Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

10: Validate

You completed sections 1-8 and made it through your first 30 days — nice work. Your setup is live, and signals are flowing. Now validate the results, confirm notifications land where they should, and build a weekly rhythm that proves value fast.

Review Next

Dashboards

When you log in to Material, you land on the Overview Dashboard. This is a great place to begin investigating as it highlights key security insights ready for review or action including. Drill down into any number to open a pre-filled issue search or click any issue title to open the issue detail view.

This dashboard data updates on a daily cadence, and reflects activity through the previous day.

Email Threats issues and report

Everything you configured in step 6, Enable Email Security can be tracked in a few ways. From the left navigation, expand Email Threats, then click Issues to see just email threat issues:

Then, from the left navigation expand Email Threats, then click Report to open the email threats report:

Learn more here.

Explorer

You've used the Explorer, located in the Material workspace, to create accounts and new tenants in previous deployment steps, and learned how to bulk remediate files. There are a few other functions you can perform in the Explorer:

  • Use MQL and auto-complete to search for messages across all enabled mailboxes in real-time and take bulk actions on the results. You can also search files by writing custom queries about your Google Drive environment. Open the message/file row to drill into details including headers and routing, related accounts, links, attachments.

    • Use cmd+k or click All Actions to download or delete a message, share the message with Material, copy Message ID, etc.

moving image of auto complete feature in message search; use drop downs to choose variables and operators to search with
Auto-complete feature on the Message Search

Learn more here.

Reports

Each protection has its own, downloadable report. To open one, from the left navigation expand the protection, then click Report.

Saved Views

Save and reuse your personalized issue list configurations with Saved Views. Create views with specific filters, sorting, grouping, column arrangements, and search queries to quickly access the issues that matter most to your workflow.

Learn more here.

Best Practices

There are a few actions you can take in just 90 minutes per week to start demonstrating value and validate your configuration choices:

Email Threats report - 15 min/week

Glance at total attacks and tactics:

  • Drill down directly into the numbers to open the related issue filters and investigate.

  • Export a PDF to share graphs and visuals with stakeholders.

File Search/Custom Detections - 30 min/week

  • Run 1-2 high value queries in the Explorer

  • Nudge owners of risky files by revising your file security defaults

  • Tune or add a custom detection if needed

Message Search - 30 min/week

  • Review inbound Email Threat reports

  • Run 1-2 queries in the Explorer

  • Bulk clean anything suspicious (Learn more in Working with Issues)

Event Subscriptions

  • Add new notifications as needed and response when they trigger

Up Next

Now that you're done with your initial deployment, give it a little time to run and get used to the output. Review the Working with Issues guides, then tweak your settings as needed.

Previous9: Configure Account Security
NextDeploy Account Takeover Resilience (ATOR)

Last updated

Was this helpful?