Current release: 6.3.4
The 6.3 release of Cequence Defender strengthens API discovery and parameterization with specification-based rules, extends dynamic fingerprinting with improved algorithm handling, adds granular control over parameterization scope, and enhances deployment observability and content handling.
Changed behavior
In the 6.3.3 release of Cequence Defender, the behavior of the mitigator changed. The Defender mitigator now applies a configured block action header exactly once per response. Previously, headers accumulated a duplicate on every configuration reload, and duplicate Access-Control-Allow-Origin values caused browsers to reject blocked responses.
New features
Specification-driven API discovery
API specifications are now the authoritative source for endpoint parameterization. Specification-defined patterns take precedence over system and custom parameterization rules, ensuring your documented API contract is the source of truth. Custom discovery patterns with prefix matching are now fully supported.
Advanced parameterization rules
Custom parameterization rules now support per-pattern host inclusion and exclusion filtering, giving you fine-grained control over where rules apply. New exclusion capabilities allow you to specify exact string or regex patterns that should not be parameterized. Discovery metadata now includes specification and custom pattern identifiers for improved traceability. Discovery metadata is improved to omit empty path segments and consistently report rule names and identifiers.
Extended Lua policy functions
Lua-based policies now support base64 encoding and decoding, URL encoding and decoding, and JWT token operations (parsing and validation), expanding the scope of transformations available in policy logic.
Dynamic fingerprinting correctness
Dynamic fingerprint algorithms now generate consistent results across different content types, handle empty algorithm slots correctly, and resolve header ID collisions that were causing fingerprint mismatches.
Automatic content-encoding detection
Defender now automatically detects content encoding (gzip, deflate, and others) to correctly decompress payloads, removing dependency on potentially inaccurate or spoofed content-encoding headers.
Enhanced health checks
Defender health checks now accurately reflect configuration state and readiness before accepting traffic.
New feature in 6.3.1: Splunk HEC
The 6.3.1 release of Cequence Defender adds Splunk HEC support as a passive, out-of-band ingestion path for API transaction telemetry. Gateway and logging sources (including IBM APIC) send events over HEC to Cequence, which validates, normalizes, and buffers them before forwarding into the Cequence Platform pipeline with no added latency or risk to live API traffic. The feature exposes the standard HEC event and health endpoints, handles concatenated JSON event streams with automatic timestamp normalization, and supports gzip-compressed submissions with built-in backpressure handling to protect against overload. Malformed or oversized events are isolated and rejected individually to prevent a single bad event from disrupting an entire batch or taking down the Defender instance.
Fixed issues
Release 6.3.4
Shadow endpoints are now parameterized automatically. In previous releases, parameterization was applied only to endpoints associated with an API spec. This behavior is controlled by a new Parameterize shadow endpoints option.
Release 6.3.3
DEF-2230 The Defender mitigator now applies a configured block action header exactly once per response. Previously, headers accumulated a duplicate on every configuration reload, and duplicate Access-Control-Allow-Origin values caused browsers to reject blocked responses.
Endpoint threat context now reports a consistent action for traffic that matches an IP allowlist, whether or not the request includes a body.
Release 6.3.2
DEF-2148: Block, challenge, and rate limit responses now return a request ID that includes the transaction depth as a suffix, so the ID shown to the client matches the ID that is searchable in the dashboard Mitigation view. Integrations that parse this ID must account for the suffix.
DEF-2188: The mitigator policy cache now populates reliably at startup, so a Defender that reports healthy and serves traffic also enforces mitigation. Readiness detection has been reworked, and the new SKIP_NGINX_STATUS_PROBE setting bypasses the readiness gate when needed.
A block or rate limit action whose custom response template has not yet reached the Defender now recovers on its own once the template arrives, instead of remaining on the default reason. Mitigation records also carry the correct transaction depth.
Release 6.3.1
DEF-2094: Defender health checks now accurately reflect configuration state and readiness before accepting traffic.
DEF-2125: Defender now automatically detects content encoding such as gzip and deflate, so payloads decompress correctly regardless of header accuracy.
Authentication endpoints for authenticity challenge policies are no longer incorrectly sent to the cq.api-transactions topic.
Empty path segments are no longer included in discovery metadata, and rule names are now consistently reported for all discovery results.
Fingerprint algorithms no longer assign duplicate header IDs, so distinct headers now produce distinct fingerprints.
Empty dynamic fingerprint algorithm slots now correctly return zero-values instead of invalid fingerprints.
Dynamic fingerprint body analysis now generates consistent fingerprints across different content types.
Prefix-based API specification rules now correctly match and parameterize endpoints.
Partial date and UUID parameterization rules now correctly match patterns within path segments, not just complete segments.