The Cequence Network Sensor is a lightweight, passive traffic collection component that captures HTTP transactions and forwards them to the Cequence Unified API Protection (UAP) platform for analysis without interfering with existing network operations. Operating out-of-band, the sensor monitors network traffic on a designated interface, extracts HTTP request and response pairs from packet data, and prepares them for analysis by converting transactions into a standardized Cequence format.

The sensor provides built-in capabilities for filtering traffic, discovering API endpoints, and detecting and masking sensitive data to ensure compliance and security.

Release highlights

Base image and build

The Zeek sensor base image has been updated to UBI 10.2 (build 1782798722), providing improved security, stability, and compatibility with the latest platform requirements. A bug affecting the base-image build download of third-party libraries (boost, jsoncons, libfmt, and rapidjson) caused by a stray leading slash in S3 object paths has been resolved.

Connector and URI parameterization

The bundled Defender Connector has been updated from release 6.0.1 to release 6.3.0, incorporating the latest connector improvements and fixes. URI parameterization behavior is now aligned across components. The partial_date_or_uuid rule's delimiter set has been cleared (previously -_., now none) in discovery-rules.json so that parameterization behaves consistently with Cequence Bridge and Defender.

A new host-discovery-rules.json file introduces host-based parameterization support, enabling automatic handling of the following host types.

• Kubernetes and service-mesh hosts
• IoT, OT, and ICS device hosts
• Cloud-instance hostnames
• IPv4 and IPv6 special-purpose address matchers, including loopback, link-local, and private ranges

Configuration hardening

The Config Updater now pins wordlist_path and host_rules_path to the sensor's managed configuration directory during config updates. A remotely supplied or externally provided configuration can no longer relocate these files outside the managed directory.

Connector client IP and CLI

A client IP value of NA now correctly falls back to the X-Forwarded-For header. The interactive command-terminal prompt has been updated from sensor-bridge> to zeek-sensor> to reflect the component's identity. The prompt_toolkit and validators Python packages have been added as runtime dependencies to support the interactive shell.

Monitoring

The Prometheus connector-stats exporter now includes a defensive type-check on the stats payload and additional debug logging to improve reliability. The *_avg_txn_process_time_us metric has been removed.

Fixed Issues

Client IP values of NA now correctly fall back to the X-Forwarded-For header

The Zeek sensor base image now uses UBI 10.2, resolving a build failure caused by an incorrect S3 object path during third-party library download

Packages