Skip to main content
UAP 9.x Releases

Cequence Platform 9.3 release notes

© 2024 Cequence Security. All Rights Reserved.

Cequence Platform 9.3 release notes

  • Updated on
  • ~ minute read
Download PDF

Current release: 9.3.2

This article covers what's new, fixed, and changed in release 9.3.0 of the Cequence Platform. Release 9.3.0 delivers a new agentic trust policy layer, expanded control over API definition generation, and a risk rules catalog update, along with several customer-facing fixes and two infrastructure component upgrades that upgrading environments need to plan for. Read the Breaking changes and Upgrading to release 9.3.0 sections before you upgrade, especially if you run the Cequence Platform on-premises.

Release highlights

Release 9.3.0 concentrates on three feature areas: a new agentic trust policy layer, selective API definition generation, and an updated risk rules catalog.

Agentic trust for AI agent traffic

The Cequence Platform now includes agentic trust, a new policy definition point for traffic from AI agents.

  • A new issuer registry lets you register identity issuers, including Skyfire and biometric or Descope-based issuers.
  • Agent access policies control which registered agents can reach your APIs and under what conditions.
  • A new detected agents view lists every agent seen in your traffic, with a per-request activity log you can filter and drill into.
  • Role-based access control governs who can manage issuers and access policies, and every change is recorded in an audit trail.

Selective API definition generation

When you generate an API definition, you can now choose which hosts, base paths, and individual endpoints to include, instead of generating a definition for an entire host at once.

  • Select one or more hosts, one or more base paths for each host, and specific endpoints under each base path.
  • Endpoints you leave unselected under a base path are treated as shadow, and endpoints outside any selected base path are treated as undocumented.
  • Generated OpenAPI documents now emit request and response header parameters.
  • Generated OpenAPI documents no longer contain duplicate schema definitions.

Risk rules catalog update

The risk rules catalog moves to version 24 in this release. The update adds eight new system rules, which ship disabled by default so you can opt in on your own schedule, and removes rules that are deprecated.

New in release 9.3.2

The following features are new in this release.

Added a connector that creates tickets in self-hosted Jira Data Center 8.22 or later. The connector selection page now labels the tiles Jira Cloud and Jira Data Center. The connector authenticates with a Client ID and Client Secret from an Application Link in Jira administration, and requires HTTPS. Jira Server is not supported.

Added a Threat Activity column to Agents Overview, which displays the threats that the agents API returns, with a +N overflow count and the remaining threats on hover. Added an Agent Name filter to the Detection Dashboard. Added a shield action next to the View Transactions action, which opens the Detection Dashboard grouped by Threat Classification, filtered to the selected agent, and set to the current Agents Overview time range.

Improvements

The following improvement is included in this release.

Improved the distribution of Bot Analyzer aggregation records across Kafka partitions. Records that have no pivot value or an empty pivot value now use salted keys, which reduces the uneven consumer lag that data skew caused.

Breaking changes

Review the following change before you upgrade to release 9.3.0.

Behavior change: shadow endpoint parameterization. The Parameterize shadow endpoints toggle in inventory settings is removed. Starting with this release, the Cequence Platform always parameterizes shadow endpoints. When your environment previously had this setting turned off, shadow endpoints in your inventory are parameterized automatically after you upgrade. There is no setting to turn this behavior off.

Upgrading to release 9.3

Review the following requirements and changes before you upgrade to release 9.3.0.

Defender compatibility. Release 9.3.0 requires Cequence Defender release 6.3.5 or later, for both ARM and x86 deployments. Upgrade your Defender instances to release 6.3.5 or later before you upgrade the platform.

Kafka and Airflow component updates. This release updates the bundled Strimzi Kafka Operator from release 0.51.0 to 1.2.0, moving the underlying Kafka version from 4.2.0 to 4.3.1 and migrating custom resource definitions to v1. It also updates the bundled Airflow release to 3.3.1.

Longer upgrade time for Elasticsearch initialization. An Elasticsearch initialization migration in this release adds approximately two minutes to the overall upgrade process.

Rollback compatibility fix. This release also fixes an issue where rolling back from a newer release, even briefly, could leave Detected Transactions permanently returning errors due to data written by the newer release. See CEQASP-13391 in the fixed issues below.

For upgrade and rollback steps, see the upgrade guide.

SaaS-hosted environments are upgraded by Cequence directly and do not require action on your part beyond reviewing the breaking changes above.

About upgrading from release 9.3

Read the related article before upgrading a 9.3.x installation to 9.4 to learn more about effects and required actions of performing this upgrade.

Fixed issues

The items below are the customer-facing fixes in release 9.3. Note that customer-reported issues appear in their own category as well as the Customer-reported issues section.

Fixed issues in release 9.3.2

The following issues are fixed in this release.

Fixed an issue in which the native Splunk HEC data export connector (splunk-hec) delivered each event to Splunk as a single escaped string instead of structured JSON. The string prevented filtering or extracting on fields such as rule_id, response_code, and policy_id. The connector now sends the event as a parsed JSON object.

CEQASP-13131: Fixed an issue in which the Configuration tab of an API Testing test plan intermittently displayed "Failed to retrieve auth profile data" even though the plan's auth profiles existed. Two API endpoints returned the same auth profiles in different JSON structures. The endpoints now return a consistent structure.

Fixed an issue in which the processed requests count on the homepage (two-week window) was consistently higher than the Monthly Cumulative Usage value on the System Usage diagnostics page.

CEQASP-13522: Fixed an issue in which fury-runner (versions 1.6.3 through 1.7.2) failed with ERR005: Unable to fetch test plan bundle when it ran an API Testing test plan from a CI pipeline on UAP 9.x and later. The same test plan ran successfully from the UI. fury-runner now retrieves the test plan bundle.

Fixed an issue in which, after you deleted the Descope Biometric issuer, the form to create a new issuer displayed empty Project ID, Flow ID, JWKS URL, and Expected issuer fields. The default values previously returned only after a policy engine restart. The form now displays the default values without a restart.

Fixed an issue in which Agents Overview listed an "Unknown" agent with the issuer Descope Biometric. Descope Biometric is a human challenge issuer, not an agent issuer, and no longer appears in Agents Overview.

Fixed an issue in which the risk-engine circuit breaker for the Kafka risk events producer opened after a transient network error and never recovered. A health check repeatedly reset the breaker's recovery timer, which stalled the pipeline workers and caused the consumer lag to grow until unprocessed messages expired from the input topic. The circuit breaker now recovers after the connection to Kafka is restored.

Fixed issues in release 9.3.1

The Contact field now populates correctly in the API Inventory.

CEQASP-13543: Findings marked Action Required no longer appear under the Open tab in Risk Posture.

The Evidence tab now includes request cookies and query parameters for risk findings.

CEQASP-13439: The Risk Posture grid count now matches the drill-down list when the Last Seen time filter is applied.

Deleting an API specification now cleanly removes its endpoints from risk scoring.

Fixed issues in release 9.3.0

API discovery and specification generation

  • Authentication schemes on active endpoints no longer get reset to null.
  • Spec preview now supports OpenAPI 3.1.x and 3.2.0 documents.
  • CEQASP-12945: Custom URI parameterization patterns now validate regular expressions correctly before you save them.
  • Endpoint indexing now honors path-level and operation-level server definitions in OpenAPI specifications.
  • Generated OpenAPI specifications no longer contain duplicate schema definitions.
  • Generated OpenAPI specifications now include request and response header parameters.
  • Several API Discovery interface elements are resized for better layout.
  • Endpoint counts for each host are now calculated correctly, and endpoints no longer appear under the wrong host in the Generate API Definition wizard.
  • The Last seen column in the Generate API Definition wizard now shows a consistent relative time format.
  • Endpoint counts in the Generate API Definition wizard now match the counts shown in inventory.
  • Adding a new parameterized endpoint no longer incorrectly affects other endpoints under the same path.
  • New base paths you add during API definition generation are now reflected correctly in inventory and endpoint classification.
  • Generate API Definition no longer includes inactive endpoints, which previously caused a validation error during preview.
  • Saving an API definition no longer removes documented endpoints from inventory when those endpoints have traffic recorded on more than one day.
  • Generated API definitions now correctly express optional authentication instead of always marking it as required.
  • Selecting the root path as a base path now correctly scopes the entire host in the generated API definition.
  • Generate API Definition preview no longer freezes the browser when you generate a definition for a host with a large discovered endpoint inventory.
  • Deleting an API definition now correctly reclassifies its endpoints as undocumented.
  • CEQASP-13237: Previewing and saving a targeted URI parameterization pattern is much faster for hosts with large discovered endpoint inventories.
  • CEQASP-13424: Generate API Definition no longer shows unnecessary warnings for schemas that use a mixed oneOf definition.
  • CEQASP-12830: Updating an API specification to a new version now preserves the server URLs you previously configured instead of overwriting them.

Risk detection and analytics

  • Custom sensitive data expression filters now work correctly on the endpoints page.
  • Endpoints marked with optional or not-required authentication no longer trigger no-authentication risk findings.
  • The clear risk options shown when you update an API specification are easier to use.
  • Improved the logic that pauses issue creation for risk events.
  • Risk evidence and sensitive data masking now update correctly when the same endpoint triggers a risk again with a different value.
  • CEQASP-13090: Improved the performance of the risk posture API for large result sets, reducing load times and preventing timeouts.
  • The change rule state dialog now defaults to the rule's current state instead of always showing on.
  • CEQASP-13219: Pivot details now load IP, organization, and ASN breakdowns correctly for tenants with data that predates a recent detection schema change.
  • Custom internal IP ranges you add are now prioritized correctly over third-party and external classification.
  • Corrected invalid character escaping in several EU AI Act system rules so they pass catalog validation.

Platform and infrastructure

  • Changes to the issuer registry now take effect without requiring a Policy Engine restart.
  • Airflow's API secret key and JWT secret now follow the platform's standard key configuration pattern.
  • Keycloak initialization resources now support custom annotations.
  • The Airflow component now appears correctly on the diagnostics system components screen.
  • CEQASP-13145: Fixed an issue where the IP allowlist and other system datasets could be reset to empty during an upgrade.
  • Upgrade initialization now resets cached entity tags so threat intelligence data refreshes correctly after an upgrade.
  • Improved the order in which Kafka resources are removed during environment teardown for cloud deployments.
  • Hardened the security context configuration for the platform's PostgreSQL database pods.
  • Updated the bundled sensor bridge and its build runner to the latest supported versions.
  • Pinned internal API security service dependencies to a stable release tag instead of a development branch.
  • CEQASP-13086: Fixed an issue where repeated API service restarts could queue an unbounded number of background Elasticsearch update tasks, degrading cluster performance.
  • CEQASP-13405: Resource discovery now aggregates records before writing them to Elasticsearch, reducing cluster load.

User interface

  • Tooltips now display the full URL instead of truncating it.
  • Fixed a display issue where the base path filter could be hidden behind the endpoints table at larger page sizes.
  • Updated the license for the UI data grid component library.
  • The agents overview page no longer shows an error when you open it after upgrading the platform.

Integrations and data export

  • Data export for risk events now completes successfully.
  • Risk events data export now groups records by rule contributor instead of by category.
  • CEQASP-13223: Fixed an issue where S3 data export credentials could become corrupted during configuration reconciliation, which broke telemetry export.
  • Custom policies with priority values greater than 200,000,000 now display correctly in the WAF section after an upgrade.

Customer-reported issues

  • CEQASP-13543: Findings marked Action Required no longer appear under the Open tab in Risk Posture.
  • CEQASP-13439: The Risk Posture grid count now matches the drill-down list when the Last Seen time filter is applied.
  • CEQASP-12945: Custom URI parameterization patterns now validate regular expressions correctly before you save them.
  • CEQASP-12830: Updating an API specification to a new version now preserves the server URLs you previously configured instead of overwriting them.
  • CEQASP-13086: Fixed an issue where repeated API service restarts could queue an unbounded number of background Elasticsearch update tasks, degrading cluster performance.
  • CEQASP-13090: Improved the performance of the risk posture API for large result sets, reducing load times and preventing timeouts.
  • CEQASP-13145: Fixed an issue where the IP allowlist and other system datasets could be reset to empty during an upgrade.
  • CEQASP-13219: Pivot details now load IP, organization, and ASN breakdowns correctly for tenants with data that predates a recent detection schema change.
  • CEQASP-13223: Fixed an issue where S3 data export credentials could become corrupted during configuration reconciliation, which broke telemetry export.
  • CEQASP-13237: Previewing and saving a targeted URI parameterization pattern is much faster for hosts with large discovered endpoint inventories.
  • CEQASP-13405: Resource discovery now aggregates records before writing them to Elasticsearch, reducing cluster load.
Was this article helpful?
日本語（日本）