Version 1.57
Version 1.57 adds MQL search support for messages caught by surge protection, closes a gap in the audit trail for detection disabling, and improves calendar remediation to better preserve legitimate meetings during email threat cleanup.
This release also adds a new Recipient column in the Issues list, improves sender attribution in forwarded-email issues, and includes fixes for integration reliability and display accuracy.
🥳 New
Search for messages surge affected messages
A new MQL field, message.status.is_surge, lets you find every message caught by Email Bomb Protection. Use it to investigate the full scope of an attack: who was affected, what was held, and when.
This field applies to messages processed after version 1.57. Email Bomb Protection events from earlier releases won't appear in results.
Audit log now records when a detection is disabled
The audit log now captures a detection_disabled action whenever a detection is turned off, whether by an admin or by the automatic circuit breaker. Previously, only create and update actions were logged. You now have a complete accountability trail for when and why a detection stopped firing.
✨ Enhancements
Detections & Remediation
Calendar remediation no longer removes legitimate meetings
When using Delete Calendar Events to remediate a malicious external guest, Material now reads the authoritative event organizer before acting. Events owned by the mailbox holder, their aliases, or internal trusted users are skipped. This check is also robust to ICS spoofing, so legitimate meetings are preserved during email threat cleanup.
Reduced noise from Google Drive detections
If your environment doesn't sync Drive, four Google Drive file detections have been moved to info-severity and automatically disabled. You'll no longer see alerts for them. Environments that do sync Drive will continue to see the same detections at lower severity.
Expanded coverage for Demio-delivered phishing
The Message Flagged by Material detection now catches phishing messages delivered through the Demio webinar platform, a real-world attack vector observed in the wild. No configuration required.
Issues & Investigation
Recipient column in the Issues list
A new Recipient column is available in the Issues list. Select it on to see a single address or a count of recipients without opening each issue individually. This is especially useful when triaging bulk campaigns.
Note, you must choose Grouped By: None to see this option.
Grouped issue views: sortable severity and stable save state
The Threats, Data Security, Critical and High Severity, and Vulnerabilities views, plus any grouped views you've saved, no longer appear marked unsaved when you load them. The Severity column in these views is also now sortable.
Email Security
Accurate sender attribution in forwarded and mailing-list issues
Email threat issues involving messages routed through mailing lists or forwarding services, like Google Groups, now surface the true original sender rather than the list address.
Clearer repeat-surge notifications for end users
The Surge Protection Ended notification, sent automatically to users when Email Bomb Protection releases their held mail, now explains what to expect if another surge starts, so users know where to find their mail if it's held again.
Integrations
Clone an event in an integration
From within any integration, the Clone action has moved to the row-level actions menu (⋯) on each event row. Cloned events are titled "Clone of …".
Copy Test Event button renamed to View Test Event
The Copy Test Event button has also been renamed to View Test Event to better reflect that it opens a view-and-copy window rather than copying directly:
Administration
Filter accounts by role
The Accounts page in Explorer now includes Any role and No role filters:
🐛 Fixes
Audit log event subscriptions now deliver reliably. The event subscription form previously allowed selecting action/category combinations that matched no events, silently dropping every audit event. Actions are now constrained to the selected category, so integrations with SIEM tools and webhook receivers receive events as expected.
Account-filtered webhooks now fire for email threat and message events. The Accounts filter on Issue Change subscriptions was only matching the issue-level account, causing email threat and message events, which carry account context at the message level, to be silently dropped. The filter now matches against the message's mailbox account.
Message Details Links tab now shows all links under a domain. Expanding a hostname row was previously capped at 5 links with no way to see more. All links under a domain are now shown, giving you the full picture when investigating link spread in a suspicious message.
Trusted Entities display corrections. The Don't create issues badge and the Subdomains column in the Trusted Entities list now display each entity's own values correctly. Previously, the badge could render blank and the Subdomains column could show the wrong value.
SAML configuration fixes. The Save button now works correctly the first time you configure SAML, and Enforce SAML Login can now be turned on in a single click.
📚 New and Updated Documentation
New
Third-party simulation tools: Covers third-party phishing simulation platforms including Ninjio, and how to configure Material to allow their messages
OAuth FAQ: Answers common questions about OAuth app detection, classification, and remediation
Updated
Simulations: Added a note about Microsoft Defender Safe Links false-click warnings in simulation emails
Web Application Firewall: Removed outdated rollout and implementation details; the overview now reflects the fully deployed WAF
Investigate: Added a note explaining that when a new email matches a manually resolved issue, it attaches to that issue without reopening it
Detected and similar messages: Added guidance on reducing false positive user reports by configuring Trusted Entities
Email Notifications: Added a note about entering multiple notification addresses using comma-separated format
User Report Auto Classification, User Reporting Methods, and Issue Details: Updated to document how issues are grouped when Material detects and a user reports the same email
Enable Email Remediation: Revised to recommend a phased trial rollout before full deployment
7: Review OAuth Remediation Agent, Malicious OAuth Apps, and OAuth Detections and Classification: Clarified the difference between OAuth Essentials and Advanced
Last updated
Was this helpful?