Email Bomb Attacks

Material automatically detects and remediates email bomb attacks to restore availability to the inbox.

How is an email bomb attack detected?

A bomb attack is detected when an account's inbound volume spikes far above its normal baseline within a short window. Material only counts messages that land in the Inbox and excludes expected or low-risk traffic (such as out-of-office replies) so that normal activity doesn't trigger a false alarm.

What remediation occurs with Email Bomb Protection?

If you enable Email Bomb Protection then Material automatically removes email bomb messages from user inboxes and moves them to a separate surge protection label (Gmail) or folder (Outlook) to prevent the attack from overwhelming users and potentially hiding legitimate messages.

• Material then moves any messages from people and domains the user has communicated with back to their inbox.

• Users can manually move messages back to their inbox or delete them from their surge protection label or folder.

• Admins can bulk-recover held messages from Message Search: search for the affected messages, select them, then from the bottom toolbar click All Actions (⌘K) > Move to Inbox.

• Any surge protection labels or folders Material creates remain, even if the emails themselves are removed.

• If you enabled protection after the attack began, remediation initiates immediately and also applies to all messages from the start of the attack on.

• User notifications are sent via email when remediation starts and ends. The notification sent when protection ends explains what to expect if another surge starts, so users know where to find their mail. Both notifications also caution the user that attackers may follow the surge with a direct approach by phone, Slack, Teams, or email, posing as IT support, and tell them not to engage, share information, or follow instructions. They look like this:

How to enable/disable Email Bomb Protection

To enable Email Bomb Protection Globally or by tenant:

1. Confirm you're in a global space, or a specific tenant, depending on where you want to enable/disable:

   
2. From the top bar, click Settings, then click Default Account Settings.

3. Under Remediations, scroll to Email Bomb Protection. Choose an option:

   1. Enabled: Bomb attacks are detected and automatically remediated

   2. Detect only: Bomb attacks are detected and issues are created for investigation

   3. Disabled: No issues created and no response

1. Save your choice.

Enable protection after an attack begins

If you chose Detect Only and see that an attack begins, you can enable protection for an account/group at that point and remediation will occur from the beginning of the attack onward.

Enable per Account/Group

You can also enable/disable individual accounts and groups separately from your default, global choice.

1. From the Explorer, open an account or group.

2. Click Settings.

3. Under Remediations, scroll to Email Bomb Protection. Choose an option.

From the detection, you can also use quick links to see all accounts/groups it's enabled/disabled for currently:

How to track an email bomb attack

• To notify admins, create an event subscription with these parameters:

  • If Issue Change

  • And Detections: Account is experiencing a potential Email Bomb Attack

• To view issues created by this detection: filter issues by the detection called Account is experiencing a potential Email Bomb Attack .