Configure User Reporting

Employee reporting is one of the most effective ways to detect and remediate phishing emails. Material places messages similar to each other in an issue, but how you respond to a user reported message is important. It gives you opportunity to reinforce this action, educate your users in addition to remediating in bulk rather than having to go one by one.

We generally recommend enabling and configuring all methods of accepting user reports, using the steps below.

Set up how you receive user reports

From the left navigation, expand User Reports, then click Settings.

Choose at least one of these options:

Forwarding Address

Reporting

To streamline processing and support user awareness and training, include a specific email to forward user reported messages to. This is called a Reporting Address.

1. Toggle the option on to enable forwarding.
2. Enter all your forwarding email addresses in the Reporting Addresses field. Separate multiple addresses with commas, for example [e-mail], [e-mail]
3. Click Save.

Include a Forwarding Address

Include as many dedicated existing email addresses as you have today for reporting phishing. Don't include multipurpose mailboxes here (e.g. where users contact your security team about issues that aren't phishing related); put those in the Intermediary section instead.

Intermediary

Sometimes reporting users forward emails to the wrong email by mistake. Include an intermediary address to ensure these emails get to the correct address.

Intermediary addresses are only useful when there's an address (or set of addresses) where forwarded phishing reports are misdirected (e.g. if you have a phishing@ and security@ aliases and people accidentally send the reports to security@). Setting up an intermediary address ensures that Material doesn't treat security@ as the account reporting the message.

1. Toggle the Intermediary Addresses option on.
2. Enter all your forwarding email addresses in the Intermediary Addresses field. Separate multiple addresses with commas, for example [e-mail], [e-mail] .
3. Click Save.

Intermediary Address

Built-in Email Provider Labels

Make it even simpler for your users to report a suspicious message by allowing them to apply a Gmail label or Outlook category.

Toggle the Label option to On.

User Reports > Settings

• Note, the label name is Suspicious, and that is not changeable.
• If a user applies the label and also forwards the email, only one issue is created or similar message added; we deduplicate repeated reports about the same message.

Email Provider UI (Google and Outlook Report Phishing Buttons)

Users can also click the built-in Gmail or Outlook "Report Phishing Buttons"

Outlook Requirement:

To avoid issue creation delay when users click the "report phishing button" in Outlook:

1. Set up a Reporting Address.
2. Once you have the Reporting address designated, as a Microsoft admin navigate to https://security.microsoft.com/securitysettings/userSubmission and update the settings to send to that reporting mailbox in addition to Microsoft:

   

To learn more about Outlook phishing reporting, review Outlook's guides.

---

Enable User Reporting Auto Classification

User Report Auto Classification automatically investigates and classifies user-reported emails so security teams can respond quickly and consistently. When a message is reported, the system checks trusted sources and analyzes 2,000+ signals to classify it as

• Malicious
• Spam, or
• Safe.

If a determination can't be made with a high degree of confidence, the issue will be marked as Unknown then surfaced to your security team in User Reports > Issues to investigate and classify manually.

The issue details highlight the indicators used for classification. Hover over the indicators to see their descriptions:

Hover the mouse over the indicators for a description

Enable Auto Classification

We recommend you enable auto classification as part of your initial deployment to automatically accept classification recommendations and apply any response or remediation you pre-configured immediately.

1. Log in to Material.
2. From the left navigation, expand User Reports, then click Settings.
3. Scroll to User Report Agent, then select Automatically classify:

1. For each classification type, choose from the auto-remediation options described here:

Learn more about User Report Auto Classification here.

---

Auto Threat Hunt

If a user reports a message that Material classifies as anything other than safe, we'll create an issue and then go look for similar messages in the rest of the environment. We're matching on up to five attributes: sender, sender domain, message ID, subject, and/or link(s).

If another message (that is not already in an existing email threats/message issue) matches on any of those attributes, Material pulls it into the issue.

You can change which attributes we match on by default here, or on an issue by issue basis. If you de-select any attribute in an individual issue, it will also remove any messages that have been added to the issue based on that attribute. We recommend you the leave the defaults as is, and only update on an issue to issue basis.

Learn more about Auto Threat Hunt here.

---

Reporter Acknowledgements

Sending a follow-up message ensures users are informed of actions taken, reinforces security awareness, and confirms that their report was valued. It also provides guidance on any additional steps they should take, fostering a proactive security culture and improving response to future incidents.

In the Reporter Acknowledgement settings, use templates to quickly and consistently respond. You can also use variables to further customize responses:

Reporter Acknowledgement

This is an example of a reporter acknowledgement, auto-sent in response to a user report:

Reporter Acknowledgement

Acknowledgement Types

Different scenarios deserve different responses and follow ups, like a message that was reported and is safe vs. a message reported that is malicious. We include multiple templates so you can customize to these scenarios.

Reporters typically receive one of these templates:

• Admin Classified: One of these three templates for Safe, Malicious, Spam trigger depending on how your team classifies the issue.
• Material Classified: One of these three templates for Safe, Malicious, Spam trigger depending on how Material initially classifies the issue.

Reporters receive the Initial user response template if the issue is classified as unknown, or auto-classification is not enabled. Once the issue is classified, subsequent reporters receive one of the classified templates. If your team changes the classification, any reporters after that change receive the template that aligns with the updated classification.

If the message is an exempt message from a trusted entity, then your user receives the template for Initial user report that matches a trusted entity, not any of the other templates.

Note, we'll review Trusted Entities at a later time. To briefly explain, sometimes you know and trust a sender and don't want issue creation to occur for these exceptions. You can add that sender to your Trusted Entities allowlist then choose how they are treated by Material via Trusted Entity settings.

Personalize your responses

We include some default language in each scenario to get you started and allow you to enable right away, but you can change the content as needed.

Insert variables to personalize your response even more:

Learn more tips in banner & template best practices.

Save a new template

To save templates for re-use in other settings:

1. Expand any response type except Initial user report or Initial user report that matches a trusted entity.
2. Click New Template.
3. Name your template, update the content, then Save.

Saved templates appear in a drop down above the response type. You set any as you active default response.

Enable Email Reporter Acknowledgements

Once you've made any revisions to the existing templates that you need, enable reporter acknowledgements so they can begin triggering. Toggle the option on:

Enabling Email Reporter Acknowledgements does not enabled remediation as a whole.

After you finish configuring Email Provider Alerts and Issue Triage in the next guides, finish Email Security deployment by enabling remediation itself.

Send Reporter Acknowledgements via other services

We recommend enabling Reporter Acknowledgements via email at deployment. If you prefer to send them via Slack, Teams, or other messaging services, disable this setting and set up a webhook instead.