File Security

Custom Detections

Common use cases are covered with Material's built in detections (follow this guide to become familiar with those).

As you deploy or any time in your use of Material, you may also want to consider any policies unique to your organization's security strategy and create custom detections to reflect those. Learn how and when to create custom detections here.

You don't need to create any custom detections to complete deployment, however some common custom detections created at this time are:

Query	Description
category.any and shared.with_personal_email	Users shared sensitive content with their personal email address
category.any and shared.with_freemail	Users shared sensitive content with a freemail account

---

File Search

Step Three: Enable Remediation

Detections are enabled and creating issues immediately, but they're not yet responding. Learn more about setting auto-response here. In brief.

1. From the left navigation, click Detections.
2. Click Filters, then select Entity Type then Files.
3. Browse the existing File Detections.
4. Open the detection then set the default response as needed:

Detection default response

1. From this detection detail screen, you can also disable the Detection. At deployment, we recommend you leave them enabled and let them run.

Detection enabled

Default response descriptions are in Configure Default Auto-Responses.

Auto-response is best practice, but if you need to revoke access manually for any reason — do this in the Explorer. Learn more here.

Default Account Settings