Detected and similar messages

An issue is created when Material detects a threat or when a user reports a message. In both cases, Auto Threat Hunt runs automatically for up to 30 days to find similar messages across your organization.

Under Detected messages review the content. Take note of any suspicious language or tactics to drill down into. If any similar messages were added to the issue, the Auto Threat Hunt tab will display for you to review each message individually.

Detected messages are messages that meet the criteria for a Material detection, a custom detection, have been reported by an end user, or via an Email Provider Alert.

From the issue detail view, click the Messages tab then click a message row to drill into details.

Message Details

• Hover over message analysis reasons to see definitions:

Hover over message analysis reasons for definitions

• When Material AI flags a message, the analysis card shows the model name and version that produced the result. This makes AI-driven detections easier to audit, compare, and report on:

Message analysis now shows the AI model name and version.

Message Activity Timeline

Message details includes a full event timeline for each message. It displays detections, issue assignment, remediation, redaction, and analyst comments in one scrollable view.

Use the timeline to trace a message from first detection to final action without switching views. When the message belongs to an issue, related issue context also appears.

Message details now show the full history for a message in one view.

Reduce false positive reports from trusted senders

When one user reports a message, the resulting issue can apply remediation to other matching copies across the organization through Auto Threat Hunt, even when other recipients didn't consider the message suspicious.

This improves coverage and speeds up response, giving you one place to review what was reported, what matched, and what action was taken.

You control whether low-risk or legitimate messages stay visible during triage. The goal is full visibility before you add trusted senders as exceptions, or in cases where a partner should already be trusted but hasn't yet been added.

This is especially useful when:

• cautious users often report partner or vendor mail

• you want to review low-risk reports before messages are moved or removed from users' inboxes

• you haven't yet added a legitimate sender to Trusted Entities

For these cases, use this approach:

• Add trusted partners or known external senders as Trusted Entities.

  • Keep Email Authentication set to Do not trust messages that fail authentication. This reduces spoofing risk.

• Investigate legitimate reports and add senders to Trusted Entities when needed.

• Educate users to move unwanted mail from trusted senders to Junk or Spam in their email client. If reporter response is enabled for that entity, the reporter acknowledgement should already indicate the message is legitimate and doesn't require security review.

Once a sender is configured as a Trusted Entity, Material handles reported messages from that sender based on your Trusted Entity settings. Depending on how the entity is configured, Material may not create an issue, or may create an issue and mark the message as safe. In both cases, Material doesn't apply a remediation such as Move to Spam. If reporter response is configured for that entity, users may also receive an acknowledgement that the message is legitimate.

In practice, this setup lets you review low-risk user reports first, then decide whether the right fix is user education, a new Trusted Entity, or a different response.

Content

View the original message's content in an HTML preview, at the HTML Source, or as Plain Text. Switch between views in the message tab:

Switch between HTML preview, HTML source, and plain text

Accounts

Click to see details about what accounts this message has affected, who reported it, what folder the email landed in, what the remediation was, and any action that was taken like defanging a link.

---

Links

View any links that were included in the email, sorted by domain.

---

Attachments

View the metadata for attachments included with the email including images. Download to see the actual attachment, but be very careful about doing this as these attachments are potentially malicious. Before you download anything, be sure to click Search to allow VirusTotal to assess the attachment for potential malware, viruses, etc.

Actions detail anything a user did with the defanged links or attachments, meaning a user clicked a link we previously modified (i.e. speedbumped),

---

Auto Threat Hunt Messages

Auto Threat Hunt messages are messages that have features in common with user reported messages, for example same sender, same body content, same link destinations. Messages may end up in Auto Threat Hunt but not be detected if the detection is coming from a user report and there is no other detection standard to meet.

From the issue detail view, click the Message tab for a list of all messages in the issue.

Update Auto Threat Hunting or Remove a message from the issue

Messages can be added to an issue based on many values including Sender, Sender Domain, Subject, and Links, etc. Update what messages match to this issue in the Auto Threat Hunt card:

Issue Detail View

Remove one message from an issue or disable Auto Threat Hunt

Disable Auto Threat Hunt vs. Remove From Issue

With Auto Threat Hunt, similar looking messages to the first detected message are added to an issue, (i.e. look for same sender, matching content, links to same domains, etc). If you disable Auto Threat Hunt, you're saying don't add issues for things like false positives, but leaves any previously similarly matched messages in the issues.

Remove from issue removes this specific message entirely from the issue, and also disables Auto Threat Hunt for that message type.

One use case here is if the issue is matching on a lot of false positives but the reported email is actually malicious, you can stop Auto Threat Hunt to stop ingesting false positives but keep remediations on for the original email and any other true positive emails. In this case you could:

1. Click Disable Auto Threat Hunt (see below).

2. Click Remove from Issue on false positives (leaving only true positives).

3. Remediate true positives via the issue.

1. From the issue detail view, click the Messages tab.

2. Check the box next to any message you want to remove.

3. From the bottom toolbar, click all actions then choose the action:

   

   Use bulk actions to remove a message from an issue

Download

To download a .eml file of the message contents, from the message click All Actions or use the keyboard shortcut ⌘K, then choose Download Message. This is useful if you want to send the file spam scorers and other content checkers, load into a database or other storage.

Sometimes you can also use this to report abuse. If the attacker is frequently sending via a third-party, you can send a report to that third-party and they often ask for a .eml to review.

---

Copy Message ID or Link

Sometimes you need to share a message ID or Link with us so we can troubleshoot.

1. From the issue detail view, click the Messages tab.

2. Click the message row to open Message Details.

3. Click All actions (or use the keyboard shortcut ⌘K)

4. Click Copy Message ID:

Message Detail View > All Actions

You can also complete these steps after searching in the Message Explorer.