> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/version-1.52.md).
# Version 1.52
Version 1.52 improves the investigation workflow with faster bulk remediation, a new Email Threat issue timeline, comments, and clearer message classification.
## :partying\_face: New
### Bulk select all message search results
You can now select all matching search results at once, up to 10,000, and apply bulk actions in a single operation when remediating large volumes.
Previously, bulk actions only applied to the current page of results. Large-scale remediation required repeated passes.
To get started, in the left navigation, expand Explorer and click Messages.
Before large deletions, you'll get a confirmation dialog to help prevent accidental, irreversible actions:
### Email Threat Issue Timeline
Email Threat issues now have a dedicated **timeline tab** showing a complete chronological record of every event in an investigation — detections, triage decisions, remediations, and [comments](#commenting-in-the-email-security-issue-timeline) — with search, filters, and hover cards linked to messages, accounts, and remediations.
This replaces the scattered context of earlier releases with a single, unified investigation narrative:
### Commenting in the Email Threat Issue Timeline
Use the new comments feature in the [Email Threat issue](/learn-more/risk-areas/email-threats/investigate/issue-details.md) timeline to capture investigation context directly in the timeline. Document why an action was taken, add handoff notes, or record findings for later review.
Material records the comment time and author automatically.
***
## ✨ Enhancements
### Introducing Message Risk Type
In **message details**, you can now use the **Risk Type** dropdown to set a message’s risk type to **Sensitive**, **Suspicious**, or **None**, or override the existing value.
* Marking a message **Suspicious** creates a new Email Threat issue.
* Marking a message **Sensitive** adds it to sensitive message redaction.
You can also by risk type with the `message.riskType` MQL operator.
### Domain-Aware Phishing Simulations
Simulations are now always scoped to a specific domain even in dedicated instances with multiple domains enrolled.
When no domain is pre-selected, a picker modal appears before simulation creation, and recipients in the enrollment dialog are filtered to match the simulation's domain. This prevents cross-domain contamination in simulation results for multi-domain organizations.
***
## :bug: Fixes
* **Assignee filter now searches all accounts:** The Issue queue Assignee filter previously only searched the first 10 pre-loaded accounts, so you couldn’t find yourself or anyone outside that initial set. It now performs live search as you type. Filter pills also display email addresses instead of raw IDs.
* **Grace period exception Category is now selectable:** "Category" was appearing as a non-clickable group header in the exception type drop-down, blocking category-based exception creation.
* **Detection status correct for rule-backed detections:** Message-rule-backed detections were showing as "Off" even when enabled, and the "Hide disabled" filter also misbehaved. Detection status now reflects the detection's own enabled state.
* **Resolve issue checkbox preserved when toggling delete**: Toggling "Delete message" was clearing the "Resolve issue after remediation" checkbox. State is now preserved across toggles.
* **Rule signals shown when no ML hits exist:** Rule-based detection rationale wasn't displayed on issues where no ML hits existed. Rule signals now appear regardless.
* **Custom integration cards organized by category:** Custom SIEM, SOAR, and ticketing webhook cards were buried in a generic "Custom" section. They now appear in their relevant categories.
* **Cleared issue icon is clearer:** The lock icon on cleared issue classifications implied a licensing restriction. It's been replaced with a minus-circle icon.
* **Email addresses display consistently:** Email casing was inconsistent across views. Addresses now render consistently everywhere.
* **Email Threat Report calculations fixed**: The **Detection source and efficiency** report denominator previously included all user-reported messages, including those ultimately marked spam or safe. To make Material’s detection percentage more accurate, now the denominator only counts messages from cases classified as malicious: Material-detected, auto-classified as malicious from a user report, and admin-reclassified to malicious.
\
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/whats-new/previous-releases/version-1.52.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
