> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/fundamentals/detect.md). # Detect ## Overview A **Detection** is a single rule designed to identify important events or conditions within your Google Workspace or Microsoft 365 environment, which are then surfaced as [Issues](/getting-started/fundamentals/investigate.md). An Issue lets you investigate, categorize, and tailor a response including automatic remediations and responses (more on [default response settings](/getting-started/fundamentals/respond.md) here). Each detection shares these details: {% tabs %} {% tab title="Name & Description" %}

* A unique [**name**](#name-and-description), separate from the issue name * A [**description**](#name-and-description) of the detection's logic and the value it adds to your security strategy {% endtab %} {% tab title="Properties" %}

* **Created by:** either Material or your own custom detection * One or more **categories** the detection belongs to * **Tactics** this detection looks for that lead to issue creation, based on the [MITRE ATT\&CK Matrix](https://attack.mitre.org/matrices/enterprise/) * [**Type**](#type)**:** either state or event-based * **Last updated:** either the logic, severity, remediations, or status {% endtab %} {% tab title="Severity, Status, and Response" %}

* [**Severity**](#severity)**:** carries down to any issues created by the detection. You can change the severity here at the detection level. When you modify severity, it only affects issues created going forward. * [**Status**](#status): Toggling stops issue creation from this detection. Archiving is an option for custom detections and removes the detection from the list. * [**Response**](#respond)**:** Your default, auto-response for any issue created by this detection. You can also apply a unique response to a specific issue. * [**Prevent**](#prevent): Links out to third party settings you can consider updating to prevent future issues of this type. {% endtab %} {% tab title="Other Detection Details" %} * **Active Issues**: Any issues currently unresolved {% endtab %} {% endtabs %} {% hint style="info" %} **When are new detections added or current detections updated?** We add new detections and updates continuously to adapt to evolving cyber threats and reduce false positives. Noteworthy detection enhancements are announced in [What's New](/whats-new.md). {% endhint %} ### What can I customize?


Auto-respond to issues created by a detection			/pages/q8C2BI15cSlIuSKwi4WS
Disable irrelevant detections			#status
Change the detection's default severity			#configure-severity-status-and-default-remediation

## The Detections Page and Detection Detail View The Detections page provides a comprehensive view of **all detections** in Material, regardless of any active issues currently linked to them. Here, you'll find details like names, categories, statuses, active issues, and severity for each detection. It's an essential tool for monitoring potential threats and attacks across your workspaces. From here you can also search for detections and apply filters based on various criteria.

{% hint style="info" %} The **Detections** list filters by the [selected tenant's](/getting-started/deployment-guides/your-first-30-days/1-connect-and-sync.md#connect-your-first-email-tenant) email provider: * **Google Workspace** hides Microsoft 365-only detections. * **Microsoft 365** hides Google Workspace-only detections. * **Global** shows all detections. {% endhint %} #### Detection detail view From the [Detections page](/getting-started/fundamentals/detect.md), click a Detection name to open the **Detection detail view**. This page details the logic used for detection, provides a summary of issues identified and resolved, and includes a list of newly created issues as a result of this specific detection. When a message matches more than one detection, the Detection detail view also surfaces the primary detection's issues as related issues, so you can see the issues another detection created for the same message.

Detection detail view showing related issues from another detection — Detection Detail View

From this view, you can update the severity of issues generated by this detection, turn the detection on or off, and add response actions that are assigned and executed, if available, when an issue is created. At the top of the page, view the detection's properties including the author, relevant categories, type (state or event), and the last update details for logic, severity, remediations, and status. {% hint style="info" %} Too many or missing columns? Click

to choose your display preferences. {% endhint %} On the Detections page and the Detection detail view, there are several key fields that can help you prioritize your triage and investigation process: ### Name and Description Search by any keyword in the detection title to narrow your results (for example, `MFA` lists all detections with MFA in their name). Each Material detection is uniquely named and also referenced in issues created by the detection. Note, the search field uses `and` logic, not `or`. The result list will show detections matching all specified criteria. If no results appear, consider clearing filters and applying them one by one.

{% hint style="success" %} The title's first word identifies the **entity** source for the detection.\ \ For example, **File contains sensitive content and is shared externally** creates issues related to specific files, while **Google account may be compromised** creates issues related specifically to Google accounts, and so on. Note, custom detections only follow this naming structure if you title them that way. {% endhint %} Material Detections are described in the [Detection detail view](#the-detections-page-and-detections-detail-view):

Some of our detections originate in Google or Microsoft alerts, and this is noted in the description. Detailed descriptions for Google detections are [located in their documentation](https://support.google.com/a/answer/9104586?sjid=17012767436982207808-NC). *** ### Properties Detection properties are defined on the Detection detail view, and are available as filters on the Detections page to help you focus your triage strategy.

#### Created By Detections are either available out of the box (created by Material), or [custom created](/getting-started/fundamentals/detect/custom-detections.md) by one of your admins. #### Categories Material's detections are classified into five categories: * Configuration Management * Data Governance * Data Security * Email Security * Identity Security Each category covers activity within one or more applications in your cloud office.

On the Detections page, hover over the icons to see the names for the categor(ies) the detection belongs to, or filter the list to one or more categories. #### Tactics Each detection considers a number of tactics, to pinpoint attacks as precisely as possible. These tactics are derived from the [MITRE ATT\&CK Matrix](https://attack.mitre.org/matrices/enterprise/). (If you don't see the tactic column Click

to choose your display preferences.) #### Type Each detection is either **state-based** or **event-based**. * **State-based**: identifies potential issues that could lead to future threats. These are ongoing and will only be resolved automatically when a future Material scan shows the risk no longer exists. You can always update the status to 'Ignored'. * **Event-based**: identifies a suspicious event that requires further investigation. These detections occur at specific points in time and can only be resolved manually once the investigation is complete and the threat is resolved. #### Last Updated Refers to either the logic, severity, remediations, or status. #### Entity Type Each detection focuses on one entity type: account, file, group, message, or tenant — identified by the first word of the [detection title](#detection-title). You can also filter the detection list by Entity Type.

*** ### Configure Severity, Status, and Default Remediation

#### Severity

We assign a default severity for each detection based on the potential operational, financial, or reputational impact the activity has on an organization. Five severities exist: 1. **Critical**: Immediate action is required. The potential scope of the activity is broad. 2. **High**: Immediate action is required. 3. **Medium**: Action is required, but the situation isn’t serious at the time of alert creation. 4. **Low**: It’s up to investigator discretion whether action is necessary. 5. **Informational**: No action necessary for issues generated by this detection. Use the **Severity** drop down to filter for the list by one or more severities. To change the default severity level for the detection (and any issues created after your change), click the ellipsis at the end of the row or edit it in the Detection detail view. #### Status

A detection can have one of three statuses, meaning it is: * **On**: actively creating issues * **Off:** disabled and not actively creating issues * **Archived:** Archiving is for custom detections only and removes the detection from the list. Unarchive in the detection details if needed. **Disable a detection** To disable, click the ellipsis at the end of the row then choose **disable detection**. You can also toggle the detection on or off from the [Detection detail view](#detection-detail-view). #### Respond When you set a response at the detection level, any issue created by this detection will follow the same workflow unless you change the response at the issue level. The response workflow begins when the event or state is triggered (and subsequently creates an issue). If you edit the default response in the detection, it applies to any issues going forward (but doesn't apply retroactively). [Learn more about configuring responses here.](/getting-started/fundamentals/respond/configure-default-responses.md) #### **Prevent** In many cases it's valuable to get ahead of issue creation and stop potential issues at the source (outside of Material). If there are relevant actions you can take in Google or Microsoft we'll place the links here. ### Other Detection Details #### Active Issues Active issues that aren't closed. To view only the detections with active issues, click the **Filters** drop-down.

#### Open and Resolved Issue Counts On the Detection detail view, Open and Resolved issues per day graphs display showing issues over time. Hover over the graph to see the count by day.

{% hint style="danger" %} [Custom detections](/getting-started/fundamentals/detect/custom-detections.md) don't display the same properties and details as Material Detections. You'll see creation dates, author, and matching criteria. {% endhint %} {% hint style="warning" %} The detections on the Detections page display default severities and responses. You can update these on an individual basis in the [issues](/getting-started/fundamentals/investigate.md) themselves. {% endhint %} *** ## Up Next To investigate issues related to a specific detection, either click the active issue count from the Detections page or one of the issues in the Detection detail view. Learn more about the [Issues page here](/getting-started/fundamentals/investigate.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/getting-started/fundamentals/detect.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.