6: Enable Email Remediation
Material Email Security is an out-of-the-box product ready to detect malicious messages and complement your email provider’s native protection on day one. These detections begin working immediately when you first connect to Material to identify suspicious emails and group them together in issues.
However, no action (response/remediation) is being taken on these issues just yet. To complete deployment, you need to:
Before you begin
Before we dive into all the flips and switches Email Threat Protection offers, let's briefly walk through Email Threat Protection's workflow to guide you on your customization choices and when they come into play.
Potential email threats are detected by:
Material Detections
Material combines threat research and machine learning to detect BEC, VIP impersonation, and other attacks that bypass Microsoft and Google.
Yes, cases are auto-classified as malicious
User Reporting
Your users report malicious emails through your preferred methods, configured in User Reports > Settings
No, specify how you want users to report in User Reports > Settings then enable
Custom Detections
You can create custom detections to look for specific criteria, if it's not already covered with other detection types
No, we recommend you wait some time after Email Threat Protection is enabled to begin using these
Email Provider Alerts
Your email provider will sometimes detect a malicious message after delivery and fire an alert instead of directly remediating the message
Yes
In the Email Threats > Issues list, get a quick look at detection sources, scope, etc., and search all suspicious messages to narrow your view.
Dive deeper with the issue detail view to read Material's analysis and recommendations, and inspect the content and metadata of all messages in the issue.
Classifications
Classifications indicate whether the messages in the issues are considered:
Malicious: emails identified as harmful, containing threats such as malware, phishing attempts, or links to fraudulent websites
Spam: unsolicited, often irrelevant emails sent in bulk, typically for advertising purposes, which can clutter inboxes but aren't necessarily harmful
Safe: emails deemed free of threats, containing no malicious content or links, and posing no risk to the recipient's security
Issues are auto-classified at creation, but you can also manually classify them after your investigation. More on that soon.
Once you've completed your investigation and classified the issue, you can keep any default responses already applied to that issue or you can modify the behavior on an issue-by-issue basis to ensure you're effectively addressing that specific threat.
Finally, educate your users to increase awareness of threats and encourage safer online behaviors, which helps prevent future incidents. It fosters a culture of security, empowering employees to recognize and report suspicious activities effectively.
In Email Threat Protection, you can educate by responding to user reports (reporter acknowledgements) and creating simulations.
Last updated
Was this helpful?