Version 1.52
Version 1.52 improves the investigation workflow with faster bulk remediation, a new Email Threat issue timeline, comments, and clearer message classification.
🥳 New
Bulk select all message search results
You can now select all matching search results at once, up to 10,000, and apply bulk actions in a single operation when remediating large volumes.
Previously, bulk actions only applied to the current page of results. Large-scale remediation required repeated passes.
Before large deletions, you'll get a confirmation dialog to help prevent accidental, irreversible actions:
Email Threat Issue Timeline
Email Threat issues now have a dedicated timeline tab showing a complete chronological record of every event in an investigation — detections, triage decisions, remediations, and comments — with search, filters, and hover cards linked to messages, accounts, and remediations.
This replaces the scattered context of earlier releases with a single, unified investigation narrative:
Commenting in the Email Threat Issue Timeline
Use the new comments feature in the Email Threat issue timeline to capture investigation context directly in the timeline. Document why an action was taken, add handoff notes, or record findings for later review.
Material records the comment time and author automatically.
✨ Enhancements
Introducing Message Risk Type
In message details, you can now use the Risk Type dropdown to set a message’s risk type to Sensitive, Suspicious, or None, or override the existing value.
Marking a message Suspicious creates a new Email Threat issue.
Marking a message Sensitive adds it to sensitive message redaction.
You can also by risk type with the message.riskType MQL operator.
Domain-Aware Phishing Simulations
Simulations are now always scoped to a specific domain even in dedicated instances with multiple domains enrolled.
When no domain is pre-selected, a picker modal appears before simulation creation, and recipients in the enrollment dialog are filtered to match the simulation's domain. This prevents cross-domain contamination in simulation results for multi-domain organizations.
🐛 Fixes
Assignee filter now searches all accounts: The Issue queue Assignee filter previously only searched the first 10 pre-loaded accounts, so you couldn’t find yourself or anyone outside that initial set. It now performs live search as you type. Filter pills also display email addresses instead of raw IDs.
Grace period exception Category is now selectable: "Category" was appearing as a non-clickable group header in the exception type drop-down, blocking category-based exception creation.
Detection status correct for rule-backed detections: Message-rule-backed detections were showing as "Off" even when enabled, and the "Hide disabled" filter also misbehaved. Detection status now reflects the detection's own enabled state.
Resolve issue checkbox preserved when toggling delete: Toggling "Delete message" was clearing the "Resolve issue after remediation" checkbox. State is now preserved across toggles.
Rule signals shown when no ML hits exist: Rule-based detection rationale wasn't displayed on issues where no ML hits existed. Rule signals now appear regardless.
Custom integration cards organized by category: Custom SIEM, SOAR, and ticketing webhook cards were buried in a generic "Custom" section. They now appear in their relevant categories.
Cleared issue icon is clearer: The lock icon on cleared issue classifications implied a licensing restriction. It's been replaced with a minus-circle icon.
Email addresses display consistently: Email casing was inconsistent across views. Addresses now render consistently everywhere.
Email Threat Report calculations fixed: The Detection source and efficiency report denominator previously included all user-reported messages, including those ultimately marked spam or safe. To make Material’s detection percentage more accurate, now the denominator only counts messages from cases classified as malicious: Material-detected, auto-classified as malicious from a user report, and admin-reclassified to malicious.
Last updated
Was this helpful?