> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/version-1.59.md).

# Version 1.59

Version 1.59 brings programmatic control of Trusted Entities through the public API, file search in plain language, faster OAuth app account management, and broader built-in email threat coverage. It also sharpens issue investigation with related-issue surfacing and clearer, local-time timelines.

***

## :tada: New

### Manage Trusted Entities programmatically

You can now manage [Trusted Entities](https://docs.material.security/getting-started/fundamentals/detect/trusted-entities) programmatically through the public v1 API and Material's MCP tools, not just in the UI. You can list, create, update, delete, and bulk-manage trusted senders and domains, with a bulk endpoint that handles up to 200 entries in a single request.

{% hint style="info" %}
Learn more in the [API v1 reference](https://docs.material.security/reference) and the [Material MCP server](https://docs.material.security/reference/material-mcp-server) documentation.
{% endhint %}

### Search files in plain language

MQL[^1] is no longer the only way to search for files in the Explorer. [File search](/getting-started/fundamentals/explore/file-search.md) now has three modes, chosen with **Search Mode** at the top of **Explorer** > **Files**:

<figure><img src="/files/alG81zXXQz9IGlaSYe3O" alt=""><figcaption><p>File Search</p></figcaption></figure>

* **Quick**: a form-based search
* **Prompt**: describe your search in plain English
* **Query**: the full MQL search

{% hint style="info" %}
**Note**: This feature is not available for customers who have opted out of Material’s GenAI capabilities.
{% endhint %}

***

## ✨ Enhancements

### Expanded detection coverage

Material's built-in [email threat detections](https://docs.material.security/learn-more/risk-areas/email-threats/detect/) catch more real-world attacks since the previous release, with no configuration required. New coverage is added automatically, so you don't need to create or turn on anything.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FN0bzEB0Pk1cxR2wsDEbk%2Fimage.png?alt=media&#x26;token=40a4e8ed-32bb-48ce-a6e9-bcf471242bd3" alt="Material detection view showing expanded built-in email threat coverage" width="375"><figcaption><p>Detection detail view</p></figcaption></figure>

{% hint style="success" %}
New detection coverage rolls out continuously, independent of our release cycle. The items below are what's new since the previous release.
{% endhint %}

**New built-in coverage**

Material now automatically flags more attack types, including:

* Netflix impersonation lures
* Voicemail-notification lures that carry credential phishing and come from newly registered sender domains, added after catching a live campaign
* SVG image attachments used to hide external links
* Suspicious Flowcode QR code and redirect links
* File-share links that carry suspicious HTML content, a common way to disguise a credential-phishing page as a shared file

**Sharpened coverage for active campaigns**

* Coverage for Xero-themed infrastructure abuse now matches more variants, including job-offer and hiring lures
* Coverage for a Zoom document-sharing infrastructure-abuse campaign was tuned repeatedly to keep pace as the campaign evolved

***

### Issues and investigation

#### View related issues when a message matches more than one detection

When a message matches more than one detection (for example, if you have overlapping custom detections), the issue detail view displays the primary detection that created the issue and notes the additional match:

<figure><img src="/files/7KVtftaxEvrGL7ncyM64" alt="" width="563"><figcaption><p>Issue Detail View</p></figcaption></figure>

The detection detail view for the second detection that also matched now displays the primary detection's issues as related issues:

<figure><img src="/files/HZyhsv1AJcYhpZIXowZo" alt="" width="563"><figcaption><p>Detection Detail View</p></figcaption></figure>

#### Local time by default in timelines

The **message**, **app**, **issues** and **Trusted Entities** timelines now show timestamps in your local time by default, so events are easier to read at a glance.

To switch, click **Preferences** on the timeline, then under **Date format** choose **UTC**:

<figure><img src="/files/AMpxDqOsjQ0XRyb0eodI" alt="issue timeline view, click preferences then UTC"><figcaption><p>Issue Timeline View</p></figcaption></figure>

***

### OAuth Apps

#### Redesigned Accounts tab with bulk token revoke

The [Accounts tab](/learn-more/risk-areas/malicious-oauth-apps.md#apps-dashboard) on an app's detail view now opens filtered to active accounts, with a count that matches what's shown:

<figure><img src="/files/5cRgL3oG0hkLlMPpJyZ1" alt="OAuth app Accounts tab filtered to active accounts, with the matching account count"><figcaption></figcaption></figure>

New **Remediation** and **Scope Level** columns and filters let you sort and narrow the list, and you can select multiple accounts to revoke their tokens at once, from the row menu, the batch toolbar, or **⌘K:**

<figure><img src="/files/Uv1MhMeOoe9fjjv3FV39" alt="OAuth app Accounts tab showing controls to revoke tokens for selected accounts" width="321"><figcaption></figcaption></figure>

#### Export app account lists to CSV

You can now export the per-app Accounts list to a CSV file, for both OAuth apps and **Email Verification** apps, up to 20,000 rows. The export also includes an **All Scopes** column listing every scope ever granted to an app, instead of only a risk summary.

<figure><img src="/files/TZ8WDMfXma5WECUMk7J7" alt="Menu option to export an app account list as CSV" width="217"><figcaption></figcaption></figure>

#### Simplified Accounts tab for Email Verification apps

Email Verification apps now have a dedicated Accounts tab that shows only the fields relevant to them, instead of the fuller OAuth-oriented tab.

<figure><img src="/files/OxHLhNmNSLHSAiWEtIeM" alt="Dedicated Accounts tab for an Email Verification app"><figcaption></figcaption></figure>

{% hint style="info" %}
Learn more about [OAuth apps](https://docs.material.security/learn-more/risk-areas/malicious-oauth-apps).
{% endhint %}

***

### Files

#### Find files shared externally to a trusted entity

File search can now match files shared externally **to a trusted entity** separately from files shared externally in general.

* In **Quick** search, select the new **Trusted external** filter
* In **Query** search, use the `shared.with_trusted_entity` operator. It's a new operator, so your existing saved searches keep working unchanged.

<figure><img src="/files/LgWMdn7fHQz58yAaOjSa" alt="Explorer Files search showing the Trusted external filter"><figcaption><p>Explorer > Files</p></figcaption></figure>

{% hint style="info" %}
Learn more about [file search](https://docs.material.security/getting-started/fundamentals/explore/file-search)
{% endhint %}

***

### Administration

* **Usage report:** the Account Settings and Admin Activity areas now appear as visually distinct sections instead of blending together, and the "Explore more reports" section has been removed.

  <figure><img src="/files/xN2iPEYHHCV6BODCh0UV" alt="Usage report with distinct Account Settings and Admin Activity sections" width="563"><figcaption><p>Reports > Usage</p></figcaption></figure>
* [**Integrations**](/integrations/integration-fundamentals.md) **shortcuts:** ⌘K now mirrors the integration action buttons.
  * From the **Integrations** list, you can **Create integration**.
  * With an integration open, ⌘K also offers **Save**, **Enable** or **Disable**, and **Delete** for that integration.

<figure><img src="/files/gSd70Sd9omNBQcdv5f5X" alt="Command menu showing integration actions, including Save, Enable, Disable, and Delete" width="158"><figcaption><p>⌘K from integration</p></figcaption></figure>

***

## 🐛 Fixes

**Issues and investigation**

* Message timelines now sort correctly even when a message is missing a date.
* Opening the Issues table from the Overview now keeps the sort order you were using.
* Stale accept or reject classification actions no longer linger in ⌘K after you've acted on them.
* Restricted-content searches now show a clear, actionable error instead of "unknown attribute".
* The border around the message header explanation is now visible in dark mode.

**OAuth Apps**

* OAuth app investigations no longer crash for tenants that don't have a primary domain set.
* After you accept or reject an OAuth app's suggested classification, the **Accept/Reject suggested classification** commands no longer linger in ⌘K.
* The classification recommendation callout on an OAuth app now dismisses after you accept it, instead of staying visible.
* OAuth app investigation reports now render with proper line breaks and formatting, instead of showing raw characters like `\n` and `###`.

**Detections**

* Fixed the cursor jumping to the start of the line while you type in the custom detection query editor, so you can edit longer queries without losing your place.

**Platform and administration**

* The Accounts CSV export in Explorer is no longer empty when a License or Active Features filter is applied.
* Lists that load one page at a time, such as the OAuth app Accounts tab and the Simulation enrolled-users list, no longer jump back to the first page when you reload.
* The read-only remediation window no longer shows its option cards as clickable when they can't be changed.
* Fixed a Google sign-in crash for users on newly enrolled domains
* SAML login now falls back correctly instead of misreading details left over from an earlier sign-in attempt
* Fixed an internal error that could affect API availability
* Fixed a crash when switching tabs in areas that share the same tabbed layout, including Trusted Entities settings, the account and mailbox message view, Detection Details, and Reports
* Audit events for viewing an issue are now visible to admins scoped to a specific domain, not only to global-scope admins.

***

## :books: New and Updated Documentation

**New**

* [Configure Google Workspace security settings](https://docs.material.security/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/configure-google-workspace-security-settings): New deployment-guide page covering the built-in Google Workspace controls to turn on alongside Material, including enhanced pre-delivery message scanning, advanced phishing and malware protection, and custom spam filters.

**Updated**

* [Configure VIP Impersonation & Trusted Entities](https://docs.material.security/getting-started/deployment-guides/31+-days/configure-vip-impersonation-and-trusted-entities), [VIP Impersonation](https://docs.material.security/learn-more/risk-areas/email-threats/detect/vip-impersonation), and [Identity Integrations](https://docs.material.security/integrations/integration-fundamentals/identity-integrations): Corrected the VIP setup steps and clarified identity integration naming.
* [Enable Sensitive Email Redaction](https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/enable-email-redaction): Clarified the force-unlock use case and the requirement to include Material in your employee off-boarding process.

[^1]: Material Query Language


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/whats-new/version-1.59.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.