Skip to main content
UAP 9.x Releases

Search

Cequence Platform 9.3 release notes

© 2024 Cequence Security. All Rights Reserved.

Cequence Platform 9.3 release notes

  • Updated on
  • ~ minute read
Download PDF

Current release: 9.3.0

This article covers what's new, fixed, and changed in release 9.3.0 of the Cequence Platform. Release 9.3.0 delivers a new agentic trust policy layer, expanded control over API definition generation, and a risk rules catalog update, along with several customer-facing fixes and two infrastructure component upgrades that upgrading environments need to plan for. Read the Breaking changes and Upgrading to release 9.3.0 sections before you upgrade, especially if you run the Cequence Platform on-premises.

Release highlights

Release 9.3.0 concentrates on three feature areas: a new agentic trust policy layer, selective API definition generation, and an updated risk rules catalog.

Agentic trust for AI agent traffic

The Cequence Platform now includes agentic trust, a new policy definition point for traffic from AI agents.

  • A new issuer registry lets you register identity issuers, including Skyfire and biometric or Descope-based issuers.
  • Agent access policies control which registered agents can reach your APIs and under what conditions.
  • A new detected agents view lists every agent seen in your traffic, with a per-request activity log you can filter and drill into.
  • Role-based access control governs who can manage issuers and access policies, and every change is recorded in an audit trail.

Selective API definition generation

When you generate an API definition, you can now choose which hosts, base paths, and individual endpoints to include, instead of generating a definition for an entire host at once.

  • Select one or more hosts, one or more base paths for each host, and specific endpoints under each base path.
  • Endpoints you leave unselected under a base path are treated as shadow, and endpoints outside any selected base path are treated as undocumented.
  • Generated OpenAPI documents now emit request and response header parameters.
  • Generated OpenAPI documents no longer contain duplicate schema definitions.

Risk rules catalog update

The risk rules catalog moves to version 24 in this release. The update adds eight new system rules, which ship disabled by default so you can opt in on your own schedule, and removes rules that are deprecated.

Breaking changes

Review the following change before you upgrade to release 9.3.0.

Behavior change: shadow endpoint parameterization. The Parameterize shadow endpoints toggle in inventory settings is removed. Starting with this release, the Cequence Platform always parameterizes shadow endpoints. When your environment previously had this setting turned off, shadow endpoints in your inventory are parameterized automatically after you upgrade. There is no setting to turn this behavior off.

Upgrading to release 9.3.0

Review the following requirements and changes before you upgrade to release 9.3.0.

Defender compatibility. Release 9.3.0 requires Cequence Defender release 6.3.5 or later, for both ARM and x86 deployments. Upgrade your Defender instances to release 6.3.5 or later before you upgrade the platform.

Kafka and Airflow component updates. This release updates the bundled Strimzi Kafka Operator from release 0.51.0 to 1.2.0, moving the underlying Kafka version from 4.2.0 to 4.3.1 and migrating custom resource definitions to v1. It also updates the bundled Airflow release to 3.3.1.

Longer upgrade time for Elasticsearch initialization. An Elasticsearch initialization migration in this release adds approximately two minutes to the overall upgrade process.

Rollback compatibility fix. This release also fixes an issue where rolling back from a newer release, even briefly, could leave Detected Transactions permanently returning errors due to data written by the newer release. See CEQASP-13391 in the fixed issues below.

For upgrade and rollback steps, see the upgrade guide.

SaaS-hosted environments are upgraded by Cequence directly and do not require action on your part beyond reviewing the breaking changes above.

Fixed issues

The items below are the customer-facing fixes in release 9.3.0. Note that customer-reported issues appear in their own category as well as the Customer-reported issues section.

API discovery and specification generation

  • Authentication schemes on active endpoints no longer get reset to null.
  • Spec preview now supports OpenAPI 3.1.x and 3.2.0 documents.
  • CEQASP-12945: Custom URI parameterization patterns now validate regular expressions correctly before you save them.
  • Endpoint indexing now honors path-level and operation-level server definitions in OpenAPI specifications.
  • Generated OpenAPI specifications no longer contain duplicate schema definitions.
  • Generated OpenAPI specifications now include request and response header parameters.
  • Several API Discovery interface elements are resized for better layout.
  • Endpoint counts for each host are now calculated correctly, and endpoints no longer appear under the wrong host in the Generate API Definition wizard.
  • The Last seen column in the Generate API Definition wizard now shows a consistent relative time format.
  • Endpoint counts in the Generate API Definition wizard now match the counts shown in inventory.
  • Adding a new parameterized endpoint no longer incorrectly affects other endpoints under the same path.
  • New base paths you add during API definition generation are now reflected correctly in inventory and endpoint classification.
  • Generate API Definition no longer includes inactive endpoints, which previously caused a validation error during preview.
  • Saving an API definition no longer removes documented endpoints from inventory when those endpoints have traffic recorded on more than one day.
  • Generated API definitions now correctly express optional authentication instead of always marking it as required.
  • Selecting the root path as a base path now correctly scopes the entire host in the generated API definition.
  • Generate API Definition preview no longer freezes the browser when you generate a definition for a host with a large discovered endpoint inventory.
  • Deleting an API definition now correctly reclassifies its endpoints as undocumented.
  • CEQASP-13237: Previewing and saving a targeted URI parameterization pattern is much faster for hosts with large discovered endpoint inventories.
  • CEQASP-13424: Generate API Definition no longer shows unnecessary warnings for schemas that use a mixed oneOf definition.
  • CEQASP-12830: Updating an API specification to a new version now preserves the server URLs you previously configured instead of overwriting them.

Risk detection and analytics

  • Custom sensitive data expression filters now work correctly on the endpoints page.
  • Endpoints marked with optional or not-required authentication no longer trigger no-authentication risk findings.
  • The clear risk options shown when you update an API specification are easier to use.
  • Improved the logic that pauses issue creation for risk events.
  • Risk evidence and sensitive data masking now update correctly when the same endpoint triggers a risk again with a different value.
  • CEQASP-13090: Improved the performance of the risk posture API for large result sets, reducing load times and preventing timeouts.
  • The change rule state dialog now defaults to the rule's current state instead of always showing on.
  • CEQASP-13219: Pivot details now load IP, organization, and ASN breakdowns correctly for tenants with data that predates a recent detection schema change.
  • Custom internal IP ranges you add are now prioritized correctly over third-party and external classification.
  • Corrected invalid character escaping in several EU AI Act system rules so they pass catalog validation.

Platform and infrastructure

  • Changes to the issuer registry now take effect without requiring a Policy Engine restart.
  • Airflow's API secret key and JWT secret now follow the platform's standard key configuration pattern.
  • Keycloak initialization resources now support custom annotations.
  • The Airflow component now appears correctly on the diagnostics system components screen.
  • CEQASP-13145: Fixed an issue where the IP allowlist and other system datasets could be reset to empty during an upgrade.
  • Upgrade initialization now resets cached entity tags so threat intelligence data refreshes correctly after an upgrade.
  • Improved the order in which Kafka resources are removed during environment teardown for cloud deployments.
  • Hardened the security context configuration for the platform's PostgreSQL database pods.
  • Updated the bundled sensor bridge and its build runner to the latest supported versions.
  • Pinned internal API security service dependencies to a stable release tag instead of a development branch.
  • CEQASP-13086: Fixed an issue where repeated API service restarts could queue an unbounded number of background Elasticsearch update tasks, degrading cluster performance.
  • CEQASP-13405: Resource discovery now aggregates records before writing them to Elasticsearch, reducing cluster load.

User interface

  • Tooltips now display the full URL instead of truncating it.
  • Fixed a display issue where the base path filter could be hidden behind the endpoints table at larger page sizes.
  • Updated the license for the UI data grid component library.
  • The agents overview page no longer shows an error when you open it after upgrading the platform.

Integrations and data export

  • Data export for risk events now completes successfully.
  • Risk events data export now groups records by rule contributor instead of by category.
  • CEQASP-13223: Fixed an issue where S3 data export credentials could become corrupted during configuration reconciliation, which broke telemetry export.
  • Custom policies with priority values greater than 200,000,000 now display correctly in the WAF section after an upgrade.

Customer-reported issues

  • CEQASP-12945: Custom URI parameterization patterns now validate regular expressions correctly before you save them.
  • CEQASP-12830: Updating an API specification to a new version now preserves the server URLs you previously configured instead of overwriting them.
  • CEQASP-13086: Fixed an issue where repeated API service restarts could queue an unbounded number of background Elasticsearch update tasks, degrading cluster performance.
  • CEQASP-13090: Improved the performance of the risk posture API for large result sets, reducing load times and preventing timeouts.
  • CEQASP-13145: Fixed an issue where the IP allowlist and other system datasets could be reset to empty during an upgrade.
  • CEQASP-13219: Pivot details now load IP, organization, and ASN breakdowns correctly for tenants with data that predates a recent detection schema change.
  • CEQASP-13223: Fixed an issue where S3 data export credentials could become corrupted during configuration reconciliation, which broke telemetry export.
  • CEQASP-13237: Previewing and saving a targeted URI parameterization pattern is much faster for hosts with large discovered endpoint inventories.
  • CEQASP-13405: Resource discovery now aggregates records before writing them to Elasticsearch, reducing cluster load.
Was this article helpful?
日本語（日本）