Libraesva ESG v5.7: Release Notes – LibraCyber - Help Center

Main features of version 5.7

Collaboration Protection: the ESG inspection engines — antivirus, URL sandboxing and data-loss prevention — extended to Microsoft Teams one-to-one chats, group chats and channel posts. An offending message is blocked in place and the sender can open a policy tip naming the rule that matched. Configured per Microsoft 365 tenant, served on a dedicated web endpoint with its own TLS certificate and worker pool. Available as a licensed add-on.
Threat Breakdown: a per-message report for any message classified as a threat, explaining the verdict instead of dumping scan fields: risk and spam confidence, sender identity, SPF, DKIM and DMARC in words, the correlated signals behind the verdict, the reconstructed attack chain, the matched rules, DLP and payload status, and prioritized recommended actions. The narrative and the attack chain are written by a language model running entirely on the appliance, so no message data leaves the box. Requires the medium resource profile or above.
SAML Single Sign-On: SAML 2.0 as a per-domain authentication scheme, against Microsoft 365 / Entra ID, Google Workspace or any other SAML 2.0 identity provider, alongside local, IMAP, POP3, LDAP and the existing connectors. Login and single logout are always started by ESG and a signature is always required.

Database encryption: encryption at rest now covers every table of the appliance databases

Blocked networks: the overview now names who blocked each network — LibraCyber IoC, DoS Protection or an administrator — says what can be done about each, and shows the reason for the block where one is known
LibraCyber Support: the "Remote Support" page is renamed "LibraCyber Support" and now pairs the session form with a checklist on how to ask for support, including where to find the Ticket ID the connection requires; the link to open a ticket points to the LibraCyber Help Center

Email Continuity: more reliable rendering of HTML messages that declare a character set other than UTF-8
Message details: clearer explanation when the live blocked URL lookup no longer finds anything listed
Threat Breakdown: AI-generated sections are cached for twelve hours, and the cache is dropped whenever a new model is installed
TLS settings: cipher grade options now state which TLS versions and ciphers each grade permits, with the full detail for all three grades in the page help
Web UI MIME parser: upgraded mime-parser codebase to leverage security, DoS protection for CPU/memory usage, and text encoding handling

ADD: new /account-takeover-protection/policy-group to manage ATP policy groups
ADD: new /account-takeover-protection/policy-group-member to manage policy group members
ADD: new /saml-login to obtain the SAML sign-on URLs for a login identifier
ADD: new /tls-certificate to manage TLS certificate configurations, with upload, {id}/upload, generate, {id}/csr and appliance-service operations
IMPROVED: /oauth-login returns the SAML sign-on URLs too, alongside the OAuth2 ones
IMPROVED: the clientIp filter on /audit accepts a CIDR network as well as a single address

IPv6 storage migration: IP and network columns are converted to the MariaDB-native INET6 type, and CIDR columns are split into a network address plus a prefix length. Because this changes the table layout, in a cluster all nodes must be upgraded back-to-back — row-based replication breaks while nodes run different schema versions.
Message and audit history is restored by a background job: the large esva_message and esva_audit tables are converted online after the upgrade by a background job, newest records first, so the message log and the audit log may not be complete right away — the older history reappears progressively over the following hours. Mail flow, new messages and new audit records are unaffected, and restoring a backup taken before the conversion completed simply lets the background job run again.

All upgrades from previous versions are included. See the full release notes of Libraesva ESG version 5.6.