> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/version-1.58.md).
# Version 1.58
Version 1.58 focuses on faster file search, a rebuilt custom detection editor, and broader email threat coverage. It also sharpens issue investigation and enables API v1 for everyone.
**At a glance:**
* **File search:** a new form-based Quick mode
* **Detections:** one rebuilt custom detection editor and broader email threat coverage
* **Issues and investigation:** full timestamps in Message Explorer and a new Classifications filter for event subscriptions
* **API:** API v1 is on by default for every customer
***
## :partying\_face: New
### Search files with a form, no MQL required
File search now has a **Quick** mode: a simple form where you search by file name, owner, type, location, sharing, and sensitive-data category. You no longer need to write MQL (Material Query Language) to find files with sensitive-data exposure or risky sharing:
Explorer > Files
File search has two modes:
* **Quick**: the new form-based search.
* **Query**: the full MQL search you've always had.
File search opens in **Query** mode by default, matching message search, so existing searches and saved queries keep working unchanged. To use the form, switch to **Quick** with the mode selector at the top.
Learn more about [file search](https://docs.material.security/getting-started/fundamentals/explore/file-search).
### Move messages back to the Inbox
A new **Move to Inbox** bulk action in message search moves the messages you select back to the Inbox for every recipient, in both Gmail and Outlook.
One use for this bulk action is to recover mail that Email Bomb Protection held.
1. From the Explorer, **search** for the affected messages then **select** them.
2. From the bottom toolbar, click **All Actions** (cmd+k).
3. Click **Move to Inbox** to release them, without fixing each mailbox one at a time.
Messages already in the Inbox are skipped, so the action is safe to run across a broad selection.
### Count recipients in message search with a new MQL field
A new numeric MQL field, `message.recipients.count`, counts the recipients on a message across the To, Cc, Bcc, and Delivered-To fields. It supports all the standard numeric operators, so you can build searches and detections that isolate mass-blast messages or single-recipient messages. For example, `message.recipients.count > 50` finds messages sent to more than 50 recipients.
Explorer > Messages
Learn more about [message search](https://docs.material.security/getting-started/fundamentals/explore/message-search).
***
## ✨ Enhancements
### Custom detections: re-designed editor
Creating and editing custom detections is now one connected experience. A single editor replaces the previous create window and the separate post-save edit flow, and several long-standing rough edges are gone.
Custom detection editor.
Editor workflow
* **One editor for create and edit.** Inline title and description, a roomier criteria editor, a preview of matching results, and a severity selector, all in one place.
* **Set the response before you save.** For both message and file detections, you can configure the response when you create the detection instead of only after.
* **AI-suggested name and description.** When you create a detection from a search, Material suggests a name and description for it.
* **Enable file detections in bulk.** Turn on multiple file detections in a single dialog instead of one at a time.
Classification and response
* **Choose the classification a detection applies.** Mark matches as Safe, Malicious, or Spam instead of always Malicious.
* **See a detection's classification without editing.** The classification is visible from the detail view, and the classification picker is the same control everywhere in the product.
Save and archive behavior
* **A clearer save dialog.** The primary and secondary buttons are easier to tell apart, you can scan previously synced files right from the dialog, a notice explains the short delay before changes take effect, and **Save as new** no longer navigates you away.
* **Clearer archiving.** Archiving a detection also disables it and offers to update any open issues it created. Archived detections must be unarchived before you can re-enable them, closing a confusing dead-end state.
* **Clearer file detection scope.** The wording makes clear that a file detection also covers files modified later, not just newly added files.
Learn more about [custom detections](https://docs.material.security/getting-started/fundamentals/detect/custom-detections).
***
### Expanded detection coverage
{% tabs %}
{% tab title="Email threat detections" %}
Material's built-in [email threat detections](/learn-more/risk-areas/email-threats/detect.md) catch more real-world attacks, with no configuration required:
* Impersonation detection expanded to catch Norton and LifeLock lures.
* Intuit callback-phishing detection strengthened with an additional signal.
* Apple ID phishing detection updated to catch a live "payment failure" lure campaign.
* PayPal invoice-abuse detection updated to catch additional obfuscation techniques.
* Callback-phishing detection expanded to catch Malwarebytes-branded lures.
{% endtab %}
{% tab title="File detections (Google Drive)" %}
Seven built-in Google Drive detections now state their actual thresholds in their names, instead of a vague phrase like "a large number of files," so you can tell what each one catches at a glance.
Built-in file detections show their thresholds.
{% endtab %}
{% endtabs %}
***
### Issues and investigation
#### Full timestamps in Message Explorer
Message Explorer shows full timestamps down to the second, instead of abbreviated relative dates. The same format is used across the Groups, Tenants, and Accounts explorer views, so timing lines up wherever you look.
Message Explorer
#### Route only the issues that need attention
[Issue Change events](/integrations/integration-fundamentals.md#events) have a new **Classifications** filter. Subscribe only to issues with a classification you choose, for example user-reported messages that auto-classification left as Unknown, and route just those to Slack, your SIEM, or a webhook.
Integration > Event
***
### OAuth Apps
* **Active apps stay classified as active**: The classification agent no longer treats an app with recent API activity as dormant or unnecessary. Any observed API activity counts as active use, so apps that are genuinely in use aren't flagged for cleanup.
* You can add a comment to OAuth app issues from the `⌘K` actions, not just email threat issues, and your comment appears right away instead of after a page refresh.
Add a comment from an OAuth app issue.
* **Last Activity** and **Last Grant** are labeled consistently across the apps list, the app detail view, and the CSV export. The detail view also shows real Last Activity data instead of a blank field.
* An app's **Website**, **Terms**, and **Privacy** links open in a new tab, and the listed **Support Email** appears as plain text instead of a clickable link.
***
### Administration
* [**API v1 is enabled by default for all instances**](https://docs.material.security/reference), so you can start building integrations right away without requesting access first.
* The **Sensitive Categories** section in the file details view has been reformatted so you can scan a file's categories more quickly.
***
## 🐛 Fixes
**Issues and investigation**
* [Global Analysts and Issue Responders](/learn-more/administration/admin-roles.md) can once again download attachments on messages judged suspicious. These roles were blocked from downloading even when they had permission to view the content.
* The Issues page **Classification** filter no longer lists the same classification twice. It had been showing both legacy and current values for each one.
* Suggested classifications and supporting evidence now appear for user-reported messages even when auto-classification is turned off. This area was previously blank, leaving you without the agent's reasoning.
* The ellipsis indicator on the matching-text column appears whenever there's more text to read, so it's clear when content is cut off.
**OAuth Apps**
* The OAuth Apps list shows the **Classification** and **Response** columns everywhere. They were missing on some instances, hiding app risk and response status.
* OAuth app revoke events in the timeline show the correct account name. They had been showing "Unknown."
**Detections and remediation**
* The Web Application Firewall no longer blocks valid API calls to create or update a detection when the MQL query contains an email address. Those calls were being flagged as suspicious and rejected.
* The **Update permissions** remediation completes on Google Shared Drive files that inherit an org-wide sharing grant from a parent folder. It removes the file's own sharing and leaves the inherited grant alone, instead of failing outright.
**Simulations**
* The Simulations list counts participants who took no action correctly. It had been undercounting them, so the **No Action** total didn't match the Simulation Details page.
***
## :books: New and Updated Documentation
**Updated**
* [Get Support](https://docs.material.security/learn-more/risk-areas/email-threats/support-settings): Added an explanation of how Material evaluates email threats independently of Google and Microsoft, plus a Share Feedback FAQ covering when the option is available, what happens after you submit, and when to contact support instead.
* [OAuth FAQ](https://docs.material.security/learn-more/risk-areas/malicious-oauth-apps/oauth-faq): Added which OAuth features are available on the Essentials and Advanced license tiers.
* [Simulations](https://docs.material.security/learn-more/risk-areas/email-threats/simulations): Revised with message delivery details, group enrollment requirements, the Send Now flow, custom simulation domains, and a campaign response reference table.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/whats-new/previous-releases/version-1.58.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
