPC with Terraform and Ansible 

Terraform on IBM Cloud® enables predictable and consistent provisioning of IBM Cloud Virtual Private Cloud (VPC) infrastructure resources so that you can rapidly build complex, cloud environments. IBM Cloud VPC infrastructure consists of SAP certified hardware that uses Intel Xeon CPUs and additional Intel technologies.

You can use Terraform scripts to create a single-tier VPC and create the SAP and SAP HANA infrastructure on the VPC. The Terraform scripts use the VPC information that you provide and then call the Ansible playbook to create the SAP architecture on the specified VPC.

You have two deployment methods to choose from:



* Terraform scripts run from the CLI on your bastion server
* Schematics user interface accessed from the menu on your cloud dashboard.



You can create either:



* SAP NetWeaver 7.x on SAP HANA based ABAP stack
* SAP NetWeaver 7.x on SAP HANA based JAVA stack





 SAP Solution implemented 

Numerous SAP enterprise solutions are built on SAP’s pervasive platform, SAP NetWeaver, including:



* SAP HANA as Primary Persistence for SAP NetWeaver-Based Applications
* SAP Business Suite applications (ERP, CRM, and SCM, and other applications),
* SAP Business Warehouse (BW), and
* Other SAP enterprise solutions



SAP NetWeaver has two distinct aspects, ABAP and Java. Many applications that are built on SAP NetWeaver’s ABAP or Java (or both) application servers can run “on” SAP HANA. In this instance, SAP HANA serves as the sole database in the architecture.

Technical interfaces are available for applications that are built on SAP NetWeaver AS ABAP and AS Java to run on SAP HANA. However, specific development enablement is normally required for each application to ensure it runs optimally on SAP HANA. SAP Business Suite applications (ERP, CRM, SCM, and other applications), SAP Business Warehouse (BW), and other SAP NetWeaver-based applications were modified to run on SAP HANA and use its many advantages.
Planning your deployment 

Having arrived at this section you are already familiar with the fundamental components and options that are provided by IBM Cloud Virtual Private Cloud (VPC) Infrastructure for SAP. Before starting with the deployment of servers, please make sure, that you have read the important information in the Get Started section.



  The 'Must-Reads' before starting deployment 

To ensure your first deployment is a success, we recommend to read:



*  [IBM Cloud® VPC Infrastructure environment introduction](https://cloud.ibm.com/docs/sap?topic=sap-vpc-env-introduction)
*  The Plan your SAP workloads topic group
*  The Infrastructure for SAP design considerations topic group - especially the chapter [Sample storage configurations on VPC Infrastructure](https://cloud.ibm.com/docs/sap?topic=sap-vpc-env-introductionvpc-env-storage)





  Other useful documents 

See the respective topics in the Get Started section for:



*  [SAP HANA design considerations for High Availability and Disaster Recovery (HA/DR)](https://cloud.ibm.com/docs/sap?topic=sap-hana-design-considerationshana-ha)
*  [SAP HANA backups - Storage impacts on Recovery Time Objective (RTO)](https://cloud.ibm.com/docs/sap?topic=sap-storage-design-considerationsstorage-performance-backup-rto)
*  [SAP NetWeaver design considerations for High Availability configuration](https://cloud.ibm.com/docs/sap?topic=sap-netweaver-design-considerationsnetweaver-ha)
Rule Associated controls Update 

 Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to RDP port AC-4(0), CM-7(a), CM-7(b), SC-7(a), SC-7(b), SC-7(4)(a), and SC-7(5)(0) The rule was removed. 
 Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to SSH port AC-4(0), CM-7(a), CM-7(b), SC-7(a), SC-7(b), and SC-7(4)(a) The rule was removed. 
 Check whether a security group other than the default for Virtual Private Cloud is attached to all endpoints SC-7(b), and SC-7(c) The rule was added. 
 Check whether OpenShift version is up-to-date CP-7(a) The rule was removed. 
 Check whether permissions for API key creation are limited and configured in IAM settings for the account owner SC-12(0) The rule was removed. 
 Check that Hyper Protect Crypto Services has failover units in at least 2 different regions that are Financial Services Validated SI-12(0) The rule was removed. 
 Check whether App ID customer-provided email service is used CM-6(a) The rule was removed. 
 Check whether Container Registry image pushes and pulls take place only over private endpoints SA-3(a) and SA-3(d) The rule was removed. 
 Check whether App ID email verification is enabled for Cloud Directory users CM-6(a) The rule was removed.
The Virtual Private Cloud API reference includes an Authorization section for each API call, for example, [Create an instance](https://cloud.ibm.com/apidocs/vpc/latestcreate-instance).





 Assigning access to VPC Infrastructure Services in the console 

You have two common ways to assign access in the console:



* Access policies per user. You can manage access policies per user from the Manage > Access (IAM) > Users page in the console. For more information about the steps to assign IAM access, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources&interface=uiaccess-resources-console).
* Access groups. Access groups are used to streamline access management by assigning access to a group once, then you can add or remove users as needed from the group to control their access. You manage access groups and their access from the Manage > Access (IAM) > Access groups page in the console. For more information, see [Assigning access to a group in the console](https://cloud.ibm.com/docs/account?topic=account-groups&interface=uiaccess_ag).







 Assigning access to VPC Infrastructure Services in the CLI 

For step-by-step instructions for assigning, removing, and reviewing access, see [Assigning access ro resources by using the CLI](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources&interface=cliaccess-resources-cli).

The following example shows a command for assigning the Viewer role for VPC Infrastructure Services:

Use is for the service name. Also, use quotations around role names that are more than one word as shown in the example here.

ibmcloud iam user-policy-create USER@EXAMPLE.COM --service-name is --roles "Viewer"





 Assigning access to VPC Infrastructure Services by using the API
This virtual server instance hosts optional NFS server, NTP forwarder, DNS forwarder, and LDAP server. If you have already some of these services in your environment that are accessible from Power Systems Virtual Server networks, then you can use them and do not need to install here. Execute following steps to deploy host for private services.

By the using the following setup, we open ports for standard widely used management components: NFS service provided by Linux distributions, NTP service over 'chrony', DNS service over 'bind' and open LDAP. If you use another software solutions or custom configurations, set up might vary.



1. Create a security group for private services. For more information, see [Configuring the security group for the instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consoleconfiguring-the-security-group). Specify following rules:

Inbound security group rules

Outbound security group rules



Table 9. Overview of the inbound security group rules for the workload services host

 Protocol Source type Source Value Rule's purpose 

 ALL CIDR Block 10.0.0.0/8 n/a address block of IBM Cloud VPC and Power Systems Virtual Server management subnets 
 ALL CIDR Block 161.26.0.0/16 n/a address block of OS registration servers 
 UDP CIDR Block 0.0.0.0/0 Port 53-53 DNS 



2. Create an ACL to restrict the access to the Workload VPC's subnets.

Inbound ACL rules

Outbound ACL rules



Table 11. Overview of the inbound ACL rules for the workload services host

 Rule priority Allow or deny Protocol Source Destination Value Rule's purpose 

 1 Allow ALL 161.0.0.0/8 10.0.0.0/8 n/a address block of OS registration servers 
 2 Allow UDP Any IP, ports 53-53 10.0.0.0/8, any port n/a DNS
The Virtual private endpoint gateways for VPC page appears.
2. Click Create to go to the provisioning page.
3. In the Details section, enter values for the following fields:



* Name - Type a unique name for your endpoint gateway.
* Resource group - Select a resource group for the endpoint gateway. You can use the default group for this endpoint gateway, or choose from the list. For more information, see [Best practices for organizing resources in a resource group](https://cloud.ibm.com/docs/account?topic=account-account_setup).
* Tags - Optionally, add tags to organize, track usage costs, or manage access to your resources.
* Access management tags - Optionally, add access management tags to resources to help organize access control relationships. The only supported format for access management tags is key:value. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).
* Virtual private cloud - Select a VPC from the available list where you need the VPE IP address. The systems provides you with a list of IBM services that you can access within the region of the VPC network to associate with the endpoint gateway. If the target service is outside the VPC's region, you can change it for an updated list of services.



If the intended service or service instance does not appear, revalidate your IAM permissions. You can also choose to allocate a reserved IP address to bind to the gateway, or specify a VPC subnet to allocate a reserved IP address for binding to the gateway.
4. In the Security groups section, select the checkboxes of the security groups that you want to attach from the security group table. You can then manage these security groups and tighten their security rules for inbound traffic towards your endpoint gateways.

When you create an endpoint gateway without specifying a security group, the VPC default security group is attached to the endpoint gateway.
Ordering Direct Link Connect for Power Systems Virtual Servers 

Use [IBM Cloud® Direct Link (2.0) Connect](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl) to configure your private network with Power® Systems Virtual Server. The Direct Link (2.0) Connect service creates a seamless connection that allows access to IBM Cloud resources from your Power Systems Virtual Server instance.

Direct Link (2.0) Connect provides the following advantages:



* Support for connections to multiple IBM Cloud accounts from a single direct link.
* Support for multiple VPCs (without classic access) from a single direct link within the same account.





 Before you begin 

Before you order Direct Link Connect, make sure that you review the following considerations and have satisfied any prerequisites:



* Verify that your IBM Cloud account has the correct authorizations to order the Direct Link (2.0) Connect service.
* Review [Direct Link prerequisites](https://cloud.ibm.com/docs/dl?topic=dl-ibm-cloud-dl-prerequisites). Also, review [Routing considerations](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-ordering-direct-link-connectrouting-considerations), and [Setting up high availability](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-ordering-direct-link-connectha-availability), as needed for your particular deployment.
* IBM Cloud highly recommends that you establish a second, diverse direct link to prevent outages, whether unplanned, or planned due to maintenance.
* A 10 Gbps connection is available only using the Direct Link (2.0) Connect offering.
* Direct Link (2.0) Connect is available in all current locations.
* Currently, there isn't a migration path from Direct Link on Classic (1.0) to Direct Link (2.0). You must order a new Direct Link (2.0) Connect connection.







 Pricing