> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/your-first-30-days/8-configure-account-security.md).

# 9: Configure Account Security

## Critical and High Severity Detections

Material assesses each detection by evaluating multiple factors, ensuring accurate severity assignment. This process involves:

1. **Impact Analysis**: Understanding the potential consequences on systems or data if the issue isn't addressed promptly.
2. **Likelihood Evaluation**: Gauging how probable it is for the detected issue to be exploited or cause harm.
3. **Environmental Context**: Considering the specific environment where the detection occurred, including any mitigating factors.
4. **Historical Data**: Reviewing similar past incidents to gauge potential patterns or recurring threats.

These factors collectively inform the severity level assigned, helping prioritize responses and allocate resources efficiently.

<figure><img src="/files/mPWkmi4DZVSnZCgV3R57" alt=""><figcaption></figcaption></figure>

**Critical Severity Detections** are clear, ongoing compromise or data theft/destruction requiring immediate containment.

**High Severity Detections** have a strong indicator of compromise or dangerous misconfiguration with near-term exploitation risk.

{% hint style="info" %}
Learn more about our [Detection Severity Framework](/getting-started/fundamentals/detect/detection-severity-framework.md) here.
{% endhint %}

### Review Detections

We assign severity to detections out-of-the-box, based on our framework and experience. You can update the severity yourself as needed.

During deployment, just familiarize yourself with the critical and high-severity detections available for account security:

1. From the workspace, click **Detections**.
2. Filter **Entity Type** to **Account**, and **Severity** to **Critical** and **High**.
3. Open each detection and review their descriptions and details.

<figure><img src="/files/s3tHqsmI9UQZQClUZuyd" alt=""><figcaption></figcaption></figure>

4. From the detection, you can also update the severity based on your organization's security framework. Either click the severity drop-down, or use the keyboard shortcut `command +K` to update:

   <figure><img src="/files/X4LnzBrDEUrEBrZxTa1d" alt="" width="375"><figcaption></figcaption></figure>

## Create a High-severity Event Subscription

Use Event Subscriptions to configure Material to notify you about many different events. This ensures timely notifications to the right people and sends information to a SIEM (Security Information and Event Management).

We recommend creating at least one high-severity event subscription to try it out.

<figure><img src="/files/g1ZcdLTDini6JQve8d1G" alt=""><figcaption></figcaption></figure>

Just as you did with the [Email Security notification in section 6](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/set-up-a-notification.md), begin in **Integrations:**

1. From the top toolbar, click **Integrations.**
2. Click **Event Subscriptions.**
3. Click **Create Subscription.**

<details>

<summary>Slack</summary>

In the Event Workflow:

1. Set the **IF** parameter to `Issue Change` . (Most event subscriptions will use `Issue Change` or `Issue Update`).
2. In the **Types** parameter, choose `Create`.
3. In the **Severities** parameter, choose `Critical` and `High`.
4. In the **THEN** parameter, choose **Slack.**
5. Choose the Slack channel to send this notification to.
6. The default message includes a variable that displays the issue number in your notification.
7. From the **Properties to Include** drop down, include any properties you want displayed in your notification.
8. Optionally, add a **Button** to your notification. If you'd like a button to open the related issue, use the URL: `${issue.issueLink}`

   <figure><img src="/files/GfiayfYPZpsX8GCiOSAd" alt=""><figcaption></figcaption></figure>
9. Click **Send Test Event**. You should see something like this in the Slack channel you chose:

   <figure><img src="/files/ScZz7um143dfr68RyIEu" alt="" width="563"><figcaption></figcaption></figure>
10. **Save**, then toggle the event subscription **On**.

</details>

<details>

<summary>Email</summary>

In the Event Workflow:

1. Set the **IF** parameter to `Issue Change` . (Most event subscriptions will use `Issue Change` or `Issue Update`).
2. In the **Types** parameter, choose `Create`.
3. In the **Severities** parameter, choose `Critical` and `High`.
4. In the **THEN** parameter, choose **Email.**
5. Enter the email address to send notifications to.
6. In the subject line, you can also include a variable like the time or message ID.
7. In the Body, consider something concise like "High/Severe Issue Created." You can also choose variables from the **Body** drop down.

   <figure><img src="/files/X9MTa8rfxXgTsFVbj0bK" alt="" width="375"><figcaption></figcaption></figure>
8. Click **Send Test Event**. You should see something like this in the inbox you chose:

   <figure><img src="/files/vMnxba7gRwp7m6iC6tyJ" alt=""><figcaption></figcaption></figure>
9. **Save**, then toggle the event subscription **On**.

</details>

<details>

<summary>Webhook</summary>

In the event workflow:

1. Set the **IF** parameter to `Issue Change` . (Most event subscriptions will use `Issue Change` or `Issue Update`).
2. In the **Types** parameter, choose `Create`.
3. In the **Severities** parameter, choose `Critical` and `High`.
4. In the **THEN** parameter, choose **Webhook.**
5. In the method, choose **Post**.
6. Enter the URI from your webhook location/provider.
7. In Headers include the parameters you want to send., a quick way to create the content is to:
   1. Choose **Slack** and configure it with everything you need.
   2. Click **Advanced Mode**.
   3. Copy the content.
   4. Choose **Webhook** again.
   5. Paste the content into the headers.
8. Click **Send Test Event**. Confirm your webhook is successful.
9. **Save**, then toggle the event subscription **On**.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/getting-started/deployment-guides/your-first-30-days/8-configure-account-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.