Skip to main content
Version: 5.3

What's New?

Version 5.3​

📅 Search Anywhere Framework version 5.3.0 released on February 2, 2026.

Critical changes

Please note the critical changes section.

Core​

⚡️ Changes
  • The appearance of the Metric visualization has been updated
  • Added the ability to enter custom values for filters of type Selection and Multi-selection in dashboards
  • Now, when editing a visualization on a dashboard, changes are applied automatically
Fixes

Core: Engine​

⚡️ Changes
  • Added the ability to configure access in ClickHouse through user role settings in Search Anywhere Framework
  • The search command now supports field comparison syntax: search <field>=<field>
  • Added the exclude parameter to the source command, allowing exclusion of indices from the search
  • Added the ability to create fields with dynamic names in the eval command
Improvements Fixes
  • Fixed the operation of the rename command when using characters (, ), and . in the rename pattern
  • Fixed incorrect field output after the fields/table command or after adding a field via eval in searches on source type ClickHouse
  • Fixed the operation of the following commands, which are translated to source type ClickHouse:
    • peval: substr, mvcoint, mvindex, cidrmatch
    • aggs: earliest/latest
  • Added the ability to use special characters in index names for OpenSearch/Elasticsearch connections: source os:os_sa_connection:'audit_t-2026':10

Core: Job Scheduler​

⚡️ Changes
  • Added the ability to configure the display order of Additional fields in the incident in the active action Create Incident
  • Added the ability to add custom headers in the active action Send Email
  • The Score field in the active action Risk Score Assignment now supports tokenization
Improvements
  • Local tasks can now be created in SP Server mode
  • Added a filter in the task list to separately view local and SP-tasks in SP Server mode
  • Added the ability for multiple editing of SP-tasks

User Behavior Analytics​

⚡️ Changes
  • The Objects page now supports filtering by basic and additional fields
  • Added an interface for displaying duplicates
  • Added the ability to manually run profiling policies
  • The profiling policy table now displays statistics of the last 5 runs
Improvements
  • Added the ability to filter objects in profiling policies and scoring calculations
  • General time interval fixation for all objects used in profiling policy and scoring calculations is now supported
  • Added cloning and bulk editing capabilities for profiling policies and object population configurations
  • Added bulk deletion capability for objects
  • Redesigned object creation and editing interfaces

Incident Manager​

⚡️ Changes
  • New interface for displaying incident history:
    • Added history filtering
    • Simplified comment input, expanded text styling functions
Improvements
  • Added display of the total number of incidents
  • Added the ability to configure the order of fields in the Additional Fields and Incident Details sections in the incident card

Move To Clickhouse​

Improvements
  • Expanded list of compatible data types
  • Added parameters for more flexible data transfer configuration
  • Added mechanisms to stop data transfer and track status

ASM 2.0​

⚡️ Changes
  • Added the ability to configure graph display using levels
  • Added import/export capability for layers and metrics

Inventory​

Improvements
  • Asset filters now allow entering custom values
  • PostgreSQL connection timeout can now be configured
Fixes
  • Optimized retrieval of asset count statistics
  • Fixed the Request failed with status code 503 Service Unavailable error during module initialization in the Module Settings section
  • Filters on the asset page are no longer reset after navigating to a specific asset and returning
  • Fixed migration error for fields created and updated in PostgreSQL

Content Management​

⚡️ Changes
  • Added the ability to upload tag types

Critical Changes​

  • Added new fields to the task structure: job_category, actions.incident.order_fields; field type score changed from float to text
  • New fields in the Incident Manager: Card Settings section can no longer be created with a . character in the identifier

Version 5.3.1​

📅 Search Anywhere Framework version 5.3.1 released on April 29, 2026.

Critical Changes

Please pay attention to the section on critical changes.

Core​

⚡️ Changes
  • Updated license format, now you can track expiration dates and support for each module on the Overview page
Fixes
  • Fixed automatic focus reset in text fields of visualization settings Metric
  • Added scaling of the search query editor when pasting a query from history
  • Fixed display of value instead of name in some cases in filters with Choice type on dashboards
  • In the Table visualization, fixed an error that occurred when configuring color display by field with null value
  • Transition from the Metric visualization on the dashboard page now opens a non-empty search query
  • Fixed date display in tooltips of the Metric visualization
  • Fixed white background appearance in the Metric visualization when no background color is configured
  • Fixed substitution of token values from the Metric visualization into dashboard filters and visualization title
  • Added additional escaping of returned field values in quick searches

Core: Engine​

⚡️ Changes
  • Added match command, allowing filtering and enriching data by field values from another source
Improvements
  • Added cluster setting for internal request timeout: sme.core.internal_timeout
Fixes
  • Fixed join command operation: now the command does not output an error if matching fields are not found in any document. Now in this case, the document will not be joined to the result and a warning will appear that the field is not in all data
  • Fixed transaction command operation after makeresults command
  • Fixed formation of result table fields after executing timeaggs command
  • Fixed millisecond truncation in tostring function of peval command
  • Fixed writing background query to disk if search results contain a number with BigDecimal data type

Core: Job Scheduler​

Fixes
  • Fixed search task update notification: now it contains the correct identifier

User Behavior Analytics​

Improvements

Incident Manager​

Fixes
  • Incident index rotation format standardized to <yyyy.ww> when creating an incident manually
  • Fixed incorrect tokenization of nested fields in Aggregation Settings (e.g., user.name)
  • Fixed display of custom workflow statuses in incident cards and aggregations; now available transitions are loaded correctly
  • Fixed display of dynamic options in responsible list when creating and editing incidents
  • Fixed icon action overlap in incident table during horizontal scrolling
  • Fixed display error when editing workflows

Move To ClickHouse​

⚡️ Changes
  • Added queue for simultaneous transfer of large number of indexes
  • Added setting to override field type
Fixes
  • Fixed handling of parent CB trigger: added retry policy

ASM 2.0​

Fixes
  • Metric status now updates correctly within the service
  • Fixed processing of incorrect graph configuration with dependencies on non-existent services or metrics
  • Now snapshots of metrics and services are created when importing a layer, as when creating them normally
  • Fixed error that prevented layer deletion

Inventory​

Fixes
  • Fixed display of source lists and linking fields when there are many elements
  • Fixed display of manual changes to additional fields of automatically created assets

Lookup Manager​

Fixes
  • When working with nested fields in a lookup, existing values are now updated instead of creating new fields

Knowledge Center​

Fixes
  • Users with write_all rights can now save files and add blocks in notes

SAF Beat Manager​

Fixes
  • Fixed error where internal database size increased too quickly

SAF Beat​

Fixes
  • Fixed error in tag binding to agents
  • Service now stops after agent removal

Critical Changes​

  • Updated MITRE ATT&CK work logic, now supports loading matrix versions not lower than 18.0, operation of already loaded matrices will not change