This article explains how to deploy the Cequence passive integration for an Apigee Hybrid environment using Apigee Shared Flows. It is intended for administrators who manage an Apigee Hybrid deployment and want to forward API traffic data to the Cequence Platform for analysis, detection, and mitigation.

Overview

An Apigee Shared Flow is a reusable bundle of policies and resources, including code scripts, that multiple Apigee API proxies can share. The Cequence passive integration uses Shared Flows to insert code into the request and response handling of your Apigee Hybrid proxies.

The Shared Flow scripts extract transaction data from each request and response, parse the data to identify key fields, and forward the data to the API Edge traffic ingestion endpoint on the Cequence Platform. The Cequence Platform then analyzes the data independently and asynchronously, without affecting the transaction flow between your client and your backend application.

How data flows through the integration

The following diagram and steps describe how a single request and response travel through the integration.

The following steps summarize the data flow shown in the diagram.

1. When a client sends a request to your backend application, the request passes through the cequence-pre-proxy-sharedflow policy. This policy captures the request payload and metadata.
2. The request continues through Apigee for further processing and is forwarded to your backend application.
3. Your backend application returns a response. The cequence-post-target-sharedflow policy captures the response payload and metadata.
4. Apigee posts the request and response payloads and metadata to Cequence Bridge, which forwards the data to the API Edge for threat detection, analysis, and mitigation.
5. Cequence Bridge returns a success response. When a call to Cequence Bridge fails, the failure does not affect your API traffic.
6. Apigee returns the original response from your backend application to the client.

Before you deploy the Cequence passive integration

Verify that your environment meets the following requirements before you deploy the integration.

• Installed apigeecli, release 2.17 or later.
• Installed Google Cloud CLI, release 1.0 or later.
• Installed jq, release 1.7.1 or later.
• Installed curl, release 8.7.1 or later.
• Deployed Cequence Bridge, release 6.3.4 or later.

Authenticate with Google Cloud by running gcloud auth login.

Deploying the Cequence passive integration

Download the Cequence Apigee Hybrid plugin bundle from the Cequence Help Center before you begin this procedure. Deploy the integration using the CQ-CLI utility, which automates the process, or deploy the integration manually through the Apigee Hybrid console.

Deploying using the CQ-CLI utility

The CQ-CLI utility is the recommended method for deploying the Cequence passive integration.

1. Extract the tar package for your platform from the downloaded bundle. For example, run tar -xvf <tar file name>.
2. Extract the Platform specific tar file using tar -xvf cequence-apigee-hybrid-plugin-<tar file name>
3. The extracted directory contains the cq-cli binary, a sample environment file, and the plugin bundle.
4. Assign executable permissions to the utility by running chmod +x cq-cli.

5. Verify the available operations by running ./cq-cli apigee.

   The command lists the available subcommands, including init, deploy, destroy, upgrade, and verify-deployment.

6. Initialize the plugin by running ./cq-cli apigee init --tar ./cequence-apigee-cqcli.tar.gz. This step extracts the integration files, sets up the configuration, and runs pre-deployment validation.
7. Create the environment file by running cp .env.sample .env.

8. Open the new environment file and set the values described in the following table.

   Variable	Description
   APIGEE_ORG	Your Apigee organization name. This value is a fallback. When you set a preference by running apigeecli preferences set -o <org>, apigeecli uses that value instead.
   APIGEE_ENV	Your Apigee environment name.
   CEQUENCE_BRIDGE_IP	The IP address where Cequence Bridge listens. Use a literal IP address, not a hostname.
   CEQUENCE_BRIDGE_PORT	The port where Cequence Bridge listens.
   CEQUENCE_SAMPLING_PER_MINUTE	The maximum number of requests sampled per minute for each normalized endpoint. Leave this value empty to sample every request without a rate limit.
   CEQUENCE_EXCLUDED_PROXIES	A comma-separated list of Apigee API proxy names to exclude from the integration. Leave this value empty to apply the integration to all proxies.

   Warning: Data loss. Apigee resolves the CEQUENCE_BRIDGE_IP value separately for each message processor. When you set this value to a hostname instead of a literal IP address, the hostname lookup can fail silently on some message processors, and those message processors drop transaction data instead of sending the transaction data to Cequence Bridge.

9. Deploy the integration by running ./cq-cli apigee deploy.

   The command deploys the Shared Flow bundles and attaches cequence-pre-proxy-sharedflow to the pre-proxy flow hook and cequence-post-target-sharedflow to the post-target flow hook.

After this procedure, Apigee Hybrid runs the Cequence passive integration, and Cequence Bridge begins receiving transaction data for analysis.

Removing the integration

To remove the Cequence passive integration deployed through the CQ-CLI utility, run ./cq-cli apigee destroy from the extracted plugin directory. The command detaches the flow hooks and undeploys the Shared Flow bundles from the environment.

Deploying manually through the Apigee console

Step 0: 

1. Extract the tar package for your platform from the downloaded bundle. For example, run tar -xvf <tar file name>.
2. Extract the Platform specific tar file using tar -xvf cequence-apigee-hybrid-plugin-<tar file name>
3. Extract the cequence-apigee-plugin using tar -xvf cequence-apigee-cqcli.tar.gz
4. Navigate to /cequence/build 
5. You can find both the zips are present there
   1. cequence-post-target-sharedflow.zip
   2. cequence-pre-proxy-sharedflow.zip

Complete the following procedure when you prefer not to use the CQ-CLI utility.

1. Navigate to Overview > Proxy Development > Shared Flows in the Apigee Hybrid console.

2. Select + Upload Bundle.

   An upload dialog box appears.

3. Select Browse, then select the downloaded Shared Flow bundle file from your local system.
4. Select Create to upload the bundle.

Repeat the previous three steps for each remaining Shared Flow bundle.

5. For each uploaded bundle, select the bundle, then select Deploy.
6. From the deployment dialog box, select the revision and the target environment, then select Deploy.
7. Open the cequence-post-target-sharedflow policy, then open the ML-SendPayload.xml file.

8. Update the <Host> and <Port> values in the policy to match your Cequence Bridge deployment, as shown in the following example.

   <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
   <MessageLogging continueOnError="true" enabled="true" name="ML-SendPayload">
     <DisplayName>ML-SendPayload</DisplayName>
     <Syslog>
       <Message>{cequenceSyslogPayload}</Message>
       <Host><Bridge host></Host>
       <Port>6514</Port>
       <Protocol>TCP</Protocol>
       <PayloadOnly>true</PayloadOnly>
       <SSLInfo>
         <Enabled>true</Enabled>
         <IgnoreValidationErrors>true</IgnoreValidationErrors>
       </SSLInfo>
     </Syslog>
   </MessageLogging>

   Replace <Bridge host> with the IP address of your Cequence Bridge deployment. Set <Port> to the port where Cequence Bridge listens.

9. Navigate to Environments > Flow hooks for the environment where you deployed the Shared Flow bundles.
10. From the PreProxyFlowHook dropdown, select cequence-pre-proxy-sharedflow.
11. From the PostTargetFlowHook dropdown, select cequence-post-target-sharedflow.

After this procedure, Apigee Hybrid runs the Cequence passive integration on the associated proxies, and Cequence Bridge begins receiving transaction data for analysis.

Troubleshooting

Use the following guidance to resolve common issues during deployment.

• Authentication errors. Run gcloud auth login, then run gcloud auth application-default login to refresh your Google Cloud credentials.
• Missing dependencies. Install apigeecli from its GitHub releases page when the apigeecli command is not found.
• Permission errors. Verify that your Google Cloud account has the Apigee Admin role and access to the target organization.