Skip to main content
Version: 6.2

What's New?

Version 6.2.0​

📅 Search Anywhere Framework 6.2.0 was released on November 2, 2026.

Critical Changes

See Critical Changes.

🔥What's New in Search Anywhere Framework​

AI Assistant​

Search Anywhere Framework now includes an AI assistant, a chat interface for working with data. Describe a task, and the assistant selects operations, queries data sources and the knowledge base, and prepares a response.

⚡️New
  • The assistant answers questions about indexes, fields, and platform objects, analyzes events for a specified period, and explains Search Anywhere Framework settings
  • The assistant creates and explains SAFL queries; you can edit and run a suggested query directly in the conversation
  • Results are displayed in interactive cards with tables and visualizations
  • You can refine a response with follow-up questions and return to previous conversations using search and pinned items in the history
  • Searches are limited by the account's permissions and, if enabled in settings, require confirmation
  • Both on-premises and cloud-hosted models are supported

User Behavior Analytics​

The User Behavior Analytics module has been redesigned. An object's risk score is now broken down by individual rule contributions, and related detections are grouped into anomalies.

⚡️New
  • The module's home page is now Overview, which shows the highest-risk objects, the number of anomalies for a period, and their distribution by zone
  • Risk scores now use a 0-100 scale. The Why This Score page shows each rule and rule family contribution, compares an object with its environment, and accounts for watchlist effects
  • Anomalies are generated based on a score threshold, a set or sequence of rule families, and are collected in a common feed
  • The Anomaly Investigation tab shows which rules triggered, in what order, and how the score changed
  • Reactions to profile deviations are configured in the policy, and the UBA scheduler query is generated automatically
  • Watchlists have been added: important objects in a watchlist receive a risk-score bonus or multiplier

Broker​

Broker is a new messaging mechanism in Search Anywhere Framework. Modules send events to it, such as an incident being opened, a risk score changing, or an asset being updated. The broker associates each event with a host, account, or other entity. The object card brings together information from all sources and the object's relationships.

⚡️New
  • The Message Sources page lets you select the modules and event types to collect
  • Journal stores all received messages and indicates whether each one was linked to an object
  • Identification Rules specify which fields are used to associate data from different modules with the same object
  • The timeline shows sequences of events that regularly occur in succession, while the graph shows relationships with other objects

Data Storage​

Search Anywhere Framework now supports connections, data units, and search spaces. These make it possible to add ClickHouse alongside OpenSearch and search both storage systems in a single query without depending on the physical location of the data.

⚡️New
  • A connection stores a storage system's address and credentials and displays its status. A connection for the primary OpenSearch storage is created in advance; an administrator configures a ClickHouse connection
  • A data unit gives a name to an index, index pattern, alias, or table and collects source statistics: size, record count, time range, and field schema
  • A search space combines data units from OpenSearch and ClickHouse, such as recent events and an archive. A query addresses it by name, and functions such as search, aggs, and peval run on the storage side
  • Permissions for connections, data units, and search spaces are assigned separately

Active Actions​

Active Actions are now shared across the platform: configure each action once and use it in different modules.

⚡️New
  • python scripts can now accept input parameters
  • An active action defines how a script runs: which parameters to show to the user, which ones the user can change, and the default values and available options
  • Actions can be run from scheduler jobs, manually for one or more incidents, in workflow transitions, and in SLA
  • Existing active actions under Incident Manager - Active Actions are marked as deprecated

Database Observability​

The new Database Observability module monitors PostgreSQL health and incorporates DB clusters and instances into Search Anywhere Framework operational processes. It collects telemetry from system views, Patroni, PgBouncer, and logs, converts it to a unified data model, and links it to Inventory assets, the Service Monitor Toolkit health model, and Incident Manager cards.

⚡️New
  • Eight PostgreSQL operations dashboards are available: fleet overview, instance state, queries, locks and transactions, replication and HA, capacity and growth, access audit, and collection diagnostics
  • 28 jobs have been added; 24 of them register incidents for events such as instance unavailability, connection saturation, query degradation, locks and deadlocks, replication failures and inactive slots, XID consumption, autovacuum lag, database growth, and collection failures
  • Query performance analysis is available, including a baseline cost, comparison with the baseline, and a query card with its text, metrics, and execution plan
  • High-availability clusters are monitored for node role changes, replication lag and failures, slots and retained WAL, the PgBouncer client queue, and WAL archiving errors
  • Data access auditing is based on pgaudit events and the PostgreSQL log
  • Two AI scenarios are available for incident analysis: explaining a slow query plan and summarizing a load change
  • DB inventory includes three Inventory asset types (cluster, instance, and instance extension) and relationships between them
  • Eight global Service Monitor Toolkit metrics and a health model with a root service have been added: instance availability, connection saturation, replication lag, time spent waiting, cache hit shortfall, wraparound risk, autovacuum lag, and DB errors
  • A DB incident type with a card and runbook, and two SLA policies for response time and resolution time, have been added
  • Agentless collection is configured on the database server: 13 configurations collect metrics and state, and the SAF Beat application collects logs

Core​

⚡️Changes
  • Interface. The appearance has been updated for a consistent look and behavior across all sections
  • Dashboards.
    • Scheduled PDF export is available, with the status of the five latest runs; regular exports are also faster
    • Dashboard query management has been added: running visualizations can be stopped or restarted all at once, and filter application can be deferred until all values are entered
  • File Storage. Shared connections of type S3 or Disk can be linked to Incident Manager and Knowledge Center modules
Improvements
  • Visualization icons. They can now be managed in the interface. A dedicated page lists built-in and custom icons with their query names and supports searching, filtering, and copying a name in one action. Custom images can be uploaded and deleted without server access; their format, size, and SVG validity are checked before saving
  • Search Anywhere. A Cluster Name (cluster_name) field has been added to the ClickHouse configuration form
Fixes
  • Visualizations (Quick State). Fixed rendering when exporting a dashboard to PDF

Core: Engine​

⚡️Changes
  • Query execution statistics have been redesigned. For each command and service process, the number of incoming and outgoing documents, duration in seconds, and volume of processed data are now shown
  • The limits settings interface and the behavior of some limits have changed
Fixes
  • Importing painless scripts (GET _sme/importScripts) no longer creates duplicate records

Core: Job Scheduler​

⚡️Changes
  • The Send E-mail active action lets you select a sender for an individual job. If no sender is selected, the address from the global setting is used. A mail server connection check has been added
  • Suppression can be configured for an individual event field value, such as a specific host. You can also configure an exception so that a job always triggers for a matching event
Improvements
  • The webhook action can now send requests through an HTTP proxy

SAF AI Service​

⚡️Changes
  • AI presets are now configured under Main Menu - Settings - Module Settings - AI Presets

Service Monitor Toolkit​

Improvements
  • The interface now provides step-by-step metric-to-service linking and a button to refresh the graph

Incident Manager​

⚡️Changes
  • Incident comments and files can now be edited and deleted
Improvements
  • Dynamic field options are now available wherever the fields are used: in the Job Scheduler's Create Incident action, incident type and access settings, and groups
  • All Inventory information is now visible directly in the incident card

Inventory​

⚡️Changes
  • Watchlists have been added: named sets of asset objects for use by other modules. Their composition is defined by a rule and can be supplemented with pinned objects
  • The PostgreSQL connection is configured under Main Menu - Settings - Module Settings - General - System Database. The password is entered in the interface, and the connection is checked from every cluster node
Improvements
  • Repeated asset collection is faster: changes are processed more quickly, and unchanged data is no longer overwritten
Fixes
  • Fixed errors that caused concurrent collection runs to interfere with each other
  • Relationships are now recalculated after a manual asset is created, changed, or deleted
  • Assets with empty key fields and duplicate assets are no longer saved

AI Observability​

The AI Observability module now provides organization-level Claude Code usage analytics: members and subscription seats, work outcomes, spending, subscription limits, and equivalents of Anthropic reports generated from collected telemetry.

⚡️Changes
  • Five Claude Code analytics dashboards have been added: Overview, Organization, Team and Productivity, Member, and Subscription and Billing
  • Eight jobs populate lookups with data equivalent to Analytics API and Compliance API reports and subscription spending summaries, based on module telemetry
  • Three subscription alerts register incidents in Incident Manager when a limit window is exhausted, 80% of the weekly window is used, or subscription limit data collection stops
  • Six disabled jobs provide examples of querying these lookups with the api command
  • Claude Code telemetry ingestion over OTLP and a collector for subscription limit usage have been added
  • The installation utility adds gen_ai_* ingest pipelines, nine claude_code_* lookups, and an ai command preset
  • The AI Observability: Claude Code dashboard has been removed. Dialogs, events, and application errors are now shown on AI Observability: Claude Code - Overview
  • An AI summary has been added to the AI Observability: GPU State dashboard, showing overall state, detected issues, and recommendations
  • The GPU inventory job is enabled by default and runs every five minutes
  • In the OTLP domain .env file, SEARCH_ANYWHERE_FRAMEWORK_VERIFY_SSL has been renamed to SEARCH_ANYWHERE_FRAMEWORK_SKIP_SSL_VERIFY, and OTEL_TRACES_PORT, OTEL_METRICS_PORT, and OTEL_LOGS_PORT have been removed: ports are now set using DATA_PREPPER_*_PORT
Fixes
  • Events received over OTLP are written to gen_ai_events; previously, the collector accepted them but did not forward them
  • OTLP domain startup has been fixed: the collector passes configuration validation, Data Prepper starts, and their ports match
  • The installation utility creates gen_ai_*-000001 write indexes with gen_ai_* aliases. Previously, a new installation had no write alias, so retention policy rollover did not work

Updating from 6.1​

  • Install version 6.2 of the installation utility before importing the content module (Utility Installation). If version 6.1 collection has already written to gen_ai_* indexes, the utility exits with code 3 and prints commands for moving data to the write indexes; run those commands
  • After each content module import, run the utility with the --bind-ism-policies flag; otherwise, retention policies are not linked to the write indexes (Module Installation)
  • Run the utility separately with the --remove-legacy-dashboards flag to delete the AI Observability: Claude Code dashboard; it remains after the update
  • Delete edited copies of the module dashboards in the interface; otherwise, those copies open instead of the updated dashboards
  • Replace the otlp_collector directory and transfer the settings to the new .env file. With the version 6.1 file, the Data Prepper container stops (Data Collection Setup)

AI Security​

The AI Security module now performs semantic checks of LLM prompts and can detect prompt injection even when an attacker changes the wording. Static and semantic analysis run together to broaden threat coverage.

⚡️Changes
  • A local embedding model fine-tuned on examples of attacks and safe prompts in Russian and English has been added
  • Semantic search against threat references is available, with a separate similarity threshold for each reference
  • An optional external AI model can verify detected matches (Additional AI Analysis)
  • The incident card now includes the detection method, semantic similarity score, and the external model's explanation when AI analysis is enabled

Cyber Security​

The Cyber Security module now includes threat detection rules for Windows, Active Directory, Linux, Kubernetes, nginx, and IIS, as well as ready-to-use data collection configurations for each source.

⚡️Changes
  • More than 200 detection rules have been added for Windows and Active Directory, Linux, Kubernetes, and the web perimeter: nginx, IIS, and Windows DNS Server. The module now contains 713 rules covering 126 MITRE ATT&CK techniques and sub-techniques
  • Sources for nginx, Microsoft IIS, Windows DNS Server, and Windows system logs (System, Application, and Windows Defender) have been added
  • Ready-to-use data collection configurations are available for all nine sources
  • Recommended source settings have been added to the module distribution
  • Each rule now includes a detailed description of its rationale
  • Implementation guides have been added for configuring sources and auditing in the infrastructure, and for enabling and tuning rules
  • Three module incident dashboards have been added: incident overview, attacker assets, and targeted assets
  • Rule fields now follow a unified model: names conform to ECS, and incident titles follow the "host, source, user" format
  • The incident card now includes an investigation playbook with a consistent field order
  • Rules without a corresponding data source have been removed from the distribution, and rule descriptions have been revised
  • Authentication, IAM, email, and web activity dashboards without corresponding data sources have been removed from the distribution. They will return as the module's source coverage expands

Critical Changes​

  • Search Limits. Settings have moved to sme.core.limits. The allowed_dt_start / allowed_dt_end pair has been replaced by max_dt_interval, which limits the duration of a time range in seconds rather than its boundaries. max_command_ram_usage has been removed without a replacement
  • Job Scheduler Suppression. Records are now stored in the .sm_throttling_v2 index instead of .sm_throttling, and the mechanism is enabled for a job with the throttle.enabled flag