This article describes what changes when you upgrade Cequence App and API Protection (AAP) to release 9.4.x. The article is for administrators who plan and run AAP upgrades, and for analysts who use AAP after the upgrade. Most items apply to every upgrade. Some items apply only when you upgrade from release 9.2.x. Those items are marked in the tables.
SaaS environments are upgraded by Cequence. When you use SaaS, read the sections about rules, features, and data export. The platform sections apply mainly to on-premises installations.
Actions to take
The following table lists the changes that need action from you. The sections later in this article describe each change in more detail.
| Change | Applies to | Action |
Strimzi resources move from API version v1beta2 to v1. | Upgrades from 9.2.x | Before the upgrade, update any Strimzi resources that you manage outside the AAP Helm chart to use v1. |
| The Splunk HEC data export format changes. | All upgrades that use Splunk HEC export | After the upgrade, update your Splunk searches and dashboards for the new format. |
| Only one challenge template remains. | All upgrades that use challenge templates | Before the upgrade, save a copy of any customized challenge template that you want to keep. |
| Some risk rules are renamed or removed. | All upgrades | After the upgrade, review your enabled risk rules. |
| The traffic-stats component starts more slowly the first time. | All upgrades | Plan for a longer first start of the traffic-stats pod. |
| The API Security report has no data until the first daily snapshot. | All upgrades | Run the API Security report after 01:00 UTC on the day after the upgrade. |
Platform changes
These changes affect the Kubernetes workloads and Kafka resources that AAP installs.
| Change | Applies to | Details |
The traffic-stats workload changes from a StatefulSet to a Deployment. | All upgrades | The upgrade deletes the persistent volume claims of traffic-stats. When the pod starts, the pod rebuilds the local state store from Kafka changelog topics. For this reason, the first start takes longer than usual. |
The agent-assist workload replaces the ai-assistant workload. | All upgrades | The upgrade removes the old workload and creates the new workload. The elasticsearch-init job creates new Elasticsearch users for agent-assist. |
| Strimzi moves to release 1.2.0, and Kafka moves to release 4.3.1. | Upgrades from 9.2.x | The upgrade converts the Kafka, KafkaTopic, KafkaUser, and KafkaConnect resources from API version v1beta2 to v1 one time. Resources outside the AAP Helm chart that still use v1beta2 need an update. |
| New Kafka topics, connectors, and cron jobs are added. | Upgrades from 9.2.x | The new resources support 9.4 features: endpoint threat context, issue state, the API cleanup pipeline, and Bot Analyzer performance improvements. |
Data and index changes
These changes affect the Elasticsearch indices that store AAP data. AAP does not migrate data that already exists. New fields and settings apply to data that AAP writes after the upgrade.
| Change | Applies to | Details |
| Indices that are open on the day of the upgrade get new fields. | All upgrades | The new fields are endpoint IDs, traffic and error counts, threat context, and parameterized host and URI fields. Data written before the upgrade does not have values in the new fields. |
New indices use the best_compression codec. | All upgrades | New indices use less disk space. Indexing uses slightly more CPU. |
| New indices are added for 9.4 features. | All upgrades | The new indices store issue state, specification statistics, AFD results and verdicts, organization and ASN lists, cleanup status, and daily API Security snapshots. |
| Older indices keep their 9.2.x mappings. | Upgrades from 9.2.x | AAP does not migrate these indices. AAP deletes the indices when the retention period ends. |
| Mitigation pivot details work on older indices. | Upgrades from 9.2.x | Indices created on release 9.2.x store the challenge status field as text. Release 9.4 handles this field correctly, so mitigation pivot details work on old and new indices. |
Rule and configuration changes
The upgrade updates system rules and some configuration. The following table describes what the upgrade keeps and what the upgrade changes.
| Area | What changes | What the upgrade keeps |
| Expert rules | The upgrade adds 71 new rules for AI agent and MCP traffic, and updates the expressions of some existing system rules. | Disabled rules, custom weights, and custom rules. |
| Risk rules | The upgrade replaces the risk rules catalog with version 25, which has 228 rules. Rule names no longer include category or framework references, so some rules have new names. | Enabled rules and custom rules. When an enabled rule is not in version 25 of the catalog, the upgrade removes the rule and the rule's enabled state. |
| Challenge templates | AAP supports one challenge template. The upgrade keeps one template and removes the others. Every challenge policy then uses the remaining template. | One template. Customizations in the removed templates are lost. |
| Dynamic fingerprints | The upgrade updates the stock fingerprint algorithms. | Custom fingerprint algorithms. |
Changes that users notice
After the upgrade, users see the following differences in the AAP console.
Unified API inventory. The inventory adds traffic, error rate, threat, and Mitigated and Flagged information. The inventory has the following limitations in release 9.4.
- An endpoint that receives only blocked requests does not appear in the inventory.
- Block and Challenge information appears only when the endpoint had at least one allowed request on that day.
- The Mitigated and Flagged type filter lists only Allow, Rate Limit, and Challenged. A fix is planned for a later release.
Activity and Import History. These pages show only jobs that run after the upgrade. Imports and jobs from earlier releases do not appear.
Issue history. AAP now keeps issue history after the 15-day index retention period ends.
API definition history. Edits to API definitions now appear in the definition's History.
API Security report. The report uses daily snapshots. The first snapshot runs at 01:00 UTC after the upgrade. Until then, the report has no data.
Data export changes
The upgrade changes the format of one data export destination. The other destinations do not change.
| Destination | Change |
| Splunk HEC | Records were an escaped JSON string inside a body field. Records are now nested JSON, and every record has an event type field, headers.x-app-name. Update your Splunk searches and dashboards for the new format. When you roll back the upgrade, the export returns to the old format. |
| HTTP, Kafka, OpenSearch, S3, and syslog | No change. These destinations keep the same format. |
In release 9.4, risk transformation scripts are not applied to Splunk HEC exports. The export sends the script text as a field in the event instead.