Traceable Platform Agents and Tracing Agents are released asynchronously from the platform features and they can be found here. 

API Catalog

• We now detect the following security headers out of the box for all APIs:

  • HSTS - Secure HTTP transport
  • CSP - Content security policy
  • CORS - Cross-origin resource sharing

• ‘NOT’ Operator for API Endpoint filters
  
  

API Protection

• Data Protection - Live View 

  • All sensitive data types part of Traceable built-in Data classifiers or custom data classifiers accessed by users can be seen based on access patterns for the last one week. 
  • Geo map, IP, User based filtering for specific data sets
  • Unique sensitive data usage counters per type to help customers get indicators on data accessed/exfiltrated by users/bots etc

• Multi part Encoding support - Data capture and blocking based on 

multi-part content type. Following options are supported - 

• Multipart/form-data based on RFC1867

This content type is intended to allow information providers to express file upload requests uniformly, and to provide a MIME-compatible representation for file upload responses.

• Alerting on Security config change and User create/edit

Data Collection

Platform Agent - 1.24.0 - 26th September

Traceable's 1.24.0 release has the following updates:

• Multipart/form-data - Traceable agent's 1.24.0 release supports redaction and truncation of multipart/form-data.
• eBPF - Traceable agent's 1.24.0 release provides an install script for eBPF and Platform agent on a virtual machine. You can download the install script by navigating to install > traffic mirroring > linux > latest folder on Traceable's download site.
• Environment scoped blocking rules - With Traceable agent's 1.24.0 release, Platform agents receive blocking rules that are specific to that environment.
• XML body redaction - Traceable's 1.24.0 agent release supports redaction of XML bodies.

NGINX Agent - 0.1.72 - 26th September

Traceable's NGINX agent 0.1.72 release has the following updates:

• Support for new NGINX versions - Traceable's NGINX agent 0.1.72 supports NGINX's versions 1.21.5, 1.21.6, 1.22.0, 1.23.0, and 1.23.1.
• multipart/form-data support - Traceable's NGINX agent 0.1.72 supports multipart/form-data. Configure the capture_content_types directive in the traceableai block. Note that multipart/form-data support requires Traceable's Platform agent 1.24.0.

API Security Testing

• Jenkins Plugin is available now. Here’s the documentation to get started: Traceable AST CI/CD plugins 
• GitHub action is ready to use and released in GitHub marketplace: https://github.com/marketplace/actions/traceable-ast-action 
• DefectDojo Integration
• Delete scan option available now

• Mutations and assertions are available now: 
  
• Environment based redaction settings are available now: 
  

AuthN/ AuthZ coverage: JWT coverage is added. We now detect confusion attacks, token expiry and invalid signature. 

Platform

We added support for SAML group mapping to allow our customers the automated ability to map SAML group roles to Traceable roles