On July 31, 2026 we shipped SAF 6.1. In this article we walk through the main changes this version brings. For the full list of changes, see our documentation.
Streaming Correlator
SAF now includes a beta release of the Streaming Correlator. It processes events from your sources in real time, builds correlations, and performs active response actions with minimal latency.
A new Streaming Jobs section lets you process a data stream with three kinds of rules. A declarative rule fires when a signal occurs a set number of times within an interval. An imperative rule tracks stages and uncovers entire chains of violations. Aggregation collects metrics and checks them against your conditions.
We've also added Active Lists with auto-population and TTL-based cleanup, so you can quickly check for values even across millions of records.
New dedicated pages are available too: ingestion and processing statistics with cluster status, rule performance with a trigger log, and configuration of the sources being processed.
ML Studio
ML Studio is a Core component for managing the full lifecycle of machine-learning models. It lets you register algorithms, deploy them to compute environments, train models, and apply them to your data. Everything is managed from the SAF interface, while the computation runs on the sm-ml-service.
AI Observability
The new AI Observability module extends SAF's observability to your AI infrastructure. It brings telemetry from LLM services, GPUs, AI agents, and local AI clients into a single view of status, cost, and performance — with ready-made scenarios for operations, ML, and FinOps teams.
AI Security
AI Security equips SAF with threat detection for the AI perimeter. The module helps SOC and DevSecOps teams keep LLM services and AI agents in check: seeing detections mapped to the OWASP Top 10 for LLMs, auditing agent permissions, spotting signs of data disclosure, and investigating incidents in a single interface.
Job Scheduler
We've redesigned how run statistics are collected for the scheduler. The job list now shows run history and statuses, and you can drill into detailed stats for each active action.
There's also a new automatic run balancer with load visualization — it spreads jobs out evenly and suggests optimal schedule options.
