Libraesva ESG v5.6: Release Notes

Main features of version 5.6

• ATP Automatic Quota Engine: a new quota engine that analyzes historical email patterns
  to assign appropriate quotas to all users.
• Second Sight: users can request AI-powered detailed security reports for any email message
  directly from their inbox.
• Enhanced Whale Protection: automated whale import from Microsoft 365 and Google Workspace
  by security group or job title, with automatic synchronization and multi-email protection.
• Firewall Protection: a new configuration view to inspect and edit firewall rules, block
  IoC networks at firewall level with automatic IoC distribution.
• SMTP Auth: added options to restrict login to specific networks and to enforce the envelope-from
  to be equal to the username
• MTA Advanced: added support for Microsoft LoadBalancer by exposing a GUID URI
• User manager: add new “Cleanup old email imports” to remove from users the secondary addresses
  that are no longer reachable via integration imports
• Report: export now supports CSV, XML and JSON formats

Version 5.6.5 (Sep 7, 2026)

• ESG definitions: more reliable upgrades that is able to isolate single download or install failures instead of dropping the whole upgrade

• Account Takeover Protection: a group member that cannot be represented no longer aborts the whole policy apply, which used to leave every following group with the members of the previous apply
• Cluster: fixed the handling of the replication sources, so a stale source in the esg-replica firewall zone no longer aborts the apply before the worker sources are configured
• Email continuity: fixed a crash in the message view when the HTML part exists but has an empty body
• Report: sanitize the saved search name used to build the generated report filename
• SIEM HTTP event forwarder: avoid sending requests with empty payload body
• Valid Recipients: recipients are now strictly validated when added from the Web UI or a text import

• FIX: an out-of-range maxScore on /quarantine/digest failed with a 500
• FIX: filter /blocklist by from and to
• FIX: POST and PUT on /welcomelist and /blocklist failed with a 500
• FIX: hostname and port are now validated on save in /integration/imap and /integration/pop3
• FIX: property relayToPort was neither returned nor accepted in /sender-dependent-relay

Version 5.6.4 (Aug 24, 2026)

Security

• Attachment Filter: added ".zed" to blocked extensions

Improvements

• First run: faster appliance initialization by using different prime number generator

Bug Fixes

• ATP quota: enforce a single quota configuration per relay
• Backup: properly use quarantine partition for backup generation
• Backup: fixed error on scheduled quarantine backup without password
• Bayes engine: disable scheduled job when the engine is stopped, to avoid noise with remote syslog
• OAuth Login: prevent an infinite redirect loop on some authentication failures
• Logwatch: "Ignored attachments due to file size" was always reported as zero
• Logwatch: "ESG rescanned message" was always reported as zero
• Mail Encryption: fixed validation of invalid subject regular expression
• Microsoft 365: fixed a crash when testing a connector whose groups reference a deleted user
• Quarantine: fixed retrieval of messages analyzed shortly after midnight
• Quarantine report: fixed label for "Send email to domain admin"
• Threat remediation: fixed an error when recalling a message on a domain served by more than one connector

API

• ADD: filter /user by role

Version 5.6.3 (Jul 14, 2026)

Security

• QuickSand: protect against evasion techniques based on VelvetSweatshop-encrypted OLE documents
• Passwordless protection: auto-upgrade encryption to a stronger cypher and algorithm
• Web portal: allow multiple domain authentication methods even when oAuth is configured (e.g. LDAP+M365)

Improvements

• Second Sight report: new redesigned cover page that summarizes the verdict, threat-level score, the AI
  agents that analyzed the email and the requester, together with a refreshed visual style across the whole report.
• Login: improved performance of local database login for large appliances

Bug Fixes

• Dashboard: restore radar graph as previous versions, based on customer feedback
• Database rotation: fixed a memory exhaust bug that may happens after a worker cluster setup
• Email continuity: fixed a 403 error on EML/attachment download for role user
• External warning: fixed an issue that caused spurious HTML tag fragments to show up in some email
• Licensing: when renewing an expired license in cluster environment make sure both main nodes are reactivated
• Mail queues: fixed UI validation error on mail queue removal (no longer requires a page refresh)
• Quarantine: fixed delete quarantine body when present
• Release requests: resolved a 500 error when saving new "notify to" address
• Report: fixed x-axis time scale of email flow chart in summary report page

API

• IMPROVED: upgrade encryption to a stronger cypher and algorithm
• DEPRECATED: old login credentials remain valid but must be upgraded to the newer version by
  performing another /login. Every request using old token will include HTTP header
  X-Esg-Auth-Token-Upgrade-Required: true

Version 5.6.2 (June 30, 2026)

Security

• Welcomelist: when sender domain address rewriting is in effect, don’t skip whitelist due to SPF mismatch

Improvements

• Quarantine: permit multiple email address for release request notifications

Bug Fixes

• ATP quota: correctly regenerate quota members on apply settings
• ATP quota: fixed migration from ESG 5.5 for domain members
• ATP quota: resolved a 500 error when creating a new policy group
• Backup: fixed backup generation when using an empty password with local backups
• Email continuity: fixed attachments download
• Email continuity: fixed show/hide images action
• Message details: fixed message search button in URI Detail
• SIEM: fixed page access for read-only domain administrators
• SIEM: upload messages in smaller batches to accommodate max requests of remote servers
• SMTP auth: fixed user activity search
• SMTP auth: fixed apply with allow networks/any sender options
• User roles: fixed visualization of “Allowed to apply pending changes” permission
• User roles: remove edit assignable role actions from “super admin” roles (all are always allowed)
• Whaling Protection: fixed new whale creation when using simple email address instead of users

Version 5.6.1 (June 12, 2026)

Features

• Collaboration Protection: email security engines extended to Microsoft Teams messages.
• SAML Single Sign-On: per-domain SSO for the ESG portal via an external IdP.
• Threat Breakdown: AI-generated, CISO-readable report for threat messages, fully on-appliance.

Improvements

• Apply settings: log timing information for all services to improve support
• Backup: improved password management for both local and remote backup
• Logging: always log the entire exception with full context to improve support
• User management: enforce uniqueness of users’ username at the database level
• User roles: added LibraCyber PSAT to the role permission page

Bug Fixes

• Appliance: fixed automatic resource profile on the first reboot after upgrade to 5.6
• Dashboard URLs: fixed search name parameter in generated routes to prevent null name errors
• Email continuity: restored privacy password redirection
• Integration: don’t block import when some user validations fail to complete
• Login: fixed LDAP failed login for users with user emails from groups
• Login networks: resolved a login loop when the authentication fails due to IP mismatch
• Message details: prevent a 500 error when it fails to compute the country code for a delivery
• Second Sight: standardized capitalization to “Second Sight” throughout the interface
• Social Graph: better centering of graph by pre-calculating SVG dimensions
• User manager: prevent validation issue due to empty “high spam score”
• Whaling: fixed whaling migration from 5.5 when duplicated entries exist

Version 5.6.0 (May 25, 2026)

Security

• ATE: enable “first time sender” identification for bounce messages
• MTA: use SHA256 for TLS fingerprint
• Mandatory password change: access to UI is now blocked until the password is successfully updated
• SMTP Auth: enforce password strength and use a password meter in UI as a hint
• TLS security: hardened medium level security so that only A-grade algorithm and higher tier ciphers are used
• TLS: increase security of DH algorithm when using certificate with 4096-bit keys
• URLSand: broaden the applicability of link rewrite in href tags when protocol is not available
• User manager: prevent using well-known compromised passwords
• Whaling: allow user-based configuration so that multiple email addresses are automatically integrated in the security analysis

Improvements

• Antispam settings: improved max message size input using MiB units
• ATP tracking: added tracker cleanup from web UI
• Auditing: show impersonator user for API user requests
• Backup: add an option to skip notification of successful remote backup
• CSV Export: improved formatting by adding heading fields
• Dashboard: improved graph styles and color schemes
• Email Continuity: compose now allows attaching files
• Email Continuity: improved user experience and error handling
• Engine rules report: includes quality feedback like cohesion, effectiveness and discrepancy
• Integration: test page now shows all groups for a user when it’s searched by a specific email address
• Integration: test page now shows the group member list instead of the generic counter
• LibraCyber PSAT: added a new integration to automatically allow user campaigns
• License manager: allow fine-grained license management since the permission to edit generic configuration is no longer required
• License overuse: when in overuse allows more controls to License Managers
• MSSP instance monitor: added datacenter location for monitored libraesva appliances
• MSSP monitor: show datacenter information for ESG cloud appliances
• Message details: add a sender IP information widget that includes RBL listing and reverse DNS
• Message details: the targeted whale is shown whenever a message is identified as Whaling attack
• OTP mandatory: integrate mandatory OTP change with mandatory password change
• OTP: use SVG instead of PNG for QR Codes
• PhishBrain: ignores whaling rules for active and running campaigns
• Phishing Highlight: now the feature is applied only on inbound messages
• Quarantine report: faster email generation
• Rebranding: allow customization of web favicon
• Report: allow multiple recipients and custom filename in scheduled reports
• Report: new email layout that allows customization of the attached PDF report name
• Report: refined reports library with sharper HTML results and better PDF generations
• Report: the engine rules hit reports now include cohesion, effectiveness and discrepancy rates
• Report: do not deliver a scheduled report when there’s no data
• SIEM Event Forwarder: support for multiple custom headers
• SNMP: support multiple network configurations
• SNMP: update sysLocation/sysContact values
• SPF: add new message results SpfHeloFail, SpfHeloSoftFail, SpfFromFail, and SpfFromSoftFail
• Search: additional filters are now automatically collapsed on result show to improve readability
• Submit as: improved UI for submitting good and bad samples
• Threat remediation: faster API calls for Zimbra servers
• Threat remediation: allow “Quarantine” built-in roles to recall messages
• UI: new and sharper icon theme
• URLSand exception: import action is now asynchronous
• User defaults: added option for mandatory password change
• User management: added an option to force users to change their password at first login
• User management: allow bulk update to update all users
• User manager: add UI meters to show the password strength
• User manager: bulk updates can now be applied to all users
• Welcomelist/Blocklist: add full support for CIDR matchers for “From” direction
• Web UI: add “search by comment” in many administrative pages
• Web UI: improved overall icon quality
• Web UI: removed reload actions for configuration that aren’t inherently dynamic
• Web UI: upgrade branding logo and text for LibraCyber

API

• ADD: added /audit to list and search audit logs
• ADD: added /dkim-key to configure DKIM keys
• ADD: added /domain-authentication-override for DKIM/MARC authentication override
• ADD: added /integration/second-sight to configure Second Sight
• ADD: added /message/{id}/second-sight to request a Second Sight for the message
• ADD: added mainRole property to GET /profile/GET /user/{id}/GET /user-role/{id}
• ADD: added passwordChangeMandatory property to /user
• ADD: added whaleGroup/whaleJobTitleRegex properties to /integration/google-connector-config
• ADD: added whaleGroup/whaleJobTitleRegex properties to /integration/ldap
• ADD: added whaleGroup/whaleJobTitleRegex properties to /integration/microsoft365-connector-config
• ADD: filter /integration/google-connector-config by organizationId
• ADD: filter /integration/ldap by tenantGroup
• ADD: filter /integration/ldap-tenant-group by name
• ADD: filter /integration/microsoft365-connector-config by tenant
• ADD: filter /integration/pop3 by hostname
• ADD: filter /quarantine/release-request-entry by user
• ADD: filter /welcomelist /blocklist by from and to
• ADD: filter /trusted-network by network
• ADD: filter /user by externalId and username
• ADD: added /network/country-policy-config to configure Country Policies
• ADD: added /network/static-route to configure Static Route
• ADD: added /license entrypoint to show license information
• ADD: added /license/upload entrypoint to update license
• IMPROVED: on blocked almost-successful /login add two properties password_change_required
  and mandatory_otp to hint for mandatory user profile update actions
• IMPROVED: requests to http://.../api now return 404 response instead of 301 to https://.../api

Breaking changes

1. TLS policy. Custom policies based on fingerprint must now use SHA256 algorithm instead of MD5.-
2. APIv1. Removed API v1, so now all requests will return 410 GONE as a standard response. Entrypoints
   /api/v1/, /api/v1/version and /api/v1/api-specifications.json are preserved for smoother migration
3. MSSP Panel. Dropped support for managing remote appliances at version 4.x or below

Version 5.5

All upgrades from previous versions are included. See the full release notes of Libraesva ESG version 5.5.