Skip to main content
Version: 5.3

What's New?

Version 5.3​

📅 Smart Monitor version 5.3.0 released on February 2, 2026.

Critical Changes

Pay attention to the section with critical changes.

Core​

⚡️Changes
  • Updated appearance of Metric visualization
  • Added ability to input custom values for filters with Selection and Multi-selection types in dashboards
  • Now when editing visualization on dashboard, changes are applied automatically
Fixes

Core: Engine​

⚡️Changes
  • Added ability to configure access to ClickHouse through user role settings in Smart Monitor
  • Now in search command available field comparison syntax: search <field>=<field>
  • Added exclude parameter to source command, allowing to exclude indexes from search
  • Added ability to create fields with dynamic names in eval command
Improvements Fixes
  • Fixed operation of rename command using characters (, ) and . in rename pattern
  • Fixed incorrect field output after fields/table commands or after adding field via eval in search by ClickHouse source type
  • Fixed operation of following commands translated to ClickHouse source type:
    • peval: substr, mvcoint, mvindex, cidrmatch
    • aggs: earliest/latest
  • Added ability to use special characters in index names for OpenSearch/Elasticsearch connections: source os:os_sa_connection:'audit_t-2026':10

Core: Job Scheduler​

⚡️Changes
  • Added ability to configure display order of incident Additional fields in active action Create Incident
  • Added ability to add custom headers in active action Send Email
  • Now tokenization supported for Score field in Risk Score Assignment active action
Improvements
  • Now in Server SP mode possible to create local tasks
  • Added filter in job list allowing to view local and SP-job separately in Server SP mode
  • Added ability for multiple editing of SP-job

User Behavior Analytics​

⚡️Changes
  • On Objects page now available filtering by base and additional fields
  • Added interface for displaying duplicates
  • Added ability for manual launch of profiling policies
  • Table with profiling policies now displays statistics of last 5 runs
Improvements
  • Added ability to filter objects in profiling policies and scoring calculations
  • Now supports fixing common time interval for all objects used when calculating profiling policies and scoring
  • Added ability to clone and bulk edit for profiling policies and object fill configurations
  • Added ability for bulk deletion of objects
  • Redesigned interfaces for creating and editing objects

Incident Manager​

⚡️Changes
  • New interface for displaying incident history:
    • Added filtering by history
    • Simplified comment input, expanded text styling functions
Improvements
  • Added display of total number of incidents
  • Added ability to configure field order in Additional Fields and Incident Details sections in incident card

Move To ClickHouse​

Improvements
  • Extended list of compatible data types
  • Added parameters for more flexible data transfer configuration
  • Added mechanisms for stopping data transfer and tracking status

RSM 2.0​

⚡️Changes
  • Added ability to configure graph display using levels
  • Added ability for import/export of layers and metrics

Inventory​

Improvements
  • Now possible to input custom values in asset filters
  • Now possible to configure PostgreSQL connection timeout
Fixes
  • Optimized getting statistics on number of assets
  • Fixed Request failed with status code 503 Service Unavailable error when initializing module in Module Settings section
  • Now filters on assets page are not reset after going to specific asset and returning back
  • Fixed error migrating created and updated fields to PostgreSQL

Content Management​

⚡️Changes
  • Added ability to upload tag types

Smart EDR​

⚡️Changes
  • Added support for SSL connection to Kafka with possibility of one-way and two-way authentication
  • Added telemetry analysis dashboard
Fixes
  • Now pipelines specify correct names of Kafka topics used in EDR "out of the box"
  • On Smart EDR: Detected Threats dashboard added handling of null values for fields

Smart Code​

⚡️Changes

  • Now module supports Continent 4 components

  • Redesigned Continent: Attack Detector dashboard (supported for both Continent versions):

    • Added panels with basic information about selected device (ID, IP address, node key status, table with main node information)
    • Added panels with general and detailed attack information (attack intensity, classification, attack information, top-10 attack sources and targets)

  • Redesigned Continent: Access Server dashboard:

    • Added panels with basic device information (ID, IP address, access server certificate expiration date, node key status, number of connected users relative to license)
    • Added panels with user and event information (table of active users, connection log, unauthorized access events, reference table for user certificates - X.509 data and expiration date)

  • Enhanced Continent: Architecture and Configuration dashboard:

    • Added panel with pairwise connection graph (VPN network scheme of AKSH)

  • Added task for sending IPS attacks to Incident Manager

  • Implemented automatic incident creation when user certificate expires

Critical Changes​

  • Added new fields to task structure: job_category, actions.incident.order_fields, field type score changed from float to text
  • New fields in Incident Manager: Card Settings section now cannot be created with . character in identifier

Version 5.3.1​

📅 Smart Monitor version 5.3.1 released on April 29, 2026.

Critical Changes

Please pay attention to the section on critical changes.

Core​

⚡️Changes
  • Updated license format, now you can track expiration dates and support for each module on the Overview page
Fixes
  • Fixed automatic focus reset in text fields of visualization settings Metric
  • Added scaling of the search query editor when pasting a query from history
  • Fixed display of value instead of name in some cases in filters with Choice type on dashboards
  • In the Table visualization, fixed an error that occurred when configuring color display by field with null value
  • Transition from the Metric visualization on the dashboard page now opens a non-empty search query
  • Fixed date display in tooltips of the Metric visualization
  • Fixed white background appearance in the Metric visualization when no background color is configured
  • Fixed substitution of token values from the Metric visualization into dashboard filters and visualization title
  • Added additional escaping of returned field values in quick searches

Core: Engine​

⚡️Changes
  • Added match command, allowing filtering and enriching data by field values from another source
Improvements
  • Added cluster setting for internal request timeout: sme.core.internal_timeout
Fixes
  • Fixed join command operation: now the command does not output an error if matching fields are not found in any document. Now in this case, the document will not be joined to the result and a warning will appear that the field is not in all data
  • Fixed transaction command operation after makeresults command
  • Fixed formation of result table fields after executing timeaggs command
  • Fixed millisecond truncation in tostring function of peval command
  • Fixed writing background query to disk if search results contain a number with BigDecimal data type

Core: Job Scheduler​

Fixes
  • Fixed search task update notification: now it contains the correct identifier

User Behavior Analytics​

Improvements

Incident Manager​

Fixes
  • Incident index rotation format standardized to <yyyy.ww> when creating an incident manually
  • Fixed incorrect tokenization of nested fields in Aggregation Settings (e.g., user.name)
  • Fixed display of custom workflow statuses in incident cards and aggregations; now available transitions are loaded correctly
  • Fixed display of dynamic options in responsible list when creating and editing incidents
  • Fixed icon action overlap in incident table during horizontal scrolling
  • Fixed display error when editing workflows

Move To ClickHouse​

⚡️Changes
  • Added queue for simultaneous transfer of large number of indexes
  • Added setting to override field type
Fixes
  • Fixed handling of parent CB trigger: added retry policy

RSM 2.0​

Fixes
  • Metric status now updates correctly within the service
  • Fixed processing of incorrect graph configuration with dependencies on non-existent services or metrics
  • Now snapshots of metrics and services are created when importing a layer, as when creating them normally
  • Fixed error that prevented layer deletion

Inventory​

Fixes
  • Fixed display of source lists and linking fields when there are many elements
  • Fixed display of manual changes to additional fields of automatically created assets

Lookup Manager​

Fixes
  • When working with nested fields in a lookup, existing values are now updated instead of creating new fields

Knowledge Center​

Fixes
  • Users with write_all rights can now save files and add blocks in notes

Smart Beat Manager​

Fixes
  • Fixed error where internal database size increased too quickly

Smart Beat​

Fixes
  • Fixed error in tag binding to agents
  • Service now stops after agent removal

Critical Changes​

  • Updated MITRE ATT&CK work logic, now supports loading matrix versions not lower than 18.0, operation of already loaded matrices will not change

Version 5.3.2​

📅 Smart Monitor version 5.3.2 was released on June 22, 2026.

Critical Changes

Pay attention to the section on critical changes.

Core​

Improvements
  • Added support for ClickHouse drivers version higher than 0.9.6
Fixes
  • Fixed an issue where part of the filter settings interface on the dashboard was hidden beyond the page boundary
  • Now when navigating to the results of a background task, a new query is not launched instead of displaying results from disk
  • The search interval now correctly applies to the query when launched via the Ctrl+Enter key combination
  • Fixed the display of the JDBC Queries page in module settings when special characters are entered in the search bar
  • In the Bar Chart visualization, fixed display when the Vertical Layout option is activated on the Main tab
  • In the Single Value visualization, fixed rendering of negative values when the Shorten Large Numbers option is disabled
  • In the Single Value visualization, trend is now built not only when using timechart and timeaggs commands
  • Now when changing filters located inside visualizations on the dashboard, the transition to the top of the dashboard no longer occurs
  • Fixed work with SP-tasks: editing, assigning tags and access rights now works correctly
  • Fixed field statistics display error on the search page: Error while calculating sidebar : OpenSearchParseException[Failed to parse content to map]

Core: Engine​

Improvements
  • In the eval command, basic mathematical operations now support working with arrays

Core: Job Scheduler​

Fixes
  • In the Create Incident active action, if the field referenced by the token contains a null value, a dash is now substituted in the incident description
  • When the Do Not Run for Each Result option is enabled in the Write to DB active action, one request is now formed for all search results

Incident Manager​

Fixes
  • Fixed pagination calculation: the number of pages now corresponds to the selected number of rows per page
  • Now workflow transition can be reassigned from one status to another without errors
  • Added validation of required fields when creating (Title and Description) and editing (Severity and Responsible) incidents

Inventory​

Fixes
  • Fixed hanging of the asset database update process
  • Eliminated cases of data loss when processing data from OpenSearch indexes by the engine
  • Asset cleanup by TTL no longer triggers if the option is active in at least one configuration

Knowledge Center​

Fixes
  • Fixed display of incident details in notes: visibility and field order are now taken into account, and values of Choice, Multi-choice, Date, and markdown fields are displayed correctly

Smart Beat Manager​

Fixes
  • Fixed operation of Status and Connection filters on the Clients tab

Critical Changes​

  • Now, in the incident manager's active action, information about the calling user is always passed in the format: 
    "user": {       
         "name": ...,        
         "backend_roles": [ ... ],         
         "roles": [ ... ]   
    }
    Previously, the user object could contain other fields. For example, text or value