This article covers what's new, fixed, and changed in release 9.2.0 of the Cequence Platform. Release 9.2.0 delivers four significant feature streams, seveeral customer-facing fixes, and two infrastructure migrations that every upgrading environment needs to plan for. Read the Breaking changes and Upgrade process sections before you upgrade, especially if you run UAP on-premises.

Release highlights

Release 9.2.0 concentrates on four feature areas: further API Security v2 enhancements, a new configuration and validation layer for Attack Feature Detection, the first phase of Edge Management, and telemetry exports that work out of the box.

API Security v2

This release continues the API Security v2 work with a set of discovery and inventory improvements.

• Endpoint counts are now deduplicated across daily indices, correcting previously inflated inventory figures.
• Spec validation results now publish downstream automatically when a spec is created or updated.
• Risk findings now carry field-level evidence, so you can see which field triggered a risk score rather than only the category.
• The OpenAPI cache now refreshes automatically when the discovery revision changes, eliminating stale spec results.
• Spec deletion is now atomic, removing a class of partial-delete inconsistency.
• Two new discovery controls are available: shadow-endpoint parameterization (on by default) and configurable allowed response codes for discovery.

Attack Feature Detection and Hindsight

Attack Feature Detection (AFD) gains a full configuration and monitoring layer in this release.

• A new Analysis Mode dial (Deep, Balanced, or Fast) replaces a hidden internal setting when running AFD, and a matching customer configuration panel exposes the AFD parameters that were previously only available through a support-managed configuration file.
• Hindsight retrospective validation lets you test decision rules against historical traffic before enforcing them.
• AFD Policy Heartbeat continuously monitors policy effectiveness and adds a Policy Changes tab, so stale or underperforming policies surface automatically instead of silently drifting.
• AFD rule selection is now grouped and searchable by TTP category.

Edge Management (phase 1)

Edge Management is a new capability for multi-tenant edge infrastructure, available in this release for new customers.

• Per-Defender-pool routing with pool-boundary isolation, so tenants sharing infrastructure cannot affect each other's routing.
• Certificate lifecycle management and pool-aware deployments through a new interface.
• A new roles and permissions model scoped to Edge Management.
• An authentication bridge for external identity integration.

Telemetry data exports out of the box

New installations can now seed three default S3 telemetry exports (Detector, Mitigator, and Risk) automatically, instead of requiring an operator to configure each one by hand. The feature is off by default and enabled through a single Helm flag that supplies the S3 destination and credentials. Existing exports are never duplicated or overwritten.

Detection and mitigation analytics

• ASN (Autonomous System Number) is now available as a Group By, breakdown, and filter dimension across the Threat Protection dashboards, enabling network-level attack analysis.
• The policy ID and mitigation action now appear directly on the Transactions view, and you can enable, disable, or edit a policy from the Mitigation Dashboard without navigating to policy settings.
• Mitigation policy tables now support a reusable, TTP-grouped rule search bar, and custom rules can optionally be assigned a TTP category.
• The Enable WAF option on the Diagnostics page now converts to a toggle, and traffic filter configuration gains application tag search.

Breaking changes

Release 9.2.0 includes two infrastructure migrations that change how the platform stores and serves data. Read this section fully before upgrading, and see the linked upgrade guide for your current release.

Reporting behavior change: mitigation counts. A correctness fix changes how "no-action" mitigations are classified. Requests that a policy evaluated but did not act on are now correctly reported as unmitigated instead of mitigated. This means your mitigation counts and endpoint classifications will shift after the upgrade even if your traffic pattern is unchanged. Any recurring reports or dashboards you track over time will show a step change at the upgrade boundary. If you run scheduled reports for your own stakeholders, brief them ahead of the upgrade so the shift doesn't read as a regression in coverage.

Data loss: Kafka topic data. This release moves Kafka off ZooKeeper and onto KRaft, and the Kafka cluster is rebuilt rather than migrated in place. Topic data does not carry over the upgrade, and does not carry over a rollback from it. This is expected and does not affect UAP functionality, because configuration lives in Elasticsearch and republishes to Kafka automatically when components start. If you run your own consumers against UAP's Kafka topics directly, those consumers will see empty topics immediately after the upgrade.

Data loss: Airflow run history. This release moves Airflow from 2.x to 3.x, which replaces the metadata database rather than migrating it. DAG run history, task history, connections, variables, and users do not carry over. Machine-learning model configurations themselves are unaffected, but historical run and task state is lost. If you need to retain this history, export it before upgrading.

On-premises upgrade issues under active investigation. Several on-premises upgrade paths to 9.x have surfaced issues, including a race condition between the Elasticsearch initialization and upgrade-init jobs, and a UI routing change that can cause CORS errors on the API risk page.

On-premises environments also need to update several Helm chart values as part of this upgrade, covering the Airflow ingress block, the Airflow API authentication secrets, and the Kafka node pool sizing keys. The full list of value changes is in the linked upgrade guide for your current release, not repeated here.

Upgrading to release 9.2.0

Because this release includes the Kafka and Airflow migrations described above, follow the dedicated upgrade guide for your current release rather than performing a standard upgrade.

• Upgrading from release 9.1.x: see Cequence UAP 9.1.x to 9.2.x upgrade and rollback.

• Upgrading from release 8.7.x: see Cequence UAP 8.7.x to 9.2.x upgrade and rollback.

SaaS-hosted environments are upgraded by Cequence directly and do not require action on your part beyond reviewing the breaking changes above.

Fixed issues

The items below are the customer-facing fixes in this release. Release 9.2.0 also includes 812 CVE remediations (109 critical, 702 high, and one unrated) across 23 platform components. These are not itemized individually here.

Mitigation dashboard and policy management

• The multi-policy filter now returns correct results after you save and reload.
• The rules search filter on the Mitigation Dashboard now returns correct matches.
• The Enable/Disable toggle on the Policy Edit dialog now responds correctly for authorized users.
• Mitigation Dashboard policy rows now include an inline enable/disable toggle and edit action, so you no longer need to navigate to policy settings for routine changes.
• A Disable Policy action is now available directly from the Mitigation Transactions and Pivot views.
• Mitigator criteria for host and path values now trim leading and trailing whitespace, so policies match as expected.
• Defender startup no longer stalls when a fingerprint-v2 store pull fails, reducing cache population delays.
• Algorithm information now loads correctly when you hover over the info icon on the Mitigation Dashboard.
• The policy criteria results preview now correctly displays OR logic for "matches any" tag conditions instead of AND.
• The confidence-based auto-mitigation demarcation percentile is now configurable on a per-customer basis. This is a backend configuration change with no UI surface in this release.

Detection and transactions

• The Event Transaction page no longer shows a blank screen when multiple rules are selected as a filter.
• Navigating between the Transactions, Endpoints, and Detection pages no longer triggers a stack-overflow error and blank screen.
• Applying a filter on the Transactions page no longer throws a JavaScript error for some tenants.
• Host header values are now handled consistently between the Detection and Mitigation dashboards regardless of letter case.
• Detected and mitigated traffic counts are now rounded independently, so large but distinct values no longer display as identical.
• User-entered form data, including custom parameterization rules in progress, is now preserved through a background authentication token refresh instead of being cleared.
• Attack Feature Detection rule creation no longer fails for header values that are normalized to an empty string, such as Referer.

API discovery, inventory, and specs

• Spec deletion no longer orphans published endpoints when Elasticsearch is under load.
• The "Clear Risks" action on the definition page now clears risks for shadow endpoints as well as documented endpoints.
• A regression that caused a subset of valid API specs to fail validation has been fixed.
• The Inventory Summary page no longer errors for tenants with no API specs on file.
• Endpoints are no longer parameterized during definition generation when the responsible parameterization rule is disabled.
• The Endpoint table now shows a First Seen date for actively-trafficked Documented endpoints, matching Last Seen.
• A clear-filter control is now visible next to the API Hosts sticky filter on the Endpoints page.
• The API Gateway now picks up an updated OpenAPI spec automatically, without requiring a manual pod restart.
• JSON spec files in View Spec are now formatted for readability, matching existing YAML formatting.

Platform, data export, and reporting

• Data export connectors, including S3 and other credentialed destinations, no longer lose their credentials after a Kafka Connect state reset.
• The Diagnostics page's Enable WAF option now states clearly that it enables all WAF policies in Block mode, including ones you previously disabled.
• Fixed an issue causing immediate connection resets on first login to the UI in some environments.
• Reduced log volume from request processing in Bot Analyzer, lowering storage cost and noise.
• The flow graph is now disabled by default, reducing baseline resource consumption. Enable it on demand from settings.
• The Keycloak theme image no longer runs as the root user, closing a security scan finding.

Customer-reported issues

• Zendesk #35967: The "Top Blocking Policies" report now consistently shows the policy name instead of falling back to the raw policy ID.
• Zendesk #36925: The Application Tag selector used when configuring traffic filters now supports type-ahead search and lists tags alphabetically by default.
• Zendesk #38067: Mitigator criteria for host and path values now trim leading and trailing whitespace, so policies match as expected.
• (no case number available): Detected and mitigated traffic counts are now rounded independently, avoiding duplicate-looking values at high volume.
• (no case number available): Elasticsearch index-setting updates no longer fail against system indices during upgrade, affecting environments that use an external Elasticsearch cluster.
• (no case number available): Applying a filter on the Transactions page no longer throws a JavaScript error.

Artifact availability