Skip to main content
Version: 6.0

What's New?

Version 6.0​

📅 Search Anywhere Framework version 6.0.0 released on April 30, 2026.

🔥What's New in Search Anywhere Framework​

Service Monitor Toolkit​

The Service Monitor Toolkit module has appeared in the Search Anywhere Framework platform. It provides observability at infrastructure, service, and application levels. It unites metrics, logs, and traces in a unified health model, correlates events from heterogeneous sources, and helps find root causes of failures

⚡️Changes
  • Added Investigations section - deep analysis and correlation of metrics on a single timeline
  • Root Cause Analysis is now available - automatic search for root causes of service degradation by dependency graph
  • Added ability to create Analytics Hub - a single window for operational monitoring of service health
  • Native integration with Inventory module - automatic construction of health models from existing assets and their relationships
  • Metrics now have the ability for dynamic calculationof criticality ranges using mathematical algorithms and ML
  • Metrics now have time windows configuration, allowing precise criticality tuning depending on time and days of the week
  • Maintenance mode is now available for metrics, you can add exceptions in the form of time periods when the metric state is not calculated and does not affect service health

SAF AI Service​

Added SAF AI Service for integrating large language models into Search Anywhere Framework via a unified API and ai command.

⚡️Changes
  • Implemented summary and per_row modes for summarization, analysis, classification, and intelligent data enrichment in SAFL-pipelines
  • Added model registry with centralized management of available models and execution parameters
  • Implemented structured output with support for deterministic results for analytics, investigations, and automation
  • Added limits and auto-truncation mechanisms for controlling data volume, overload protection, and predictable execution of large queries
  • Implemented integration with Langfuse for monitoring, tracing requests, quality control, and model usage analysis

AI Security​

Added AI Security module to protect artificial intelligence systems, corporate search, and agent scenarios from new types of threats

⚡️Changes
  • Implemented detection of malicious instructions, hidden commands, dangerous documents, and secret data leaks
  • Added tool abuse control for detecting dangerous action chains, privilege escalation, and unauthorized operations
  • Implemented data leak analysis through agents, including email, messengers, command line, browser, and cloud services
  • Added change verification mechanism for identifying new vulnerabilities after updating instructions, policies, and available tools
  • Implemented security policy layer for applying access restrictions, preventing leaks, and generating protection recommendations

Core​

⚡️Changes
  • OpenSearch updated to version 3.5.0

Core: Engine​

⚡️Changes
  • Added semanticsearch command for semantic search through documents. Supports meaning-based search using vectorization models and helps find relevant data even without exact keyword matches
  • Added ai command for integrating large language models into SAFL-pipelines. Allows performing summarization, per-row data analysis, result enrichment, and intelligent string processing directly in queries with support for structured output, limits, and controlled execution.

ACM​

⚡️Changes
  • Completely redesigned health models display:
    • Clear display of available services and their status
    • Ability to set service as "parent" for analyzing its relationships
    • Extended model navigation with ability to adjust display levels, hide and expand relationships, view parents of current service
    • New Service Card page with display of all associated services and metrics, additional attributes, and state change history
  • Metrics are now global and can be bound to different health models

Incident Manager​

⚡️Changes
  • Added ability to configure various Incident Types, in which you can specify:
    • What set of fields will be in the card of a specific type
    • Which roles will have access to incidents of a specific type
    • How the card will be displayed. You can add multiple card views in one incident type. For different roles, visibility and editing capability for individual fields can be configured
  • Added ability to attach files to incident history, as well as save and render them in comments
  • Added ability to configure connection to S3 storage for file storage

User Behavior Analytics​

⚡️Changes
  • Now in the task scheduler active action Risk Score Assignment you can configure detailing, with transition to search or link from the list of risk score assignments in the object profile

Servers​

⚡️Changes
  • The Servers module has been completely redesigned for centralized monitoring of Linux and Windows server infrastructure
  • Simplified data collection: ready configurations are supplied for quick connection and monitoring startup
  • Added 5 new dashboards for infrastructure, servers, and process control
  • Implemented server inventory for unified infrastructure accounting
  • Added 6 ready-made infrastructure incident scenarios:
    • High CPU load
    • High RAM consumption
    • High Load Average
    • Critical filesystem filling
    • Detection of zombie processes
    • Absence of current metrics from server

Version 6.0.1​

📅 Search Anywhere Framework version 6.0.1 was released on June 22, 2026.

Critical Changes

Pay attention to the section on critical changes.

Core​

Improvements
  • Added cluster permission cluster:admin/sm/nav_settings/write to allow access to editing the navigation menu
  • Added support for ClickHouse drivers version higher than 0.9.6
Fixes
  • Fixed an issue where part of the filter settings interface on the dashboard was hidden beyond the page boundary
  • Now when navigating to the results of a background task, a new query is not launched instead of displaying results from disk
  • The search interval now correctly applies to the query when launched via the Ctrl+Enter key combination
  • Fixed the display of the JDBC Queries page in module settings when special characters are entered in the search bar
  • In the Bar Chart visualization, fixed display when the Vertical Layout option is activated on the Main tab
  • In the Single Value visualization, fixed rendering of negative values when the Shorten Large Numbers option is disabled
  • In the Single Value visualization, trend is now built not only when using timechart and timeaggs commands
  • In the Heatmap visualization, fixed color scheme update without recreating the series
  • In the Pie Chart visualization, fixed color palette update when changing the visualization theme
  • Now when changing filters located inside visualizations on the dashboard, the transition to the top of the dashboard no longer occurs
  • Fixed work with SP-tasks: editing, assigning tags and access rights now works correctly
  • Fixed field statistics display error on the search page: Error while calculating sidebar : OpenSearchParseException[Failed to parse content to map]

Core: Engine​

Improvements
  • In the eval command, basic mathematical operations now support working with arrays

Core: Job Scheduler​

Fixes
  • In the Create Incident active action, if the field referenced by the token contains a null value, a dash is now substituted in the incident description
  • When the Do Not Run for Each Result option is enabled in the Write to DB active action, one request is now formed for all search results

Incident Manager​

Fixes
  • Now workflow transition can be reassigned from one status to another without errors
  • Added validation of required fields when creating (Title and Description) and editing (Severity and Responsible) incidents
  • Fixed display of dynamic options in incident type fields in creation and editing windows, including for fields not included as filters

Inventory​

Fixes
  • Fixed hanging of the asset database update process
  • Eliminated cases of data loss when processing data from OpenSearch indexes by the engine
  • Fixed an error where asset cleanup by TTL was triggered if this option was active in at least one configuration

SAF Beat Manager​

Fixes
  • Fixed operation of Status and Connection filters on the Clients tab

Critical Changes​

  • Now, in the incident manager's active action, information about the calling user is always passed in the format: 
    "user": {       
         "name": ...,        
         "backend_roles": [ ... ],         
         "roles": [ ... ]   
    }
    Previously, the user object could contain other fields. For example, text or value

Version 6.0.2​

📅 Search Anywhere Framework version 6.0.2 was released on October 9, 2026.

Core​

Fixes
  • Search:
    • Ctrl+Backspace in the search query field now removes the last word instead of the entire query
    • restored search in the Search History section for queries containing special characters such as |, =, ", (, @, and \
    • the selected time range is no longer reset to the default value when a query is run with keyboard shortcuts
    • opening an incomplete background job now displays a loading indicator until the request completes instead of a result-reading error
    • fixed incorrect error highlighting in query text after a single \ character inside a string in the form of """<string>"""
  • Dashboards:
    • fixed the transfer of $time.isPaused$ and $time.refreshInterval$ tokens in custom visualization links
    • restored support for $click.label$ and $click.category$ tokens
  • Security Settings: fixed duplicate validation error text in role, internal user, and permission creation forms
  • File Storage: saved settings are now applied after restart
  • Index Patterns: improved loading speed of the Module Settings - Index Patterns page

Core: Engine​

Fixes
  • a function can now be passed as the first argument to the relative_time command
  • the format command now escapes double quotation marks in values
  • fixed the lookup command when used with lookup fields of the wildcard type

Core: Job Scheduler​

Fixes
  • the description column in the Jobs List is no longer truncated
  • fixed an issue with jobs that use an action from an uninstalled module, for example MITRE ATT&CK Technique Fixation without the Mitre Attack module

Move To ClickHouse​

Improvements
  • improved data transfer to ClickHouse for complex data type conversion cases:
    • added escaping for the ` character in field names, so these fields are now transferred successfully
    • when an object field is explicitly redefined as String, its child fields are ignored
    • when old and new types are combined in a view, the widest type is selected, for example String instead of Int64, rather than the last type
    • added handling for the ignore_malformed scenario
    • added a parameter for specifying the date format
    • added handling for known type mismatch cases: decimal and exponential numbers
Fixes
  • improved the stability of bulk migration for large indices when started through POST _ism/move_to_click/<index>. The number of concurrent migrations is now limited, and restarting migration for an index that is already being migrated does not create a competing job

ASM​

Fixes
  • a service page opened outside the model graph through a direct link, in a new tab, or after page refresh no longer appears empty
  • the model graph now loads even when the model contains dependencies on deleted services

Knowledge Center​

Fixes
  • navigating to a nonexistent article or an article without read permission no longer causes the page to freeze: a page-not-found message is displayed
  • note attachments and images are now transferred when notes are exported and imported through JSON
  • removed an unnecessary note save button that discarded changes

Service Monitor Toolkit​

Fixes
  • fixed model imports after updating from 5.3.0 to 6.0.0
  • fixed owner and creation date display
  • Metrics:
    • the checkbox in a filtered list header now selects only visible metrics instead of all metrics
    • a metric is no longer created when proceeding to the second step of the wizard if creation is then canceled

Incident Manager​

Fixes
  • fixed error 500 when the Incident Manager is opened by a user without the cluster:admin/sme/search permission
  • the selfassign action now assigns the assignee correctly when status changes
  • fixed attachment of files in some formats, such as .msg, to comments
  • the Assignee filter now displays a unified list of static and dynamic values: the list is no longer incomplete or replaced after a value is selected
  • Incident Card:
    • line breaks are now preserved in Multiline Text fields in incident cards and the incidents table
    • Multi-select field values are no longer displayed as a single concatenated string: a separator is shown between them
    • fixed overlapping labels and values for long fields in the Additional Fields section
    • fixed incorrect display of functional fields in the description and title of incident aggregation
  • Incident History: fixed indentation and \ character display in comments
  • Module Settings:
    • all static values can now be removed from the Assignee field
    • an incident type can now be created without selecting additional fields
    • Access Configuration:
      • configured values are no longer reset when the order of items in role-to-view mappings changes
      • the window no longer closes and discards unsaved changes when switching browser tabs or remaining inactive

Inventory​

Fixes
  • added duplicate validation when an asset object is created manually