9: Configure Account Security

Critical and High Severity Detections

Material assesses each detection by evaluating multiple factors, ensuring accurate severity assignment. This process involves:

1. Impact Analysis: Understanding the potential consequences on systems or data if the issue isn't addressed promptly.
2. Likelihood Evaluation: Gauging how probable it is for the detected issue to be exploited or cause harm.
3. Environmental Context: Considering the specific environment where the detection occurred, including any mitigating factors.
4. Historical Data: Reviewing similar past incidents to gauge potential patterns or recurring threats.

These factors collectively inform the severity level assigned, helping prioritize responses and allocate resources efficiently.

Critical Severity Detections are clear, ongoing compromise or data theft/destruction requiring immediate containment.

High Severity Detections have a strong indicator of compromise or dangerous misconfiguration with near-term exploitation risk.

Learn more about our Detection Severity Framework here.

Review Detections

We assign severity to detections out-of-the-box, based on our framework and experience. You can update the severity yourself as needed.

During deployment, just familiarize yourself with the critical and high-severity detections available for account security:

1. From the workspace, click Detections.
2. Filter Entity Type to Account, and Severity to Critical and High.
3. Open each detection and review their descriptions and details.

1. From the detection, you can also update the severity based on your organization's security framework. Either click the severity drop-down, or use the keyboard shortcut command +K to update:

   

Create a High-severity Event Subscription

Use Event Subscriptions to configure Material to notify you about many different events. This ensures timely notifications to the right people and sends information to a SIEM (Security Information and Event Management).

We recommend creating at least one high-severity event subscription to try it out.

Just as you did with the Email Security notification in section 6, begin in Integrations:

1. From the top toolbar, click Integrations.
2. Click Event Subscriptions.
3. Click Create Subscription.

Slack

In the Event Workflow:

1. Set the IF parameter to Issue Change . (Most event subscriptions will use Issue Change or Issue Update).
2. In the Types parameter, choose Create.
3. In the Severities parameter, choose Critical and High.
4. In the THEN parameter, choose Slack.
5. Choose the Slack channel to send this notification to.
6. The default message includes a variable that displays the issue number in your notification.
7. From the Properties to Include drop down, include any properties you want displayed in your notification.
8. Optionally, add a Button to your notification. If you'd like a button to open the related issue, use the URL: ${issue.issueLink}

   
9. Click Send Test Event. You should see something like this in the Slack channel you chose:

   
10. Save, then toggle the event subscription On.

Email

In the Event Workflow:

1. Set the IF parameter to Issue Change . (Most event subscriptions will use Issue Change or Issue Update).
2. In the Types parameter, choose Create.
3. In the Severities parameter, choose Critical and High.
4. In the THEN parameter, choose Email.
5. Enter the email address to send notifications to.
6. In the subject line, you can also include a variable like the time or message ID.
7. In the Body, consider something concise like "High/Severe Issue Created." You can also choose variables from the Body drop down.

   
8. Click Send Test Event. You should see something like this in the inbox you chose:

   
9. Save, then toggle the event subscription On.

Webhook

In the event workflow:

1. Set the IF parameter to Issue Change . (Most event subscriptions will use Issue Change or Issue Update).
2. In the Types parameter, choose Create.
3. In the Severities parameter, choose Critical and High.
4. In the THEN parameter, choose Webhook.
5. In the method, choose Post.
6. Enter the URI from your webhook location/provider.
7. In Headers include the parameters you want to send., a quick way to create the content is to:

   1. Choose Slack and configure it with everything you need.
   2. Click Advanced Mode.
   3. Copy the content.
   4. Choose Webhook again.
   5. Paste the content into the headers.
8. Click Send Test Event. Confirm your webhook is successful.
9. Save, then toggle the event subscription On.