vania-janet/multiturn-rag-retrieval-data huggingface dataset:
CM-6 - Configuration Settings 



 Control requirements 

The organization:

CM-6 (a)
: Establishes and documents configuration settings for information technology products employed within the information system using [IBM Assignment: see CM-6 (a) Additional Requirements and Guidance] that reflect the most restrictive mode consistent with operational requirements;

CM-6 (b)
: Implements the configuration settings;

CM-6 (c)
: Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

CM-6 (d)
: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.





 Additional IBM Cloud for Financial Services specifications 



* Usage and configuration changes made to Virtual Machine Monitors (VMM) and hypervisors must be documented and maintained for customer review.
* NIST SP 800-125A Security Recommendations for Server-based Hypervisor Platforms should be consulted for additional guidance.







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Compliance monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for CM-6 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 CM-6 (a) <br><br> * Check whether App ID customer-provided email service is used<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether App ID email verification is enabled for Cloud Directory users<br><br><br>
cis_page_rule](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_page_rule)<br> * [ibm_cis_range_app](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_range_app)<br> * [ibm_cis_rate_limit](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_rate_limit)<br> * [ibm_cis_routing](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_routing)<br> * [ibm_cis_tls_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_tls_settings)<br> * [ibm_cis_waf_group](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_waf_group)<br> * [ibm_cis_waf_package](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_waf_package)<br> * [ibm_cis_waf_rule](
When you use this configuration, a secondary load balancer is automatically provisioned and deployed in an active-active fashion for better availability. See [Scenario 2 - deploying in multiple zones with IBM Cloud Internet Services](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ha-3-tiermulti-zone-cis).
2. IBM Cloud® Internet Services is a global load balancer that acts as a public load balancer only. Typically, it is deployed for global applications across multiple regions. Cloud Internet Services (CIS) is geo-aware and steers the traffic to the zone that is closest to the requester.
3. IBM Cloud® DNS Services is a global load balancer that acts as a private load balancer within IBM Cloud. IBM Cloud® DNS Services provides Virtual Private Cloud (VPC) users with private DNS zones that are resolvable only on IBM Cloud. Only explicitly permitted networks can access the private DNS zones.



In [Scenario 2 - deploying in multiple zones with IBM Cloud Internet Services](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ha-3-tiermulti-zone-cis), Cloud Internet Services (CIS) distributes traffic between zones. Cloud Internet Services (CIS) allows you to create multiple server pools and origins to allow a 1:N type of deployment – one application to multiple server pools and origins. One application that is deployed across multiple server pools is helpful for DevOps management.





 Storage 

Storage can be a virtual server with block volumes or IBM Cloud® Object Storage. If your application requires lower latency and higher IOPs, use a virtual server with block volumes. You need a 3rd-party tool to provide replication or snapshots. For unstructured data and high data volumes, use Object Storage. The IBM Cloud Object Storage service has different tiers where replication varies such as within a zone, across multiple zones, or across regions. The replication is not instantaneous, but occurs over time.





 Security 

IBM Cloud provides both security groups and firewall access control lists (ACL).
Managing zones 

In IBM Cloud® Security and Compliance Center Workload Protection, a zone is a collection of scopes that represent important areas of your business. For example, a zone might be your production environment or staging environment. You can also define zones as various regions.

Two zones are provided by default:

Entire infrastructure
: This zone includes all connected data sources. CIS policies and Workload Protection Kubernetes policies are automatically applied to this zone. Findings are reported on the [Compliance page.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-compliance)

To apply other policies, apply them to individual zones.

Entire Git
: If you configured integrations with your Git repositories, then Entire Git zone includes those source repositories.

You can create targeted zones for specific data sources or Git repositories as needed.



 Creating and configuring zones 

A zone is consisted of:



* The name of the zone.
* The description of the zone.
* The scope of the zone.
* Any applied policies.



To configure a zone, do the following steps:



1. Open the [Workload Protection UI](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-launch).
2. Hover over the Policies icon ![Policies icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/policies.png) and click Zones in the Posture section.
3. Click New Zone.
4. Enter a Name and Description for your zone and click Create.

If necessary, you can update the Name and Description on the next page.
5. Click Add Scope and select the scope rules for each platform.

Scope rules for supported platforms are:

Kubernetes
Allowable values are: iam_credentials, public_cert, private_cert.





 Examples 

ibmcloud secrets-manager config --secret-type=iam_credentials







 ibmcloud secrets-manager config-element-create 

Add a configuration element to the specified secret type.

Use this method to define the configurations that are required to enable the public certificates (public_cert) and private certificates (private_cert) engines.

You can add multiple configurations for your instance as follows:



* Up to 10 public certificate authority configurations
* Up to 10 DNS provider configurations
* Up to 10 private root certificate authority configurations
* Up to 10 private intermediate certificate authority configurations
* Up to 10 certificate templates.



ibmcloud secrets-manager config-element-create --secret-type SECRET-TYPE --config-element CONFIG-ELEMENT --name NAME --type TYPE --config CONFIG



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: public_cert, private_cert.

--config-element (string)
: The configuration element to define or manage. Required.

Allowable values are: certificate_authorities, dns_providers, root_certificate_authorities, intermediate_certificate_authorities, certificate_templates.

--name (string)
: The human-readable name to assign to your configuration. Required.

The maximum length is 256 characters. The minimum length is 2 characters.

--type (string)
: The type of configuration. Value options differ depending on the config_element property that you want to define. Required.

Allowable values are: letsencrypt, letsencrypt-stage, cis, classic_infrastructure, root_certificate_authority, intermediate_certificate_authority, certificate_template. The maximum length is 128 characters. The minimum length is 2 characters.
ibmcloud secrets-manager config-element-update 

Update a configuration element that is associated with the specified secret type.

ibmcloud secrets-manager config-element-update --secret-type SECRET-TYPE --config-element CONFIG-ELEMENT --config-name CONFIG-NAME --type TYPE --config CONFIG



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: public_cert, private_cert.

--config-element (string)
: The configuration element to define or manage. Required.

Allowable values are: certificate_authorities, dns_providers, root_certificate_authorities, intermediate_certificate_authorities, certificate_templates.

--config-name (string)
: The name of your configuration. Required.

--type (string)
: The type of configuration. Value options differ depending on the config_element property that you want to define. Required.

Allowable values are: letsencrypt, letsencrypt-stage, cis, classic_infrastructure, root_certificate_authority, intermediate_certificate_authority, certificate_template. The maximum length is 128 characters. The minimum length is 2 characters.

--config (generic map)
: Properties that describe a configuration, which depends on type. Required.





 Examples 

ibmcloud secrets-manager config-element-update --secret-type=public_cert --config-element=certificate_authorities --config-name=exampleString --type=cis --config='{"anyKey": "anyValue"}'







 ibmcloud secrets-manager config-element-action 

Invoke an action on a specified configuration element. This method supports the following actions:



* sign_intermediate: Sign an intermediate certificate authority.
* sign_csr: Sign a certificate signing request.
* set_signed: Set a signed intermediate certificate authority.
Update the correct keystore filename and password in your connector configuration.



The following example represents a configured SSL Connector block.

<Connector port="443" maxHttpHeaderSize="8192" maxThreads="150"
minSpareThreads="25" maxSpareThreads="75" enableLookups="false"
disableUploadTimeout="true" acceptCount="100" scheme="https"
secure="true" SSLEnabled="true" clientAuth="false" sslProtocol="TLS"
keyAlias="server" keystoreFile="/home/user_name/your_site_name.jks"
keystorePass="your_keystore_password" />

If your Tomcat version is prior to Tomcat 7, change keystorePass to keypass.
5. Save your server.xml file.
6. Restart Tomcat.







 Microsoft Internet Information Services (IIS) 7.0 



1. Create a CSR in IIS Manager and export it as .pem. The IIS Manager is located under Administrative Tools.
2. Order a CIS origin certificate using your CSR.
3. Copy the origin certificate to the desktop of your server.
4. Open IIS Manager and select your server's hostname under Connections.
5. Select Server Certificates from the IIS section in the center menu.
6. Select the action Complete Certificate Request from the Actions menu. On the Specify Certificate Authority Response page under File name containing the certification authority's response, click ... to browse to the .cer certificate file that was copied to the desktop, select the file, and click Open.
7. Enter a friendly name for the certificate. The friendly name identifies the certificate.
8. Select OK to finish the certificate installation to your server.
9. Bind the certificate to your website. Select your website by expanding Sites under your server's name in the menu under Connections in the IIS Manager.
Enable / disable tiered caching PATCH /v1/{crn}/zones/{domain_id}/routing/tiered_caching internet-svcs.performance.update internet-svcs.tiered-caching.update 







 Page Rules 



Table 13. Page Rules

 Action Method IAM ACTION AT ACTION 

 Get page rules GET /v1/{crn}/zones/{domain_id}/pagerules internet-svcs.performance.read internet-svcs.pagerules.read 
 Create a page rule POST /v1/{crn}/zones/{domain_id}/pagerules internet-svcs.performance.manage internet-svcs.pagerules.create 
 Update a page rule PUT /v1/{crn}/zones/{domain_id}/pagerules/{rule_id} internet-svcs.performance.update internet-svcs.pagerules.update 
 Delete a page rule DELETE /v1/{crn}/zones/{domain_id}/pagerules/{rule_id} internet-svcs.performance.manage internet-svcs.pagerules.delete 







 TLS 



Table 14. TLS

 Action Method IAM ACTION AT ACTION 

 Get universal SSL setting GET /v1/{crn}/zones/{domain_id}/ssl/universal/settings internet-svcs.security.read internet-svcs.universal-ssl-setting.read 
 Update universal SSL setting PATCH /v1/{crn}/zones/{domain_id}/ssl/universal/settings internet-svcs.security.update internet-svcs.universal-ssl-setting.update 
 Get edge certificates ordered from CIS GET /v1/{crn}/zones/{domain_id}/ssl/certificate_packs internet-svcs.security.read internet-svcs.certificate-packs.read 
 Order an edge certificate POST /v1/{crn}/zones/{domain_id}/ssl/certificate_packs internet-svcs.security.manage internet-svcs.certificate-packs.create
Edge functions use cases 

The following use cases are provided solely as examples, and are not intended for exact duplication in your environment.

Exercise caution when testing any of the following code, because it might cause a disruption in service.



 A/B testing 

You can create a CIS Edge function to control A/B tests.

addEventListener('fetch', event => {
event.respondWith(fetchAndApply(event.request))
})

async function fetchAndApply(request) {
const name = 'experiment-0'
let group // 'control' or 'test', set below
let isNew = false // is the group newly-assigned?

// Determine which group this request is in.
const cookie = request.headers.get('Cookie')
if (cookie && cookie.includes(${name}=control)) {
group = 'control'
} else if (cookie && cookie.includes(${name}=test)) {
group = 'test'
} else {
// 50/50 Split
group = Math.random() < 0.5 ? 'control' : 'test'
isNew = true
}

// We'll prefix the request path with the experiment name. This way,
// the origin server merely has to have two copies of the site under
// top-level directories named "control" and "test".
let url = new URL(request.url)
// Note that url.pathname always begins with a /, so we don't
// need to explicitly add one after ${group}.
url.pathname = /${group}${url.pathname}

const modifiedRequest = new Request(url, {
method: request.method,
headers: request.headers
})

const response = await fetch(modifiedRequest)

if (isNew) {
// The experiment was newly-assigned, so add a Set-Cookie header
// to the response.
Set the Name to the hostname that you want to expose for the application. The application's FQDN becomes <name>.<CIS domain>.
5. Set the Edge port to the appropriate value. For HTTPS traffic, set the edge port to 443.
6. Select an appropriate value for Edge IP connectivity.
7. Set the Origin to Load balancer.



1. Set Load balancer to the name of the global load balancer created in the previous step.
2. Set the Port to the port that is exposed by the global load balancer.



8. You can enable IP firewall if you want to restrict the IP ranges that can connect to the service. If IP filtering is not needed, disable IP firewall.
9. TLS Termination must be set to off to prevent the TLS connection from being terminated in CIS.
10. Leave TLS mode greyed out.
11. Set Proxy protocol to Off.



You can use the following curl command to verify that the combination of the Range Application and Global Load Balancer is working correctly.

$ curl -v https://<Range application name>.<domain>/<path>

The verbose output from the curl command shows the signer of the SSL certificate where TLS is being terminated. The signer should be the signer of the application's SSL certificate. If the signer of the certificate includes "Cloudflare", then CIS is incorrectly terminating the TLS connection. Check that the Global Load Balancer's Proxy is configured to Off and that the TLS encryption mode is set to End-to-End CA Flexible.

When the edge application is working, it is important to prevent users from using the global load balancer directly. This is especially important to prevent a DDoS attack against the global load balancer. To prevent users from accessing the global load balancer directly, create a policy within BIG-IP that allows traffic to pass that specifies the FQDN of the Range application only.





 Step 5: Enable license modules on the BIG-IP 



1. Under System > License, click the Module Allocation tab.
2.
Before you target a private endpoint for CIS:



1. Ensure that your IBM Cloud infrastructure account is enabled for [virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf).

When you enable VRF, a separate routing table is created for your account, and connections to and from your account's resources are routed separately on the IBM Cloud network. To learn more about VRF technology, see [Virtual routing and forwarding on IBM Cloud](https://cloud.ibm.com/docs/dl?topic=dl-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud).

Enabling VRF permanently alters networking for your account. Be sure that you understand the impact to your account and resources. After you enable VRF, it cannot be disabled.
2. Ensure that your IBM Cloud infrastructure account is enabled for [service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint).

After you enable VRF and service endpoints for your account, all existing and future CIS resources and instances become available from both the public and private endpoints.







 Using the CLI 



 Step 1. Configure the IBM Cloud private network on your virtual server 

Prepare your virtual server instance or test machine by configuring your routing table for the IBM Cloud private network.



1. To route traffic to the IBM Cloud private network, run the following command on your virtual server instance:

route add -net 166.9.0.0/16 gw <gateway> dev <gateway_interface>

Replace <gateway> (for example, 10.x.x.x) and <gateway_interface> (for example, eth10) with the appropriate values.
2. Optional: Verify that the route was added successfully by displaying your new routing table.

route -n







 Step 2. Target the CIS private endpoint
Cache using the CIS Cache API. This example can also cache POST requests.

const someOtherHostname = "my.herokuapp.com"

async function handleRequest(event) {
const request = event.request
const cacheUrl = new URL(request.url)

// Hostname for a different zone
cacheUrl.hostname = someOtherHostname

const cacheKey = new Request(cacheUrl.toString(), request)
const cache = caches.default

// Get this request from this zone's cache
let response = await cache.match(cacheKey)

if (!response) {
//If not in cache, get it from origin
response = await fetch(request)

// Must use Response constructor to inherit all of response's fields
response = new Response(response.body, response)

// Cache API respects Cache-Control headers. Setting max-age to 10
// will limit the response to be in cache for 10 seconds max
response.headers.append("Cache-Control", "max-age=10")

// Store the fetched response as cacheKey
// Use waitUntil so computational expensive tasks don"t delay the response
event.waitUntil(cache.put(cacheKey, response.clone()))
}
return response
}

async function sha256(message) {
// encode as UTF-8
const msgBuffer = new TextEncoder().encode(message)

// hash the message
const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer)

// convert ArrayBuffer to Array
const hashArray = Array.from(new Uint8Array(hashBuffer))

// convert bytes to hex string
const hashHex = hashArray.map(b => ("00" + b.toString(16)).slice(-2)).join("")
curl -X PUT https://api.cis.cloud.ibm.com/v1/:crn/alerting/destinations/webhooks/:webhook_id -H 'content-type: application/json' -H 'x-auth-user-token: Bearer xxxxxx' -d '{"name":"Example Webhook","url":"https://hooks.slack.com/services/Ds3fdBFbV/456464Gdd"}'





 Deleting alerts using the API 

To delete an email alert, run the following command:

curl -X DELETE https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies/:policy_id -H 'content-type: application/json' -H 'accept: application/json' -H 'x-auth-user-token: Bearer xxxxxx'

To delete a webhook, use the following DELETE request:

curl -X DELETE https://api.cis.cloud.ibm.com/v1/:crn/alerting/destinations/webhooks/:webhook_id -H 'content-type: application/json' -H 'accept: application/json' -H 'x-auth-user-token: Bearer xxxxxx'
ca = ibm_sm_public_certificate_configuration_ca_lets_encrypt.my_lets_encrypt_config.name
dns = ibm_sm_public_certificate_configuration_dns_cis.my_cis_dns_config.name
rotation {
auto_rotate = true
rotate_keys = false
}
}







 Ordering public certificates with your own DNS provider in the UI 

To create a public certificate by using a manual DNS provider in the UI, complete the following steps.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets table, click Add.
4. Click the Order public certificate tile.
5. Add a name and description to easily identify your certificate.
6. Select the

secret groupthat you want to assign to the secret.

Don't have a secret group? In the Secret group field, you can click Create to provide a name and a description for a new group. Your secret is added to the new group automatically. For more information about secret groups, check out [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups).
7. Optional: Add labels to help you to search for similar secrets in your instance.
8. Optional: Add metadata to your secret or to a specific version of your secret.



1. Upload a file or enter the metadata and the version metadata in JSON format.



9. Click Next.
10. Select a certificate authority configuration.

The configuration that you select determines the certificate authority to use for signing and issuing the certificate.
Select Online as the Deployment type, provide iris_deployment as the name and then click Create.
8. Under Deployments tab, once the status changes to Deployed, Click on the Name of the new web service to check the details.





 Test the deployed model 



1. Under Test tab of your deployment, click on JSON input icon next to Enter input data and provide the JSONbelow as input.

{
"input_data": [{
"fields": "sepal_length", "sepal_width", "petal_length", "petal_width"],
"values":
5.1,3.5,1.4,0.2], 3.2,1.2,5.2,1.7]
]
}]
}
2. Click Predict and you should see the Prediction results in table and JSON view.
3. You can change the input data and continue testing your model.









 Step 5: Try out the API 

Along with the UI, you can also do predictions using the API scoring endpoint by exposing the deployed model as an API to be accessed from your applications.



1. Under API reference tab of the deployment, you can see the Endpoint under Direct link and code snippets in various programming languages.
2. Copy the Endpoint in a notepad for future reference.
3. In a browser, launch the [IBM Cloud Shell](https://cloud.ibm.com/shell) and export the scoring End-point to be used in subsequent requests. Make sure you don't close this window/tab..

export SCORING_ENDPOINT='<SCORING_ENDPOINT_FROM_ABOVE_STEP>'

IBM Cloud Shell is a cloud-based shell workspace that you can access through your browser. It's preconfigured with the full IBM Cloud CLI and tons of plug-ins and tools that you can use to manage apps, resources, and infrastructure.
4. To use the Watson Machine Learning REST API, you need to obtain an IBM Cloud Identity and Access Management (IAM) token. Run the below command