Issues

The issue view contains all the high level information you need to triage and start investigating.

Material automatically analyzes reported messages to find similar threats and automatically de-escalate false positives. You can investigate these issues to:

• Understand attack methods and trends
• Review and classify email threat issues in the issue detail view
• Override default responses and remediations on a case by case basis in the issue detail view

Email Threat Issues

Email Threat Issues in Material are collections of similar emails based on their detection method, content, etc. All issues display on the All Issues page.

To view only email threat issues, from the left navigation expand Email Threats, then click Issues.

From the Issue page, you have a high level view of the message that triggered issue creation, what/who detected/reported it, a quick analysis, scope, classification, current remediation, and creation time.

You can also filter issues by custom criteria using the search criteria described in Issue Search.

Triage efficiently by filtering your view based on a number of fields and also drill down into the issue itself, and the issues contained within. Analyze and if needed, classify the issue and update the response or remediation.

Filter Issue by Source

Email Threat issues fall under one of three detections:

• Message flagged by Material

• For user-reported issues, from the left navigation expand User Reports, then click Issues:

You can also group by detection (rather than issue). Click Display Options, then Group By: Detection

Group By Detection

Filter descriptions are located in the Investigate guide.

Exclude closed and/or ignored issues

To exclude resolved and/or ignored issues from your view, click the List Options button then toggle on or off:

---

Open vs. Resolved Issues

Issues auto-resolve in 30 days. Most phishing attacks occur over a few days then end. 30 days allows us to detect any similar emails and move them into a issue for you to review (an open issue). Once the 30 days is up, we resolve the issue and stop sending emails to it (a resolved issue).

Any emails detected with similar parameters once an issue resolves are likely a new attack, so a new issue is opened for these emails.

There's no need to reopen a issue (and you can't reopen) because anything with a similar attack method will just create a new open issue. In other words, nothing is missed because a issue is resolved. Unlike a ticketing system or similar, a resolved issue doesn't mean we stop detecting.

To view your closed issues:

1. From the left navigation, expand Email Threats, then click Issues.
2. Click the List Options button then toggle on or off: