Share Feedback on Email Threats
Have a False Positive or Missed True Positive?
First, ensure that you've shared your issue with Material.
Sharing an issue with Material notifies our internal teams and includes the issue messages and pertinent information. This process allows you to share feedback with us so we can continuously tune our detections.
If you don't share these issues, we won't see any of the data or information contained in them.
How Material evaluates Email Threats
Material scans messages independently of Google Workspace and Microsoft 365.
An email appears in Email Threats > Issues when Material identifies it as a threat. Material's detection works independently of Google and Microsoft's own filtering.
An email can appear in Email Threats > Issues even if Google or Microsoft also flagged it.
Likewise, a message in your spam folder may not appear in Email Threats > Issues if Material assessed it differently.
Share issues
When troubleshooting, you may be asked to send us the Issue ID. To copy this ID:
From an issue, click All Actions (or
⌘K).Click Copy Issue ID.
To share the issue directly, click Share Feedback then describe what happened in the comment box.
Share Feedback sends your comments and the issue context to Material for review. Use it to report a false positive, a missed true positive, or other issue-specific feedback.
You can also share messages in bulk. From the Explorer, select one or more messages, then from the bottom toolbar click Share with Material.
FAQ
When is Share Feedback available?
The Share Feedback button is available on email threat and other malicious message issues in the All Actions Menu (⌘K).
It's not available on:
Material system notifications (alerts or speedbump notifications)
Messages opened in Explorer without an associated issue. (To add the message to an issue, choose Suspicious from the risk type drop-down).
Issues that are already in certain resolved states
What if Share with Material isn't clickable?
Classify the issue as malicious, spam or safe first.
What happens after you submit feedback
When you click Share Feedback on an issue, Material's Threat Research team reviews the message and the indicators that led to its classification. Depending on what they find, they might:
Push updated detection logic to your instance so similar messages are classified correctly going forward
Confirm the original classification was correct, and share which indicators were involved
When to contact support instead
Use Share Feedback to flag how Material classified a single message. Contact support instead when your request applies across your whole organization, not just one message, for example:
Excluding specific senders, domains, or addresses from a detection (such as your own support or bulk-mail addresses)
Adjusting the severity for a specific combination of indicators
Understanding why a specific message received its classification
A type of message keeps recurring with the same classification, and you want that changed going forward
Last updated
Was this helpful?