Case Event Migration (version 1.51)

Beginning with version 1.51, we're retiring some legacy events:

• Existing subscriptions using the case events still work and you can still edit them
• case events can't be use for new subscriptions

The new events provide a consistent set of events across all detection categories, not just email threats. Use this guide to apply the new events to achieve similar outcomes. The tables below map legacy case events to their new replacements.

Legacy vs. Version 1.51 Event Subscription

Case Event Mapping

• Legacy case events are deprecated for new subscriptions
• New subscriptions should use the new events described below

• Existing subscriptions using case still work and you can still edit them
• If you choose to replace an existing event subscription with a new subscription using the new events, be sure to modify your receiver also to handle the new payload

Message Category

Legacy Event	New Event	Notes
Message Detected as Suspicious	Subscribe to: Issue Change Type: CREATE Detection Types: Email Threat for most scenarios including new threat detected, new message added to an existing issue, etc.	Use this event if you want notifications for all detected messages, including those that don’t create an Issue. This can happen if a message is detected but matches a Trusted Entity configured to not create Issues, or you’ve configured a User Report threshold so an Issue is only created when a message is reported by multiple users.

Case Category

Legacy Event	New Event	Notes
Case Analysis Updated	Issue Change Filter to: Type: UPDATE Detection Types: Email Threat	Event payload will include changes in before and after properties.
Case Message Exemption Updated	Issue Change Filter to: Type: UPDATE Detection Types: Email Threat Check the box to Include events for messages being added, removed, or interacted with in an Email Threat issue	In the event payload, look for messageChange.type = REMOVE
Case Message Interacted	Issue Change Filter to: Type: UPDATE Detection Types: Email Threat Check the box to Include events for messages being added, removed, or interacted with in an Email Threat issue	Use this to identify when: A user reports a message already in a case A user reads a message in a case
Case Message Warning Bypassed	Issue Change Filter to: Type: CREATE Detection: "Account clicked through speedbump on a phishing message"	Material includes a Detection for this scenario. You can create an event subscription for any Issues found by that Detection.
Case Remediation Updated	Issue Change Filter to: Type: UPDATE Detection Types: Email Threat	Event payload will include changes in before and after properties.
Case Reporter Acknowledgement Updated	Issue Change Filter to: Type: UPDATE Detection Types: Email Threat	Event payload will include changes in before and after properties
Case Reviewed Status Updated	Issue Change Filter to: Type: UPDATE Detection Types: Email Threat	Event payload will include changes in before and after properties
New Case Created	Issue Change Filter to: Type: CREATE Detection Types: Email Threat	As of version 1.56, the Issue Change payload now includes the fields that were previously unique to this legacy event: message subject and recipients (msgSubject, msgTo, msgCc, msgBcc), detection source (detectedBy), and sender reputation (senderReputation). Full field details are in your Material instance under Integrations > API and MCP > Events > Issues.