Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Version 1.55

Version 1.55 introduces the OAuth Remediation Agent in beta, giving you real-time visibility into every connected app in your environment and the ability to revoke OAuth tokens automatically.

This release also adds a new detection for Microsoft verification code abuse, plus a wide range of enhancements to the API, integrations, and investigator workflows.

🥳 New

OAuth Remediation Agent

Material's OAuth Remediation Agent gives you real-time visibility into every OAuth connection in your Google Workspace environment, and the ability to act on them automatically.

spinner

The agent:

  • Automatically classifies OAuth connections based on severity, risk, and business impact, using a unique understanding of each application's runtime behavior and potential reach

  • Instantly detects new OAuth connections and continuously audits existing ones, performing the deep investigation an analyst would otherwise need to do manually

  • Can revoke OAuth tokens automatically and flag critical risks for review, so your team stays in control without managing every connection manually

View your authorized applications in Explorer > Apps, and configure classification settings in Settings > OAuth Apps. Learn more about the OAuth Remediation Agent here.

connected apps, risk classifications, and remediation options in the Explorer

OAuth monitoring is available on all plans.

  • Essentials plans receive notifications when new app connections are detected and can manually revoke tokens and set classifications.

  • Advanced plans also get AI-powered investigations and automatic remediation.

Join our June 16th webinar with VP of Product and Design John Hrvatin for hands-on guidance on setting up and using OAuth management and remediation features. Sign up here!

New detection for Microsoft verification code abuse

This release adds an improvement to recently-reported abuse of Microsoft infrastructure to send spam links. This update joins a batch of tuning improvements across impersonation, infrastructure abuse, account takeover, and bulk-mail detection families we've recently made.

✨ Enhancements

API & MCP

MCP server: Claude Desktop support

You can now connect the the Material MCP via Claude desktop in addition to Claude Code and Cursor, with a paste-ready claude_desktop_config.json snippet. Learn more.

Claude Desktop configuration example for connecting to the Material MCP server.
Use the provided Claude Desktop config to connect to the Material MCP server.
API actor indicator in issue timeline

Issue timeline entries for actions performed via the API now show a </> code icon next to the actor, matching the audit log. You can now tell at a glance whether a remediation was applied manually or by automation.

API v1 enhancements

  • Set issue classification via API. API v1 now lets you set an issue classification. If you don't include an explicit remediation, the API automatically applies the default remediation configured for that classification. Programmatic responders get UI-consistent behavior without computing it themselves.

  • Typed error codes in OpenAPI spec. API v1's OpenAPI spec now documents typed error codes, so client integrations can handle errors reliably without pattern-matching against free-text strings.

API v1 is currently in limited release. Learn more about API v1.

Consistent API message summary shape

The message summary returned in search results and issue-message edges now uses the same field structure as the full message object. You can parse both with the same schema, with no need to handle them separately.

Navigation rename: "API and MCP"

The API section under Integrations is now labeled API and MCP in the left navigation, so you can find both entry points in one place:

Left navigation showing the Integrations section renamed to API and MCP.
The left navigation now labels this section as API and MCP.

Integrations

Copy Test Event for integrations

Events associated with integrations that contain a JSON payload now have a Copy Test Event button. Clicking it opens a modal with the full JSON payload and a copy-to-clipboard control, so you can build a receiver without sending test events and logging the payload manually.

To copy the test event:

  1. From a saved integration, open an event row.

  2. Click Copy Test Event to open a modal with the full JSON payload and a copy-to-clipboard control.

You need to save your integration first for this option to appear. See Integration Fundamentals for more details.

Integration event details view with the Copy Test Event action available.
From an integration, open an event row to copy test event.

Clone an event subscription

A new Clone action on each event in an integration duplicates an existing subscription's configuration into a new draft. This is useful when building several similar subscriptions without having to create from scratch each time.

Integration event subscription row showing the Clone action.
Use Clone to duplicate an existing event.

Issues & Investigation

"Assign to me" on issues

Issue detail pages now include an Assign to me action under All Actions, so analysts can take ownership without searching for themselves in the assignee picker.

Issue details page showing the Assign to me action in the All Actions menu.
Assign to me is available from the All Actions menu on an issue.

Filter issues by response

The Issues view now includes a Response filter, so you can find issues by the remediation that was applied, such as Spam, Block Links, Revoke token for all users, and more.

Issues filter panel showing the Response filter options.
Filter issues by the remediation response that was applied.

"View on issues list" everywhere

All related-issues tables now include a link to the full Issues view (previously this link only appeared on tables with five or more rows).

Related issues table showing the View on issues list link.
Related-issues tables now link directly to the full Issues view.

EML filenames include the subject

Downloaded .eml files are now named {messageId} - {subject}.eml, making it easier to identify messages at a glance when reviewing downloads in batches.

Detection & Administration

Delete calendar events in custom detection responses

The Delete associated calendar events remediation is now available as an automatic response option for Custom Detections.

  1. To view your existing custom detections, from Detections filter to Created By Admins.

  2. Open a custom detection.

  3. Under Response, add Delete associated calendar events

Custom detection response settings showing the Delete associated calendar events option.
Custom Detection Detail View

"Powered-by" branding toggle

A new admin setting under End-User Support lets you show or hide the Powered by Material branding on your user-facing emails and pages.

  1. From the top toolbar, click Settings (the cog icon).

  2. Click End-User Support.

  3. Toggle Material branding on or off.

    End-User Support settings showing the Powered by Material branding toggle.
    Admins can show or hide Powered by Material branding in End-User Support settings.

🐛 Fixes

  • Multi-recipient email subscriptions now deliver: A bug was causing email event subscriptions with more than one recipient to fail silently. They now deliver as intended, and the UI guides you to separate multiple addresses with commas.

  • Model version display: The model version in the Analysis card is now driven by the model family rather than hardcoded versions. When more than one model ran on an issue, the card now correctly displays the latest. Previously, nothing was shown.

  • Audit log filter for API tokens: When you click View Audit Events on an API token, the audit log now shows the token as a visible, clearable filter chip, consistent with other audit log filters.

  • Character counter and instant comments: Issue comment dialogs now show a live character counter with a warning when the 512-character limit is exceeded. New comments also appear in the timeline immediately rather than after a short delay.

  • Sensitive-term mail filters now honor exemptions: The sensitive-terms detection was incorrectly triggering on excluded keywords in Gmail and Outlook mail filter detections. For example, a filter set to exclude a subject keyword would still generate an alert. This is now fixed, reducing false positives on messages users have deliberately filtered out.

  • Link extraction improvements: Fixed edge cases in URL parsing in messages, improving detection quality.

  • Email threat issue summaries now include all signals: Issue summaries were sometimes finalized before all analysis completed, permanently omitting signals like "Domain + BEC/Fraud Risk" or "Missing Domain Info." Summaries now regenerate when additional signals arrive, so analysts get the full picture.

  • Issue counters update after issue merge: After merging issues, the surviving issue's message and account counts now reflect post-merge totals immediately, rather than waiting for an unrelated event to trigger the update.

  • Email Bomb detection visible per tenant: On multi-tenant instances, Email Bomb detection was missing from the Detections list when filtering to a single tenant. Multi-tenant admins can now see and tune it per tenant as expected.

  • Trusted Entity Recommendations accessible to domain-scoped users: Domain-scoped users were hitting a 403 on the Trusted Entity Recommendations page. This is now fixed.

  • Scroll jump fixed in Message Details: Switching tabs between Recipients and Headers inside Message Details no longer causes the page to appear to jump to the top.

📚 New and Updated Documentation

PreviousVersion 1.56
NextVersion 1.54

Last updated

Was this helpful?