> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/version-1.57.md). # Version 1.57 Version 1.57 adds MQL search support for messages caught by surge protection, closes a gap in the audit trail for detection disabling, and improves calendar remediation to better preserve legitimate meetings during email threat cleanup. This release also adds a new Recipient column in the Issues list, improves sender attribution in forwarded-email issues, and includes fixes for integration reliability and display accuracy. *** ## :partying\_face: New ### **Search for messages surge affected messages** A new MQL field, `message.status.is_surge`, lets you find every message caught by Email Bomb Protection. Use it to investigate the full scope of an attack: who was affected, what was held, and when. This field applies to messages processed after version 1.57. Email Bomb Protection events from earlier releases won't appear in results.
MQL search filtering messages with the message.status.is_surge field.

Use `message.status.is_surge` to find messages\

### Audit log now records when a detection is disabled The audit log now captures a `detection_disabled` action whenever a detection is turned off, whether by an admin or by the automatic circuit breaker. Previously, only create and update actions were logged. You now have a complete accountability trail for when and why a detection stopped firing.
Audit log entry showing a detection_disabled action.

Audit log entries now show when a detection is disabled.

*** ## ✨ Enhancements ### Detections & Remediation #### Calendar remediation no longer removes legitimate meetings When using [**Delete Calendar Events**](/learn-more/risk-areas/email-threats/auto-respond.md#delete-messages-and-associated-calendar-events) to remediate a malicious external guest, Material now reads the authoritative event organizer before acting. Events owned by the mailbox holder, their aliases, or internal trusted users are skipped. This check is also robust to ICS spoofing, so legitimate meetings are preserved during email threat cleanup.
Calendar remediation skipping legitimate meetings after checking the event organizer.

Calendar remediation now checks the authoritative organizer before removing events.

#### Reduced noise from Google Drive detections If your environment doesn't sync Drive, four Google Drive file detections have been moved to info-severity and automatically disabled. You'll no longer see alerts for them. Environments that do sync Drive will continue to see the same detections at lower severity. #### Expanded coverage for Demio-delivered phishing The **Message Flagged by Material** detection now catches phishing messages delivered through the Demio webinar platform, a real-world attack vector observed in the wild. No configuration required. *** ### Issues & Investigation #### Recipient column in the Issues list A new **Recipient** column is available in the Issues list. Select it on to see a single address or a count of recipients without opening each issue individually. This is especially useful when triaging bulk campaigns. Note, you must choose **Grouped By**: **None** to see this option.
#### Grouped issue views: sortable severity and stable save state The **Threats**, **Data Security**, **Critical and High Severity**, and **Vulnerabilities** views, plus any grouped views you've saved, no longer appear marked unsaved when you load them. The **Severity** column in these views is also now sortable.
Issues list with the Recipient column enabled.

Issue Views

Issue Timeline Enhancements * Some "message received" events were missing from the issue timeline when a sender's timestamp didn't match actual delivery time. These events now always appear. * The issue timeline now shows the specific user who removed messages, rather than "Material."
Issue list and detail improvements * The Related Issues and Investigations panels now show a loading indicator while data loads (instead of briefly showing "No issues" or "No investigations" before the content appears). * The **Detected by** line on email threat issues now lists detections first, then any user or admin reports in a separate sentence. When Material's built-in scanning is the only signal, it's no longer shown, since it runs on every email threat message and doesn't narrow down what flagged this one. * Issue titles now render as links immediately, rather than appearing as plain text first. * The "Processing messages…" notification persists through long bulk operations instead of disappearing prematurely.
### Email Security #### Accurate sender attribution in forwarded and mailing-list issues Email threat issues involving messages routed through mailing lists or forwarding services, like Google Groups, now surface the true original sender rather than the list address. #### Clearer repeat-surge notifications for end users The **Surge Protection Ended** notification, sent automatically to users when Email Bomb Protection releases their held mail, now explains what to expect if another surge starts, so users know where to find their mail if it's held again. ### Integrations #### Clone an event in an integration From within any integration, the **Clone** action has moved to the row-level actions menu (⋯) on each event row. Cloned events are titled "Clone of …".
Row actions menu in an integration with the Clone option.

Use the row actions menu to clone an event in an integration.

#### Copy Test Event button renamed to View Test Event The **Copy Test Event** button has also been renamed to **View Test Event** to better reflect that it opens a view-and-copy window rather than copying directly:
Integration page button labeled View Test Event.

The View Test Event button opens the test event in a view-and-copy window.

### Administration #### Filter accounts by role The **Accounts** page in Explorer now includes **Any role** and **No role** filters:
Accounts page filters showing Any role and No role options.

Filter Explorer accounts by Any role or No role.

*** ## 🐛 Fixes * **Audit log event subscriptions now deliver reliably.** The event subscription form previously allowed selecting action/category combinations that matched no events, silently dropping every audit event. Actions are now constrained to the selected category, so integrations with SIEM tools and webhook receivers receive events as expected. * **Account-filtered webhooks now fire for email threat and message events.** The **Accounts** filter on Issue Change subscriptions was only matching the issue-level account, causing email threat and message events, which carry account context at the message level, to be silently dropped. The filter now matches against the message's mailbox account. * **Message Details Links tab now shows all links under a domain.** Expanding a hostname row was previously capped at 5 links with no way to see more. All links under a domain are now shown, giving you the full picture when investigating link spread in a suspicious message. * **Trusted Entities display corrections.** The **Don't create issues** badge and the **Subdomains** column in the Trusted Entities list now display each entity's own values correctly. Previously, the badge could render blank and the Subdomains column could show the wrong value. * **SAML configuration fixes.** The **Save** button now works correctly the first time you configure SAML, and **Enforce SAML Login** can now be turned on in a single click. *** ## :books: New and Updated Documentation **New** * Third-party simulation tools: Covers third-party phishing simulation platforms including Ninjio, and how to configure Material to allow their messages * OAuth FAQ: Answers common questions about OAuth app detection, classification, and remediation **Updated** * Simulations: Added a note about Microsoft Defender Safe Links false-click warnings in simulation emails * Web Application Firewall: Removed outdated rollout and implementation details; the overview now reflects the fully deployed WAF * [Investigate](/getting-started/fundamentals/investigate.md): Added a note explaining that when a new email matches a manually resolved issue, it attaches to that issue without reopening it * Detected and similar messages: Added guidance on reducing false positive user reports by configuring Trusted Entities * [Email Notifications](/integrations/integration-fundamentals/messaging-and-ticketing-integrations.md): Added a note about entering multiple notification addresses using comma-separated format * User Report Auto Classification, User Reporting Methods, and [Issue Details](/learn-more/risk-areas/email-threats/investigate/issue-details.md): Updated to document how issues are grouped when Material detects and a user reports the same email * Enable Email Remediation: Revised to recommend a phased trial rollout before full deployment * 7: Review OAuth Remediation Agent, [Malicious OAuth Apps](/learn-more/risk-areas/malicious-oauth-apps.md), and OAuth Detections and Classification: Clarified the difference between OAuth Essentials and Advanced --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/whats-new/previous-releases/version-1.57.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.