vania-janet/multiturn-rag-retrieval-data huggingface dataset:
2. Enter a name, <glb_name>, under Name for the Global Load Balancer. This name will also be part of your universal application URL (http://<glb_name>.<your_domain_name>), regardless of the location.
3. Under Geo routes, click Add route



1. Select Default from the Region drop down
2. Select the pool All
3. Click Add



Repeat the process to create the following:



List of Geo routes to create

 Region Origin Pool 

 Default All 
 Western Europe UK 
 Eastern Europe UK 
 Northeast Asia UK 
 Southeast Asia UK 
 Western North America US 
 Eastern North America US 



With this configuration, users in Europe and in Asia will be redirected to the cluster in London, users in US to the Dallas cluster. When a request does not match any of the defined route, it will be redirected to the All origin pool.
4. Click Create



At this stage, you have successfully configured a Global Load Balancer with Kubernetes clusters across multiple locations. You can access the GLB URL http://<glb_name>.<your_domain_name>/hostname to view your application. Based on your location, you are redirected to the closest cluster or a cluster from the default pool if CIS was not able to map your IP address to a specific location.







 Step 4: Secure the application 



 Turn the Web Application Firewall On 

The Web Application Firewall(WAF) protects your web application against ISO Layer 7 attacks. Usually, it is combined with grouped rule-sets, these rule-sets aim to protect against vulnerabilities in the application by filtering out malicious traffic.



1. In the IBM Cloud Internet Services dashboard, navigate to Security, then on the WAF.
2. Ensure the WAF is On.
3. Click OWASP Rule Set. From this page, you can review the OWASP Core Rule Set and individually enable or disable rules. When a rule is enabled, if an incoming request triggers the rule, the global threat score will be increased.
This name is not used externally, but is referenced by the Range application.
6. Set values for TTL and Traffic steering that are appropriate for your application.
7. Click Create.
8. Configure an [origin pool](https://cloud.ibm.com/docs/cis?topic=cis-glb-features-pools) for the new load balancer that contains the BIG-IP endpoints.
9. Configure appropriate [health checks](https://cloud.ibm.com/docs/cis?topic=cis-glb-features-healthchecks).



You can use the following curl command to verify that the global load balancer is working correctly.

$ curl -v https://<global load balancer name>.<domain>/<path>

The verbose output from the curl command shows the signer of the SSL certificate that is terminating TLS. The signer should be the SSL certificate that is within the BIG-IP. If the signer of the certificate includes Cloudflare, then CIS is incorrectly terminating the TLS connection. Check that the global load balancer's Proxy is turned off and that the TLS encryption mode is set to End-to-End CA Flexible.





 Step 4: Configure CIS Range Application 

DDoS protection in CIS is enabled by using a Range application. The Range application becomes the application's front end and sets the FQDN for the service.



1. Go to Security > Range.
2. Click Create.
3. Select TCP as the Type. This enables pass-through without terminating TLS.
4. Set the Name to the hostname that you want to expose for the application. The application's FQDN becomes <name>.<CIS domain>.
5. Set the Edge port to the appropriate value. For HTTPS traffic, set the edge port to 443.
6. Select an appropriate value for Edge IP connectivity.
7. Set the Origin to Load balancer.



1.
Customizing error pages 

Cloud Internet Services (CIS) has a wide range of error codes that allow us to differentiate specific problems. By default, these error pages mention Cloudflare; however, you can customize and brand these error pages. Having custom error pages allows you to provide a consistent experience for your users, even in the event of a page load error.

There are two groups of customizable error pages:

Challenges



* Basic security
* Web Application Firewall
* IP Firewall (Country block, Country challenge, IP (range) block)



CIS errors



* 502, 504, and CF 52X errors
* 10XX errors
* Errors related to Serve Stale Content



500, 501, 503, and 505 responses do not trigger custom error pages to avoid breaking specific API endpoints and other web applications. Custom error pages should be reserved for cases where the origin server cannot return a response for the request (520-526 errors).



 Custom error template 

The following example is a basic custom error template. When creating your custom error templates, note that the maximum page size is 1.5 MB and the page cannot be blank. Additionally, all external resources are inlined using base64 encoding, making them approximately 50% larger when published.

<html>
<head></head>
<body>
::[REPLACE WITH TOKEN NAME]::
</body>
</html>





 Available custom error tokens 

Some types of custom error pages must include one of these tokens anywhere within the HTML of the custom error page. Only one page-specific token can be present per error page, so if you want to customize every error, you must create one custom error page for each error containing the respective token.



Table 1. Page types and their tokens

 Page Type Token 

 All pages ::CLIENT_IP:: 
 All pages ::RAY_ID:: 
 Basic Security (CAPTCHA Challenge) ::CAPTCHA_BOX:: 
 WAF (CAPTCHA Challenge) ::CAPTCHA_BOX:: 
 Country Challenge (CAPTCHA Challenge) ::CAPTCHA_BOX::
[IBM Cloud® Internet Services (CIS)](https://cloud.ibm.com/docs/cis?topic=cis-getting-started) internet-svcs [Global events](https://cloud.ibm.com/docs/cis?topic=cis-at_events) 







 Observability services 

The following table lists observability services that send auditing events:



Table 8. List of observability services

 Service CRN service name Events 

 [IBM Cloud® Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started) atracker [Location-based events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events). 







 Platform services 

The following table lists platform services that send auditing events:



Table 9. List of platform services

 Service CRN service name Events 

 [Billing](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uibilling-acct-mgmt) billing [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_acc_mgt_account) 
 [User management](https://cloud.ibm.com/docs/account?topic=account-iamuserinv) user-management [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_acc_mgt_users) 
 [Provisioning](https://cloud.ibm.com/docs/account?topic=account-manage_resource) provisioning [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_rcat_events_rc)
Rules for CM-6 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 CM-6 (a) <br><br> * Check whether App ID customer-provided email service is used<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether App ID email verification is enabled for Cloud Directory users<br><br><br> 
 CM-6 (b) <br><br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br><br><br> 
 CM-6 (c) <br><br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 
 CM-6 (d) <br><br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 







 NIST supplemental guidance 

Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the information system that affect the security posture and/or functionality of the system. Information technology products for which security-related configuration settings can be defined include, for example, mainframe computers, servers (e.g., database, electronic mail, authentication, web, proxy, file, domain name), workstations, input/output devices (e.g., scanners, copiers, and printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications.
If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-update-ratelimit-options" "> --><-- <section "id="section-update-ratelimit-examples" "> --> Examples Update rate limiting rule for domain 31984fea73a15b45779fa0df4ef62f9b. ibmcloud cis ratelimit-rule-update 31984fea73a15b45779fa0df4ef62f9b 372e67954025e0ba6aaa6d586b9e0b59 --json '{"disabled":false,"description":"Prevent multiple login failures to mitigate brute force attacks","match":{"request":{"methods":"GET","POST"],"schemes":"HTTP","HTTPS"],"url":".example.org/path"},"response":{"status": 403, 401],"headers":{"name":"Cf-Cache-Status","op":"ne","value":"HIT"}]}},"bypass":{"name":"url","value":"api.example.com/"}] ! ! ! ,"threshold":60,"period":900,"action":{"mode":"challenge","timeout":86400,"response":{"content_type":"text/xml","body":"<error>This request has been rate-limited.</error>"}}}' -i "cis-demo"
Activity Tracker hosted event search,Container Registry,Secrets Manager,App ID,Cloudant,Key Protect,Log Analysis,Cloud Internet Services (CIS)



* 2 hours
* 2023-05-05



[Resource sharing across accounts](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-resource-sharing)Resource sharing across accounts

This tutorial walks you through different options on how to share cloud-based resources across accounts.

Virtual Private Cloud (VPC) Log Analysis

+6

Activity Tracker hosted event search,Secrets Manager,App ID,Key Protect,Hyper Protect Crypto Services,Object Storage



* 1 hour
* 2023-05-05



[Serverless web app and eventing for data retrieval and analytics](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-serverless-github-traffic-analytics)Serverless web app and eventing for data retrieval and analytics

In this tutorial, you create an application to automatically collect GitHub traffic statistics for repositories and provide the foundation for traffic analytics. GitHub only provides access to the traffic data for the last 14 days. If you want to analyze statistics over a longer period of time, you need to download and store that data yourself. In this tutorial, you deploy a serverless app in a IBM Cloud Code Engine project. The app manages the metadata for GitHub repositories and provides access to the statistics for data analytics. The traffic data is collected from GitHub either on-demand in the app or when triggered by Code Engine events, e.g., daily. The app discussed in this tutorial implements a multi-tenant-ready solution with the initial set of features supporting a single-tenant mode.

Code Engine Db2 on Cloud

+1

App ID



* 1 hour
* 2023-06-16
: For the latest Enhancements and fixes to support resources and data sources of VPC infrastructure and Cloud Internet Services (CIS) webhooks, see [Updates and fixes in v1.39.0](https://github.com/IBM-Cloud/terraform-provider-ibm/releases/tag/v1.39.0) release.







 January 2022 

Review the release notes for January 2022.



 28 January 2022 

Enhancements
: For the latest Enhancements on integration of security group with VPE gateway and update the deprecation notice of policy management in KMS resources, see [Updates and fixes in v1.38.1](https://github.com/IBM-Cloud/terraform-provider-ibm/releases/tag/v1.38.1) release.





 14 January 2022 

Features and enhancements with the bug fixes
: For the latest Resources, Data sources, Enhancements, and Bug fixes, see [Updates and fixes in v1.38.0](https://github.com/IBM-Cloud/terraform-provider-ibm/releases/tag/v1.38.0). Note In terraform-provider-ibm_1.38.0_darwin_amd64.zip binary release the team is working to resolve the notarization approval issue.







 December 2021 

Review the release notes for December 2021.



 9 December 2021 

Enhancements with the bug fixes
: This release contains the regression fix on IAM Policy Management resources from [1.37.0](https://github.com/IBM-Cloud/terraform-provider-ibm/releases/tag/v1.37.0). For the latest Resources, Data sources, Enhancements, and Bug fixes, see [Updates and fixes in v1.37.1](https://github.com/IBM-Cloud/terraform-provider-ibm/releases/tag/v1.37.1).





 7 December 2021 

Features and enhancements with the bug fixes
* [Using fields, functions, and expressions](https://cloud.ibm.com/docs/cis?topic=cis-fields-and-expressions)
* [Prioritizing options](https://cloud.ibm.com/docs/cis?topic=cis-priority)



* Working with global load balancers



* [Configuring a global load balancer](https://cloud.ibm.com/docs/cis?topic=cis-configure-glb)
* Global load balancer features



* [Working with load balancers and existing DNS records](https://cloud.ibm.com/docs/cis?topic=cis-existing-dns-records)
* [Setting up origin pools](https://cloud.ibm.com/docs/cis?topic=cis-glb-features-pools)
* [Setting up health checks](https://cloud.ibm.com/docs/cis?topic=cis-glb-features-healthchecks)
* [Optimizing traffic steering](https://cloud.ibm.com/docs/cis?topic=cis-traffic-steering)
* [Setting proxy modes](https://cloud.ibm.com/docs/cis?topic=cis-proxy-modes)
* [Setting session affinity](https://cloud.ibm.com/docs/cis?topic=cis-session-affinity)





* Working with page rules



* [Using page rules](https://cloud.ibm.com/docs/cis?topic=cis-use-page-rules)
* [Using page rules with caching](https://cloud.ibm.com/docs/cis?topic=cis-use-page-rules-with-caching)
* [Using resolve override with Cloud Object Storage](https://cloud.ibm.com/docs/cis?topic=cis-resolve-override-cos)



* [Customizing error pages](https://cloud.ibm.com/docs/cis?topic=cis-custom-page)
* Using edge functions
All IBM Maximo Application Suite SaaS servers are hardened using Center for Internet Security (CIS) Benchmarks. For further details, please visit: [https://www.cisecurity.org/cis-benchmarks/](https://www.cisecurity.org/cis-benchmarks/)

An IBM SaaS-wide central health checking service is used to automatically maintain baseline (hardened) configurations of systems against standard IBM policy.

IBM Maximo development follow IBM Secure Engineering practices for application development. IBM Secure Engineering is outlined publicly at the following link: [https://www.ibm.com/security/secure-engineering/index.html](https://www.ibm.com/security/secure-engineering/index.html)

IBM Maximo developers are required to follow secure coding practices, and complete education in the SANS top 25 and OWASP top 10. In addition, static (source) and web application scanning using IBM (HCL) AppScan product suite must be performed. These products check for SANS Top 25 and OWASP top 10 issues. Any vulnerabilities found by these scans must be resolved before product release or submitted through IBM's Product Security Incident Response Team (PSIRT) process for resolution via defect (IBM Authorized Program Analysis Report or APAR)

IBM Maximo development uses Rational Team Concert for development (management of tasks, stories, epics, version control, test management, etc) Selenium and TestNG for test automation, Jenkins for deployment automation, and Rational Performance Tester (RPT) for performance load testing.

IBM Maximo Software Development Life Cycle (SDLC): [https://www.ibm.com/support/pages/ibm-maximo-software-development-life-cycle](https://www.ibm.com/support/pages/ibm-maximo-software-development-life-cycle)





 Data Security & Privacy (DS&P) 

Manage application logging when configured with certain verbose options can allow for extensive information being gathered. This logging could include Personally Identifiable Information (PII) or Sensitive Personal Information (SPI). This information is generated and stored in plain text files on the application server. These logs are often made available to the customer upon request via SFTP.
SSO configuration is optional but is included as part of the IBM on Cloud subscription.





 Compliance - AWS (Infrastructure) 

All IBM Maximo Application Suite SaaS customer environments are managed to IBM IT Security Standards (ITSS) defined by IBM’s Chief Information Security Officer (CISO). This includes vulnerability scanning and subsequent remediation

AWS holds ISO-27001 certification and can provide SOC 1, 2 and 3 reports to customers

AWS (IaaS) ISO information:

[https://aws.amazon.com/compliance/iso-27001-faqs/](https://aws.amazon.com/compliance/iso-27001-faqs/)

AWS SOC information:

[https://aws.amazon.com/compliance/soc-faqs/](https://aws.amazon.com/compliance/soc-faqs/)





 Industry and Regulatory Compliance 

AWS Security Controls:

[https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)

IBM Maximo Application Suite SaaS environments are ISO-27001 certified. This certificate is publicly available and can be viewed / downloaded via the link below.

ISO-27001:

[https://www.ibm.com/downloads/cas/EEO0NVLK](https://www.ibm.com/downloads/cas/EEO0NVLK)

Details regarding specific Industry and Regulatory compliance can be found in the IBM Enterprise & Technology Security Community (this is accessible to IBMers only).

All IBM Maximo Application Suite SaaS servers are hardened using Center for Internet Security (CIS) Benchmarks. For further details, please visit: [https://www.cisecurity.org/cis-benchmarks/](https://www.cisecurity.org/cis-benchmarks/)

An IBM SaaS-wide central health checking service is used to automatically maintain baseline (hardened) configurations of systems against standard IBM policy.

IBM Maximo development follow IBM Secure Engineering practices for application development.
"value": "flexible"
},
{
"id": "browser_cache_ttl",
"value": 14400
},
{
"id": "security_level",
"value": "medium"
},
{
"id": "cache_level",
"value": "basic"
},
{
"id": "edge_cache_ttl",
"value": 7200
},
{
"id": "bypass_cache_on_cookie",
"value": "wp-.|wordpress.|comment_."
}
] ! !
}
Show more
-s, --json-str: Deprecated. The JSON data describing a page rule.-j, --json-file: Deprecated. A file contains input JSON data.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-command-options-page-rule-update" "> --><-- <section "id="section-command-examples-page-rule-update" "> --> Examples Update page rule a5836c2a7ea72d2e225890caea70ae32. ibmcloud cis page-rule-update 31984fea73a15b45779fa0df4ef62f9b a5836c2a7ea72d2e225890caea70ae32 --json '{"targets":{"target":"url", "constraint":{"operator":"matches", "value":"example.com/images/"}}], "actions":{"id":"always_online", "value":"on"}] ! ! !
rule-d0725d07-27e6-4079-a3bc-746d5ccae00f - Check whether Hyper Protect Crypto Services instance is enabled with a dual authorization deletion policy
rule-da567ec9-8e24-4c65-993b-ad290bfdb855 - Check whether Cloud Object Storage buckets are enabled with IBM Activity Tracker
rule-0fb54bb2-773b-4cec-81b0-1ca7d8049ba0 - Check whether Cloud Object Storage buckets are enabled with IBM Cloud Monitoring
rule-5910ed25-7ad7-42d0-8e42-905df0123346 - Check whether IBM Activity Tracker is provisioned in multiple regions in an account
rule-d592e06a-8756-4efc-a401-1ec215168f48 - Check whether IBM Activity Tracker trails are integrated with LogDNA logs
rule-c98fab05-5119-451a-b100-35df840d2326 - Check whether IBM Activity Tracker logs are encrypted at rest
rule-1cdad315-c39e-4d7e-99ef-8af88ba410c1 - Check whether Cloud Internet Services (CIS) has web application firewall enabled
rule-564ed93b-1927-4562-8a90-fbae173cdee1 - Check whether Cloud Internet Services (CIS) has DDoS protection enabled
rule-7c5f6385-67e4-4edf-bec8-c722558b2dec - Check whether Virtual Private Cloud (VPC) security groups have no inbound rules that specify source IP 0.0.0.0/0 to SSH port
rule-9653d2c7-6290-4128-a5a3-65487ba40370 - Check whether Virtual Private Cloud (VPC) security groups have no inbound rules that specify source IP 0.0.0.0/0 to RDP port
Enterprise only 
 Minify Web Content Minifies HTML, CSS and/or JavaScript files by removing all unnecessary characters from these files. Enterprise only 
 Image Load Optimization Improves load time for pages that include images based on network connection and device type by one of the following:<br><br><br><br> * Image Virtualizing - Replaces images with low-resolution placeholder images that have the same dimensions as the original (including third-party images). After the page renders completely, full resolution images are then lazy-loaded (prioritizing images in the browser viewport). This process allows pages to render quickly and minimizes browser reflow.<br> * Request Streamlining - Combines multiple individual network requests for images into a single request.<br><br><br> 
 Image Size Optimization Reduces image file size by removing metadata (date and time, camera manufacturer, model, and so on), and by compressing images when possible. Smaller file sizes mean faster load times for images and web pages. 
 Sort Query String Treats files with the same query strings as the same file in cache, regardless of the order of the query strings. Enterprise only 
 Response Buffering Enables or disables buffering of responses from the origin server. By default, CIS sends packets to the client as we receive them. Enabling Response Buffering means that CIS waits until it has the entire file before forwarding it to the user. Enterprise only 
 Script Load Optimization Improves paint times by asynchronously loading your JavaScripts, including third-party scripts so that they do not block rendering the content of your pages. 







 Page rule URL patterns 

A page rule takes effect on a specific URL pattern, matching the following format:

<scheme>://<hostname><:port>/<path>

An example that uses each component would be:

https://www.example.com:80/image.png

The scheme and port components are optional. If the scheme is omitted, it covers both http:// and https:// protocols. If the port is not specified, then the rule matches all ports.