Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Version 1.53

Version 1.53 adds a message activity timeline, AI model attribution, and broader CSV exports to deepen investigation context. It also improves issue counts, attachment context, trusted sender visibility, and tenant-aware detection filtering.

🥳 New

Message activity timeline

Message details now include a full event timeline for each message. It displays detections, issue assignment, remediation, redaction, and analyst comments in one scrollable view.

Use the timeline to trace a message from first detection to final action without switching views. When the message belongs to an issue, related issue context also appears.

This builds on the issue-level timeline introduced in Version 1.52. For more investigation context, see Issue Details.

Message details now show the full history for a message in one view.

AI model attribution in message analysis

When Material AI flags a message, the analysis card now shows the model name and version that produced the result.

This makes AI-driven detections easier to audit, compare, and report on.

Learn more about Material message analysis here.

Version 1.53 message analysis card showing the AI model name and version for a Material AI result.
Message analysis now shows the AI model name and version.

✨ Enhancements

CSV exports across Explorer

New CSV export options make ad hoc analysis easier:

  • Accounts and Groups now support CSV export.

  • Each export supports up to 20,000 rows.

  • Exports respect active filters.

With this change, every Explorer view now supports CSV export. The Issues CSV also adds four columns:

  • Issue ID

  • Assignee

  • Ignore reason

  • Resolve reason

version 1.53 CSV export options for Explorer views and Issues export fields.
CSV exports now cover all Explorer views

Issue count in the issues table

In the ungrouped Issues view, the header now shows the total number of issues that match your current filters. The count stays visible while more results load, so you always know how many issues you're looking at before you start triaging.

The issues count stays visible while more results load.

MIME type column in message attachments

The message attachments view now shows MIME type. Analysts can confirm a file's actual type without opening or downloading it.

MIME type helps confirm an attachment's actual file type.

Trusted Entity badge in sender reputation

When a message sender matches a configured trusted entity, the sender reputation section now shows a Trusted Entity badge with a direct link to Trusted Entities.

This makes manual trust decisions easier to spot during investigation.

Version 1.53 sender reputation section showing a Trusted Entity badge and link for a matched sender.
Sender reputation now highlights trusted entities.

Filter detections by tenant type

The Detections list now filters by the selected tenant's email provider:

  • Google Workspace hides Microsoft 365-only detections.

  • Microsoft 365 hides Google Workspace-only detections.

  • Global shows all detections.

System-agnostic detections, such as Okta, always appear.

🐛 Fixes

  • Messages no longer attach to cleared issues: Incoming email threat messages were sometimes assigned to issues that were already cleared or closed. Messages now land in the appropriate open issue.

  • Assignee lists now load completely: The Assign to... menu on issue details and bulk assignment now loads the full list of assignable accounts with pagination. Analysts in larger organizations can now find the right assignee.

  • Duplicate trusted entity API errors now return 409: Creating an existing trusted entity through the API now returns 409 Conflict instead of 500 Internal Server Error.

🗑️ Removed

  • Known Breaches: We removed the Known Breaches feature. It previously checked addresses against the HaveIBeenPwned (HIBP) breach database.

📚 New and Updated Documentation

PreviousVersion 1.54
NextVersion 1.52

Last updated

Was this helpful?