Configure Material Detections

Material Detections are on by default, detecting malicious messages and creating issues for you to investigate. However, no response is enabled just yet.

The available response options are the same across Material Detections, User Reporting, Custom Detections, and Email Provider alerts, but defaults are configured separately for each detection type allowing you more custom control.

For deployment, we recommend you enable the default responses:

1. From the left navigation, navigate to Email Threats > Settings > Material Detection.
2. Under Response, choose Remediate Messages.

   

Response Types

Banner

Banners appear on the top of a suspicious email.

The default text is "This message was identified as potentially suspicious" to give your users a moment to pause before they take any action on it, but you can update it as needed.

Block

Blocks disable access to links or attachments entirely. You also have the option to just require the user to confirm they trust the sender when accessing a link or attachment (known as a speedbump). For deployment, we recommend you begin with the block then update as needed.

Move Message to Spam

In addition to adding a banner and blocking link or attachments, the default response is to move Material Detected malicious messages to spam.

We recommend you begin with these default responses so Material can take action right away. To learn more about customizing remediations, review Settings.

Next Steps

Now that you've enabled remediation for Material Detections, you need to also enable it for User Reporting and Email Provider Alerts.