Version 1.58

Version 1.58 focuses on faster file search, a rebuilt custom detection editor, and broader email threat coverage. It also sharpens issue investigation and enables API v1 for everyone.

At a glance:

• File search: a new form-based Quick mode
• Detections: one rebuilt custom detection editor and broader email threat coverage
• Issues and investigation: full timestamps in Message Explorer and a new Classifications filter for event subscriptions
• API: API v1 is on by default for every customer

---

🥳 New

Search files with a form, no MQL required

File search now has a Quick mode: a simple form where you search by file name, owner, type, location, sharing, and sensitive-data category. You no longer need to write MQL (Material Query Language) to find files with sensitive-data exposure or risky sharing:

Explorer > Files

File search has two modes:

• Quick: the new form-based search.
• Query: the full MQL search you've always had.

File search opens in Query mode by default, matching message search, so existing searches and saved queries keep working unchanged. To use the form, switch to Quick with the mode selector at the top.

Learn more about file search.

Move messages back to the Inbox

A new Move to Inbox bulk action in message search moves the messages you select back to the Inbox for every recipient, in both Gmail and Outlook.

One use for this bulk action is to recover mail that Email Bomb Protection held.

1. From the Explorer, search for the affected messages then select them.
2. From the bottom toolbar, click All Actions (cmd+k).
3. Click Move to Inbox to release them, without fixing each mailbox one at a time.

Messages already in the Inbox are skipped, so the action is safe to run across a broad selection.

Count recipients in message search with a new MQL field

A new numeric MQL field, message.recipients.count, counts the recipients on a message across the To, Cc, Bcc, and Delivered-To fields. It supports all the standard numeric operators, so you can build searches and detections that isolate mass-blast messages or single-recipient messages. For example, message.recipients.count > 50 finds messages sent to more than 50 recipients.

Explorer > Messages

Learn more about message search.

---

✨ Enhancements

Custom detections: re-designed editor

Creating and editing custom detections is now one connected experience. A single editor replaces the previous create window and the separate post-save edit flow, and several long-standing rough edges are gone.

Custom detection editor.

Editor workflow

• One editor for create and edit. Inline title and description, a roomier criteria editor, a preview of matching results, and a severity selector, all in one place.
• Set the response before you save. For both message and file detections, you can configure the response when you create the detection instead of only after.
• AI-suggested name and description. When you create a detection from a search, Material suggests a name and description for it.
• Enable file detections in bulk. Turn on multiple file detections in a single dialog instead of one at a time.

Classification and response

• Choose the classification a detection applies. Mark matches as Safe, Malicious, or Spam instead of always Malicious.
• See a detection's classification without editing. The classification is visible from the detail view, and the classification picker is the same control everywhere in the product.

Save and archive behavior

• A clearer save dialog. The primary and secondary buttons are easier to tell apart, you can scan previously synced files right from the dialog, a notice explains the short delay before changes take effect, and Save as new no longer navigates you away.
• Clearer archiving. Archiving a detection also disables it and offers to update any open issues it created. Archived detections must be unarchived before you can re-enable them, closing a confusing dead-end state.
• Clearer file detection scope. The wording makes clear that a file detection also covers files modified later, not just newly added files.

Learn more about custom detections.

---

Expanded detection coverage

Email threat detections

Material's built-in email threat detections catch more real-world attacks, with no configuration required:

• Impersonation detection expanded to catch Norton and LifeLock lures.
• Intuit callback-phishing detection strengthened with an additional signal.
• Apple ID phishing detection updated to catch a live "payment failure" lure campaign.
• PayPal invoice-abuse detection updated to catch additional obfuscation techniques.
• Callback-phishing detection expanded to catch Malwarebytes-branded lures.

File detections (Google Drive)

Seven built-in Google Drive detections now state their actual thresholds in their names, instead of a vague phrase like "a large number of files," so you can tell what each one catches at a glance.

Built-in file detections show their thresholds.

---

Issues and investigation

Full timestamps in Message Explorer

Message Explorer shows full timestamps down to the second, instead of abbreviated relative dates. The same format is used across the Groups, Tenants, and Accounts explorer views, so timing lines up wherever you look.

Message Explorer

Route only the issues that need attention

Issue Change events have a new Classifications filter. Subscribe only to issues with a classification you choose, for example user-reported messages that auto-classification left as Unknown, and route just those to Slack, your SIEM, or a webhook.

Integration > Event

---

OAuth Apps

• Active apps stay classified as active: The classification agent no longer treats an app with recent API activity as dormant or unnecessary. Any observed API activity counts as active use, so apps that are genuinely in use aren't flagged for cleanup.
• You can add a comment to OAuth app issues from the ⌘K actions, not just email threat issues, and your comment appears right away instead of after a page refresh.

Add a comment from an OAuth app issue.

• Last Activity and Last Grant are labeled consistently across the apps list, the app detail view, and the CSV export. The detail view also shows real Last Activity data instead of a blank field.
• An app's Website, Terms, and Privacy links open in a new tab, and the listed Support Email appears as plain text instead of a clickable link.

---

Administration

• API v1 is enabled by default for all instances, so you can start building integrations right away without requesting access first.
• The Sensitive Categories section in the file details view has been reformatted so you can scan a file's categories more quickly.

---

🐛 Fixes

Issues and investigation

• Global Analysts and Issue Responders can once again download attachments on messages judged suspicious. These roles were blocked from downloading even when they had permission to view the content.
• The Issues page Classification filter no longer lists the same classification twice. It had been showing both legacy and current values for each one.
• Suggested classifications and supporting evidence now appear for user-reported messages even when auto-classification is turned off. This area was previously blank, leaving you without the agent's reasoning.
• The ellipsis indicator on the matching-text column appears whenever there's more text to read, so it's clear when content is cut off.

OAuth Apps

• The OAuth Apps list shows the Classification and Response columns everywhere. They were missing on some instances, hiding app risk and response status.
• OAuth app revoke events in the timeline show the correct account name. They had been showing "Unknown."

Detections and remediation

• The Web Application Firewall no longer blocks valid API calls to create or update a detection when the MQL query contains an email address. Those calls were being flagged as suspicious and rejected.
• The Update permissions remediation completes on Google Shared Drive files that inherit an org-wide sharing grant from a parent folder. It removes the file's own sharing and leaves the inherited grant alone, instead of failing outright.

Simulations

• The Simulations list counts participants who took no action correctly. It had been undercounting them, so the No Action total didn't match the Simulation Details page.

---

📚 New and Updated Documentation

Updated

• Get Support: Added an explanation of how Material evaluates email threats independently of Google and Microsoft, plus a Share Feedback FAQ covering when the option is available, what happens after you submit, and when to contact support instead.
• OAuth FAQ: Added which OAuth features are available on the Essentials and Advanced license tiers.
• Simulations: Revised with message delivery details, group enrollment requirements, the Send Now flow, custom simulation domains, and a campaign response reference table.