vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Document changes in the [Agent release notes](https://docs.sysdig.com/en/sysdig-agent-release-notes.html) Update the agent to keep it up to date as new versions are made available. 
 Update default dashboards Update the default dashboards as requirements change. Update custom dashboards and track changes by using your own change management process. 
 Update pre-defined alert definitions Update the default alert definitions as requirements change. Update custom alert definitions and track changes by using your own change management process. 
 Track versions of custom dashboards, alerts, notifications, and teams Use your own change management process to control versions of monitoring resources such as dashboards, alert definitions, teams, and notifications. 







 Identity and access management 

IBM is responsible for the security and compliance of IBM Cloud Monitoring. You are responsible for defining the IBM Cloud Identity and Access Management (IAM) policies to control which users within your account have access to the monitoring data.



Table 3. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 Manage platform permissions Allow administrators to control access to manage resources in the IBM Cloud. Grant, revoke, and manage access to service instances by using IAM. 
 Manage service permissions Allow administrators to control access to work with the IBM Cloud Monitoring. Grant, revoke, and manage access to monitoring features by using IAM. 
 Control monitoring data access Allow administrators to control access to metrics data and metadata through Sysdig teams. Grant, revoke, and manage access to monitoring data by using IAM. 



[Learn more about controlling access through IAM](https://cloud.ibm.com/docs/monitoring?topic=monitoring-iam).





 Security and regulation compliance 

IBM is responsible for the security and compliance of IBM Cloud Monitoring. You are responsible for ensuring that metrics, that contain regulated data, are not provided to the IBM Cloud Monitoring service.



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Meet security and compliance objectives Maintain controls that are commensurate to supported industry compliance standards, such as SOC. Ensure that regulated data is not provided to the IBM Cloud Monitoring service. 







 Disaster recovery
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Use views to monitor logs ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Use dashboards to monitor logs ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) 
 resolveOnOk ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) !
PM-12 - Insider Threat Program 



  Control requirements 

PM-12 - 0
:   The organization implements an insider threat program that includes a cross-discipline insider threat incident handling team.
The openshift-api-<cluster_ID> provides access only to the Satellite location control plane. IBM SREs have no access to the hosts that are assigned as worker nodes of your Satellite-enabled IBM Cloud service clusters, where you run workloads in your location, because no default Link endpoints are created for workloads that run on these worker nodes, and all SSH access is disabled as part of the host bootstrapping process.





 How can I monitor and manage IBM access into my location? 

Default Satellite Link endpoints are created for your location's control plane cluster and for any other [Satellite-enabled services](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services) that you run in your location. These default Satellite Link endpoints are accessible only from within the IBM Cloud private network. To review these endpoints, see [Default Link endpoints for IBM Cloud access to your Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-default-link-endpoints). You have full control over these default endpoints, including the ability to disable them. However, disabling these endpoints prevents your location from being fully managed and updated, and the endpoints cannot be removed.

Satellite Link provides built-in controls to help you restrict which clients can access endpoints, ensuring that there are no back door access points on your hosts. For more information, see [Access and audit controls](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloudlink-audit-about).

Additionally, you can configure auditing to monitor user-initiated events for Link endpoints. IBM Cloud Satellite integrates with IBM Cloud® Activity Tracker to collect and send audit events for all link endpoints in your location to your Activity Tracker instance. For example, after you set up event auditing, you can review all events that relate to the masters for the clusters that run in your location, including events that are initiated by IBM Cloud. To get started with auditing, see [Auditing events for endpoint actions](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-monitorlink-audit).
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) 
 sysdig-monitor.secure.user[] Perform read-only actions within a service. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) 
 sysdig-monitor.secure.viewer[] Perform read-only actions within a service. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) 
 sysdig-monitor.agent-installation.read Agent installation access. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) 
 sysdig-monitor.promcat.integrations.read View PromCat integrations. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) 
 sysdig-monitor.promcat.integrations.validates Test to see if PromCat integrations are properly configured. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 







 Details per Watson service 

The following table lists the Watson services and related information about additional steps that you might need to be able to monitor events:



Table 3. Watson services that require actions for data events

 Service Name Paid plan required Other configuration required 

 IBM Watson® Assistant ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) <br>Premium & Enterprise Plans only feature 
 IBM Watson® Discovery 
 IBM Watson® Studio ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 IBM Watson™ Knowledge Catalog ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 IBM Watson® Machine Learning ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 IBM Watson® Knowledge Studio 
 IBM Watson® Language Translator ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 IBM Watson® Natural Language Understanding !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) 







 Details per Watson service 

The following table lists the Watson services and related information about additional steps that you might need to be able to monitor events:



Table 3. Watson services that require actions for data events

 Service Name Paid plan required Other configuration required 

 IBM Watson® Assistant ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) <br>Premium & Enterprise Plans only feature 
 IBM Watson® Discovery 
 IBM Watson® Studio ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) 
 IBM Watson™ Knowledge Catalog ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) 
 IBM Watson® Machine Learning ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) 
 IBM Watson® Knowledge Studio 
 IBM Watson® Language Translator !
<br>Comply with [Operational responsibilities when using IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-shared-responsibilities). 
 Monitor metrics for IBM Cloud Metrics Routing [Participating Cloud services](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-cloud-services-mr) publish relevant data to their subscribing clients. Clients have the ability to receive this data once their account is configured. [Configure your account](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-getting-started) where Cloud service subscriptions publish metrics to receive the published metrics. Notice that IBM Cloud Metrics Routing can only route metrics that are generated in [supported regions](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-regions). Other regions, where IBM Cloud Metrics Routing is not available, continue to manage events by using Monitoring service. 
 Monitor IBM Cloud Metrics Routing targets Check the health and status of the targets through Monitoring by configuring alerts to notify of problems writing metrics to a target, and generate notifications, for example, to the IBM Cloud Monitoring service. 







 Change management 



Table 2. Responsibilities for change management

 Task IBM Responsibilities Your Responsibilities 

 Updates to IBM Cloud Metrics Routing Provide major, minor, and patch version updates for IBM Cloud Metrics Routing interfaces. <br>Document changes in the [IBM Cloud Support Center](https://cloud.ibm.com/unifiedsupport/supportcenter) N/A 







 Identity and access management 



Table 3. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 Manage permissions for IBM Cloud Metrics Routing Provide the ability to restrict access to resources. <br>IBM is responsible for the security and compliance of the IBM Cloud Metrics Routing feature. Restrict access to IBM Cloud Metrics Routing by using Cloud IAM access policies. Define IAM policies to control which users within your account have access to manage the service and related resources in your account.
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) Events are available through the Activity Tracker Dallas (us-south) instance. 
 SAP ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) Events are available through the Activity Tracker Dallas (us-south) instance. 
 NetworkPorts ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) Events are available through the Activity Tracker Dallas (us-south) instance. 
 Tenant ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) Events are available through the Activity Tracker Dallas (us-south) instance. 
 SSHKeys ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) Events are available through the Activity Tracker Dallas (us-south) instance. 
 IKE !
* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)



Most Relevant Controls:



Table 8. Related controls for audit logs

 Family Control 

 Audit and Accountability (AU) [AU-1 Audit and Accountability Policy and Procedures) | Network Access to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-1) <br>[AU-2 Audit Events](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-2) <br>[AU-3 Content of Audit Records](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-3) <br>[AU-11 Audit Record Retention](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-11) 
 System and Information Integrity (SI) [SI-4 Information System Monitoring](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-4) 







 9. Ensure operational logging and monitoring is implemented 

Requirement: Ensure operational logging and monitoring is implemented.

Purpose & value: Operational logging and operational monitoring are a very important for ensuring your application runs smoothly. Proper operational logging and monitoring can help you determine if you need to failover to an alternate storage or processing site. In addition, operational logging and monitoring can help you determine if operations have returned to normal after a system disruption.

Operational logging is a complement to [audit logs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-audit-logs).
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) 
 IBM Cloud Monitoring ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) !
sumSeries(net.cloudant.mycustomer001.db.df.srv.free),1391019780,1391020080,60|6.49070326579e+12,6.4896982057e+12,6.48884414054e+12,6.48801589658e+12,4.32277107507e+12







 Monitoring endpoints 

To list all of the currently supported monitoring endpoints, make a request to the monitoring endpoint.

The following table lists the supported monitoring endpoints that are provided by the API:



Table 3. Monitoring API endpoints

 Endpoint Description 

 [connections](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-monitoring-an-ibm-cloudant-clusterconnections) The status of multiple load balancer connections. 
 [disk_use](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-monitoring-an-ibm-cloudant-clusterdisk_use) The disk use, as measured by a df command. 
 [kv_emits](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-monitoring-an-ibm-cloudant-clusterkv_emits) The number of key:value emits per second. 
 [map_doc](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-monitoring-an-ibm-cloudant-clustermap_doc) The number of documents processed by a map function, per second. 
 [network](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-monitoring-an-ibm-cloudant-clusternetwork) The octets that are received and transmitted. 
 [rate/status_code](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-monitoring-an-ibm-cloudant-clusterrate-status_code) The rate of requests, which are grouped by status code.
View name Description 

 [CBR] [Report] Allowed access requests Use this view to evaluate whether this access flow is supposed to be allowed, or whether you need to update your rule to deny access so that your resources are protected. 
 [CBR] [Report] Blocked access requests report Use this view to evaluate whether this access flow is supposed to be denied, or whether you need to update your rule to allow access so that your workflows don't break. 
 [CBR] Blocked access requests Use this view to find access flows that have been denied and blocked. 
 [Login] [TP] Compute resources login sessions Use this view to monitor trusted profile logins for compute resources. 
 [Login] [TP] Federated users login sessions Use this view to monitor trusted profile (TP) logins for federated users. 
 [Login] Service ID API Key logins Use this view to monitor logins with service ID API keys. 
 [Login] User API Key logins Use this view to monitor logins with user API keys. 



CBR is the acronym that is used to group views that are related with context based restrictions. TP is the acronymn that is used to group views that are related with trusted profiles.

For more information, see [Monitoring login sessions for trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-monitor&interface=ui) and [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor&interface=ui).





 Predefined screens 

The following table outlines the predefined screens that you can use to gain insight on your IBM Cloud access requests.



Table 2. Predefined screens

 Screen name Description 

 Activity Summary View statistics and gain insight on your IBM Cloud requests. 
 Login and Requests Status View statistics about login, unauthorize access, and denied requests.
This role includes the logdna.dashboard.manage IAM action role that allows a user to perform admin tasks such as configure streaming.
* When you configure streaming, the source IBM Log Analysis instance and the destination IBM Log Analysis instance can be provisioned in the same account or in different accounts.
* To connect the source IBM Log Analysis instance to the destination IBM Log Analysis instance, you need the following information:



* Destination IBM Log Analysis ingestion URL
* Ingestion key for the destination IBM Log Analysis for authentication



* If you configure your log sources to send data through private endpoints, make sure you configure a private ingestion endpoint for streaming.
* If you configure your log sources to send data through private and public endpoints, make sure you configure a private ingestion endpoint for streaming.
* If you have any regulatory restriction to keep data within specific regions, make sure streaming is only configured to a valid destination.







 Monitor streaming 

To monitor streaming, you can use the following services:



* IBM Cloud Monitoring service to monitor streaming to an Event Streams instance:

Event Streams is integrated with the Monitoring service. Monitoring provides a default template that you can customize to monitor the Event Streams instance, how data is streamed out of Log Analysis and consumed by any application or service that is subscribed to Event Streams.

For more information, see [Monitoring streaming by using IBM Cloud Monitoring](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-streaming-monitorstreaming-monitor-1).
* IBM Cloud Activity Tracker:

Streaming generates Activity Tracker events with the action logdna.streaming-logs.send to notify of failures sending data. There are different reasons for failure such as invalid credentials and topic deleted.

For more information, see [Monitoring streaming by using Activity Tracker](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-streaming-monitorstreaming-monitor-2).







 Conditional streaming 

You can configure exclusion rules to filter out data from streaming.
sysdig-monitor.promcat.integrations.validates Test to see if PromCat integrations are properly configured. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) 
 sysdig-monitor.promql-metadata.read View PromQL metadata. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/checkmark-icon.svg) !