SecNova AI-SIEM V3.0.3 Release Notes

SecNova V3.0.3 brings NovaQL to GA, unifying security analytics, detection, visualization, and AI, while introducing a lakehouse architecture, a new AI Agent foundation, and fine-grained log access controls to reduce data costs and strengthen detection and automation.

Key Feature Updates

NovaQL GA

SecNova's self-developed query language for security analytics provides a consistent query capability for analysts, detection rules, visualization dashboards, and AI assistants.

Query Language

• Compatible with commonly used KQL operators, including where, summarize, extend, project, join, union, distinct, take, and sort.
• Supports multi-value expansion and structured data processing, including mv-expand, mv-apply, arg_max, arg_min, let variables and subqueries, and make_series time-series queries.
• Provides built-in functions for strings, date and time, IP addresses, JSON extraction, aggregation, and more.
• Currently provides approximately 160 analytics operators and functions.

Data Model

Provides a three-layer query view: physical Index + OCSF + data source Dataset.

• Uses OCSF classes as logical data sources, so users do not need to understand the underlying physical indexes, such as ocsf_events, authentication activity, network activity, or HTTP activity.
• Treats entities such as users, endpoints, and devices as first-class citizens.
• Supports querying data through syntax such as dataset("azure.entra"), without requiring knowledge of the underlying physical storage Index.
• Native JSON columns are automatically parsed into structured fields, such as dst_endpoint.ip and metadata.product.name, and can be accessed directly through dot-path notation.

Detection Integration

• Detection rules and Context Jobs are both expressed through NovaQL.
• Query results can be written to reference tables or enriched datasets for rule correlation and joins.

AI Capabilities

• Supports generating NovaQL directly from natural language. For example, entering “recent high-risk network events” automatically generates an executable query with a time window and result limit.
• The generation process is aware of user-visible data sources and follows the same permission model.

Security, Multi-Tenancy, and Data Source ACL

• Tenant-level database isolation gives each tenant an independent database boundary.
• User-level data permissions allow Index and data source ACLs to be configured by role, ensuring that users can access only authorized sources.

Editing Experience

• Includes a NovaQL editor with syntax highlighting and catalog and field auto-completion.
• Displays query details with read-only syntax highlighting.

Lakehouse Architecture Upgrade

Significantly reduces data costs and supports long-term compliance storage:

1. Hot data storage now uses CK by default. Disk usage is approximately one-third of the previous version.
2. Cold data storage uses Iceberg for long-term, low-cost storage in compliance scenarios. Object storage costs are approximately one-tenth of the previous solution.
3. All cold data can be queried directly at any time, without importing or loading it.
4. NovaQL can query both cold and hot data.

Detection Engine

1. Supports NovaQL as the detection syntax.
2. The real-time detection engine, currently in Preview, supports defining detection rules with NovaQL over streaming data. A syntax subset is supported; some syntax is available only for Scheduled Queries.
3. Adds Context Jobs for scheduled NovaQL tasks. Results can be stored in Reference Tables or physical indexes for rule correlation analysis.

NovaQL-Native Dashboards and Reports

1. Supports defining visualization widgets through NovaQL.
2. Significantly improves the customization workflow for Reports and Dashboards.

New AI Agent Foundation

1. AI Chat first-token latency is significantly reduced, resulting in faster responses.
2. The AI tool runtime supports cloud and edge Broker scheduling. AI Agents and automated workflows can interact with customer on-premises environments without requiring VPN tunnels or public network exposure.
3. AI tool invocation supports human-in-the-loop approval.

Fine-Grained Log Index Management

1. Supports writing different data sources to different physical indexes.
2. Physical indexes support independent lifecycle configuration.
3. Physical indexes support role-level ACL configuration.