> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/reference/case-event-migration-version-1.51.md).

# Case Event Migration (version 1.51)

Beginning with version 1.51, we're retiring some legacy events:

* Existing subscriptions using the `case` events **still work and you can still edit them**
* `case` events can't be use for **new** subscriptions

The new events provide a consistent set of events across all detection categories, not just email threats. Use this guide to apply the new events to achieve similar outcomes. The tables below map legacy `case` events to their new replacements.

<figure><img src="/files/4HwwFNylMMleT2MY0qiV" alt=""><figcaption><p>Legacy vs. Version 1.51 Event Subscription</p></figcaption></figure>

## Case Event Mapping

* Legacy `case` events are deprecated for **new** subscriptions
* New subscriptions should use the new events described below

{% hint style="success" %}

* Existing subscriptions using `case` still work and you can still edit them
* If you choose to replace an existing event subscription with a new subscription using the new events, be sure to modify your receiver also to handle the new payload
  {% endhint %}

### Message Category

| Legacy Event                   | New Event                                                                                                                                                                                                                                                                           | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Message Detected as Suspicious | <p>Subscribe to:</p><p><code>Issue Change</code></p><ul><li><strong>Type:</strong> <code>CREATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code> for most scenarios including new threat detected, new message added to an existing issue, etc.</li></ul> | <p>Use this event if you want notifications for all detected messages, including those that don’t create an Issue.</p><p>This can happen if a message is detected but matches a <a href="https://docs.material.security/learn-more/administration/trusted-entities">Trusted Entity</a> configured to not create Issues, or you’ve configured a User Report threshold so an Issue is only created when a message is reported by multiple users.</p> |

### Case Category

| Legacy Event                          | New Event                                                                                                                                                                                                                                                                                                                                                                      | Notes                                                                                                                                                                                                                                                                                                                                                                                                 |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Case Analysis Updated                 | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>UPDATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code></li></ul>                                                                                                                                                                                              | Event payload will include changes in before and after properties.                                                                                                                                                                                                                                                                                                                                    |
| Case Message Exemption Updated        | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>UPDATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code><br></li></ul><p>Check the box to <strong>Include events for messages being added, removed, or interacted with in an Email Threat issue</strong> <img src="/files/2QtI7eElbE8BfWWkqK5V" alt=""><br></p> | In the event payload, look for `messageChange.type = REMOVE`                                                                                                                                                                                                                                                                                                                                          |
| Case Message Interacted               | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>UPDATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code><br></li></ul><p>Check the box to <strong>Include events for messages being added, removed, or interacted with in an Email Threat issue</strong> <img src="/files/2QtI7eElbE8BfWWkqK5V" alt=""></p>     | <p>Use this to identify when:</p><ul><li>A user reports a message already in a case</li><li>A user reads a message in a case</li></ul>                                                                                                                                                                                                                                                                |
| Case Message Warning Bypassed         | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>CREATE</code></li><li><strong>Detection</strong>: "Account clicked through speedbump on a phishing message"</li></ul>                                                                                                                                                                    | Material includes a Detection for this scenario. You can create an event subscription for any Issues found by that Detection.                                                                                                                                                                                                                                                                         |
| Case Remediation Updated              | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>UPDATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code></li></ul>                                                                                                                                                                                              | Event payload will include changes in before and after properties.                                                                                                                                                                                                                                                                                                                                    |
| Case Reporter Acknowledgement Updated | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>UPDATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code></li></ul>                                                                                                                                                                                              | Event payload will include changes in before and after properties                                                                                                                                                                                                                                                                                                                                     |
| Case Reviewed Status Updated          | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>UPDATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code></li></ul>                                                                                                                                                                                              | Event payload will include changes in before and after properties                                                                                                                                                                                                                                                                                                                                     |
| New Case Created                      | <p><code>Issue Change</code></p><p>Filter to:</p><ul><li><strong>Type:</strong> <code>CREATE</code></li><li><strong>Detection Types:</strong> <code>Email Threat</code></li></ul>                                                                                                                                                                                              | As of version 1.56, the `Issue Change` payload now includes the fields that were previously unique to this legacy event: message subject and recipients (`msgSubject`, `msgTo`, `msgCc`, `msgBcc`), detection source (`detectedBy`), and sender reputation (`senderReputation`). Full field details are in your Material instance under **Integrations** > **API and MCP** > **Events** > **Issues**. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/reference/case-event-migration-version-1.51.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.