Skip to main content
Version: 6.1

What's New?

Version 6.1.0​

📅 Search Anywhere Framework 6.1.0 was released on July 31, 2026.

Critical Changes

Review the Critical Changes section.

🔥What's New in Search Anywhere Framework​

Streaming Correlator​

The Search Anywhere Framework platform now includes a beta version of Streaming Correlator, a clustering-enabled module that processes events from data sources in real time, correlates them, and performs active actions on detected events with minimal latency.

⚡️New
  • The new Streaming Jobs section supports three types of data stream processing rules:
    • Declarative - a single condition applied to an event. The rule is triggered when an attribute occurs a specified number of times within an interval
    • Imperative - staged analysis for detecting chains of violations
    • Aggregation - metric collection and compliance checks
  • Active Lists with automatic population and TTL-based cleanup are now available. They provide fast value lookups across millions of records
  • Separate pages are now available for:
    • Statistics, including data ingestion metrics such as EPS, throughput, and average event size; event processing metrics; and the status of the cluster and active lists
    • Rule performance and the trigger log
    • Data source configuration

ML Studio​

ML Studio provides a unified service and interface for working with ML models, including jobs, training, application, and prediction, with invocation from SAFL, Service Monitor Toolkit, and other modules.

⚡️New
  • The general workflow is: register an algorithm - deploy its image to an environment - start training - obtain a model - apply the model:
    • Algorithm - an implementation of an ML method. Each algorithm is associated with an image, which is the container image in which the algorithm code runs
    • Runtime environment - a compute environment (Docker or Kubernetes) in which images are deployed and jobs run
    • Deployment - an algorithm instance running in a specific environment with assigned resources (CPU, memory, and GPU). Jobs send requests to the deployment
    • Job - a single execution of a fit (training) or apply (application) operation on a deployment
    • Model - the result of successful training. It references the algorithm and the job that created it
  • Models can now be trained and applied directly from the search bar using the train and predict commands

AI Observability​

The new AI Observability module extends Search Anywhere Framework observability to AI infrastructure. It consolidates telemetry from LLM services, GPUs, AI agents, and local AI clients into a unified view of status, costs, and performance, with ready-to-use scenarios for operations, ML, and FinOps teams.

⚡️New
  • AI infrastructure observability dashboards provide a unified environment overview, agents, traces, LLM costs, service metrics, GPU status, and local AI clients
  • End-to-end analysis of AI requests through traces is now available, including span details, a request map, bottleneck detection, and tool-call-level errors
  • GPU observability has been added, including utilization, memory, temperature, and hardware errors, to help identify equipment degradation early
  • LLM cost transparency has been implemented, including tokens and costs by model and provider, detection of abnormal cost growth, and identification of the most expensive requests
  • Observability has been added for developers' local AI tools, including Claude Code and Codex
  • GPU fleet inventory now provides up-to-date specifications for each GPU
  • Service Monitor Toolkit metrics now include the AI environment in the overall health model, covering GPUs, request duration, and trace errors, with early degradation signals
  • Telemetry collection has been configured across the entire AI stack, including GPUs and inference servers, the LLM gateway, agents, and local clients. Data is normalized to a unified model based on OpenTelemetry GenAI

Core​

Improvements
  • The search query input has been improved with autocompletion for command argument and function names
  • Auto-refresh has been added to the active searches page. The tab now refreshes automatically at a specified interval
  • Custom icons can now be uploaded to the system
  • Custom icons can be configured in the Quick State and Metric visualizations
  • Cell descriptions can now be configured in the Quick State visualization
  • Categories in the Tree Map visualization can now be excluded by right-clicking an item
Fixes
  • Fixed an issue where values from one dynamic dashboard filter appeared in another dynamic filter
  • Fixed click token substitution, such as $click.label$, in search queries when a dashboard visualization is clicked

Core: Engine​

Improvements
  • The train and predict commands are integrated with the ML Studio service
  • Range boundaries can now be specified for the random function in eval and peval
  • Variables can now be passed as the second and third arguments to eval replace
  • The eval mvmap command has been added to perform an operation on each array element
Fixes
  • Fixed incorrect processing of negative integer and decimal values by the peval function for opensearch and ClickHouse data sources

Core: Job Scheduler​

⚡️Changes
  • Job execution statistics collection has been redesigned. The Jobs List now shows the execution history and statuses, with detailed statistics for each active action in a job
  • An automatic scheduled job execution balancer with load visualization has been implemented. It distributes job executions evenly and suggests optimal schedule options
Improvements
  • Headers can now be excluded from messages in the Send Email active action

AI Security​

AI Security can now analyze events from LLM services and AI agents, their permission configurations, and related incidents. The module detects prompt injection, data disclosure, resource attacks, excessive agent permissions, dangerous actions, and signs of model theft.

Improvements
  • Dashboards have been implemented for analyzing LLM threats, AI agent permissions, and signs of model theft
  • Threat detection jobs based on OWASP Top 10 for LLM Applications categories have been added, with automatic incident registration
  • Detection has been implemented for prompt injection, confidential information disclosure, limit violations, dangerous commands, and agent privilege escalation attempts
  • Permission configuration monitoring has been added for AI agents, including confirmation mode, sandbox, network access, origins, and allowlists and denylists
  • Signature and baseline value lookups have been added for detection rules

Incident Manager​

⚡️Changes
  • SLA support has been implemented. Incident processing deadlines can now be configured for different scenarios. SLA violations can trigger scripts automatically, and statistics for all SLAs are available on a dedicated dashboard
  • A simplified partial-match incident search has been added. You can now search by part of a word without using *
Improvements
  • Ad hoc actions can now be applied to multiple incidents or aggregations at once
  • Tags can now be assigned to multiple incidents at once
  • A limit on the number of generated incidents has been added to the Create Incident active action
  • The Workflow column has been added to the incident table
  • Fields with large amounts of content are now collapsed by default in the incident card
  • Search transitions without specified time boundaries now use the time boundaries from the search job
Fixes
  • Fixed an issue where file storage settings were not applied after a cluster restart

Inventory​

Improvements
  • Filters in the asset list have been optimized. They now find any value without quantity limits and work faster even with a large number of assets

Knowledge Center​

Fixes
  • Fixed an issue where attached files were not transferred when notes were exported and imported through JSON

Lookup Manager​

⚡️Changes
  • The pages for creating a lookup and displaying its data have been redesigned:
    • The data table has been improved with quick filtering, array support, change highlighting, column reordering, and other features
    • When a lookup is created for an existing index, its field information is loaded automatically. When creating a lookup from scratch, you can select field data types and the index is created automatically
Fixes
  • Fixed incorrect handling of wildcard fields, where value did not match value*

Move To ClickHouse​

⚡️Changes
  • The Delete By Max Size action has been added to delete data based on the total size of an index group. It controls the amount of data stored on disk by deleting some older indexes when the specified limit is exceeded
Improvements
  • Data transfer to ClickHouse has been improved with ignore_malformed processing, a date format parameter, type conflict resolution in favor of a broader type, correct conversion of objects with nested fields to JSON strings, and other enhancements

SAF Beat Manager​

Improvements
  • Applications can now be cloned directly in the web interface

User Behavior Analytics​

⚡️Changes
  • Profiling policy management capabilities have been expanded:
    • A policy can now be canceled while it is running
    • If a policy completed with an error or warning, the calculation can be restarted
    • Individual algorithms can be managed, stopped, and restarted
    • Calculations for one or more specific objects can now be stopped or restarted
    • Policy calculations can now be started for objects selected in the list

Service Monitor Toolkit​

⚡️Changes
  • A user interface for configuring maintenance windows has been implemented. You can now select time intervals during which a metric does not affect services
  • An interface for managing adaptive metric calculations has been added. It allows you to:
    • Track calculation statuses and history
    • Start and restart calculations for a specified period
Improvements
  • The analytics center, metric, and service card visualizations have been improved

Critical Changes​

The fields field in the .smos_incident-* index is migrated from object to flat_object

After migration, the fields.* fields are no longer available for aggregations. Review dashboards, reports, and search queries that aggregate by fields.*; they must be revised.

The first version of the resource-service model (ASM v1) has been removed

Routes have been replaced with the current version, and old links to ASM v1 no longer work. Layers must be migrated to ASM v2. For details, see ASM Layer Migration.