Version 1.49

Phishing Issues now more clearly show you the full list of recipients on any given message so you can gauge blast radius immediately, and our automated similarity matching engine is now called Auto Threat Hunt for clarity’s sake. Same capability, more intuitive name.

We also snuck in some quality of life updates: you can now use arrow keys to move between items while an overlay is open, so investigating a list of issues, accounts, or issues no longer means jumping in and out.

---

✨ Enhancements

Phishing Investigation

• Similarity Matching is now called Auto Threat Hunt: Same feature, clearer name. Admins can now easily understand how Material’s engine works. It automatically identifies related messages by examining multiple attributes of a message. These messages are then grouped and addressed collectively for efficient remediation.
• See who else received a specific message more easily: The Email Threats message view now has a recipients tab that shows everyone on To, CC, and BCC in a more upfront manner:

  

  From the issue detail view, click the message tab, then open message details
• Sender and recipient details front and center in the Message Detail view: From and Recipients now appear at the top of the Message Details view along with full sender reputation signals for the address and domain.

  
• Faster, more reliable Message Search: We upgraded the backend logic for message search to provide a more consistent and performant experience.

Platform Updates

• Set severity levels for sensitive categories:

  • Assign Critical, High, Medium, or Low severity to any sensitive category.
  • Material categories come pre-configured, and the sensitive categories list now sorts by severity. (If needed, override any severity from the detail panel):

  
• Arrow through list items without leaving an overlay: Keyboard navigation between items now works while an overlay is open across Accounts, Apps, Groups, Simulations, Detections, Investigations, Issues, and the File tables:

  
• Jump to a Group by pasting its ID: In the Groups Explorer tab, paste a Group ID into the search bar and find it immediately.
• Detections created by deleted users are attributed correctly: When a detection’s author has been removed, it now shows Deleted user {id} rather than assigning Material as the creator.
• Only provision licenses to accounts with active mailboxes: We introduced a new configuration option to restrict license allocation to accounts with a provisioned, active mailbox.
• Trusted Entities search is now case-INsensitive: No more worrying about capitalization when searching for a trusted entity.

  

Email Bomb Protection now available in Essentials

Material can detect email bomb attacks and remediate to restore availability to the inbox. This feature is now available in all packages.

Learn more about Email Bomb Protection here.

New Role

• A new role, Issue Responder / Global Issue Responder , is now available. Issue responders have read-only access to the detections and settings that generated the issue and can't perform message or file searches.

  

🐛 Fixes

• Drive session activity renders correctly: The session activity chart and file table in the evidence would sometimes not display. Both are fixed, with the full set of relevant activity types and no broken rows.
• Adding permissions to Drive files works correctly: Account and group selections in the Update External Permissions dialog were being dropped in the UI. Both paths work now.
• Matching criteria showing up when editing a sensitive category: The field was missing from the edit dialog. It’s back, pre-populated with your existing criteria.
• Detection details load cleanly without flashing: A re-render loop was causing the Created by field to flicker on load. Fixed.
• Long sender addresses no longer run off the screen: Truncated cleanly in phishing signals. Hover to see the full address.
• The search shortcut stays out of your way: It no longer steals focus when you’re typing elsewhere or when a dialog is open.
• New threat categories labeled correctly in Email Threats Summary: Categories with no prior-period history were showing a nonsensical percentage change. They now display “new this period.”

---

📚 New and Updated Documentation

• Updated offboarding instructions for ATOR

Have you tried our doc assist?

You can start a conversation with the agent and it will search our docs to give you personalized answers and point you the the related pages. Give it a try and let us know what you think!

To try it out, click the icon to the right of the search box called Ask Gitbook Assistant:

Once you've asked it a question, let us know what you think of the answer with a thumbs up or down directly in the chat so we can update and improve our docs.