> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/fundamentals/investigate/evidence.md).
# Evidence
The **Issue detail view** displays all evidence and status information that led Material to create the issue in the **analysis card**. Analyze the core properties of the issues (the detection, creation time, triaged by, severity, etc.) and the relevant content or context as to why the detection created this issue in the Evidence section, then make response changes as needed.
All issues have these core properties in common:
{% tabs %}
{% tab title="Name and Detection" %}
* The **name** is a combination of the primary entity (e.g. account, message, file) and the [detection](/getting-started/fundamentals/detect.md) that created the issue. In the example above, `example.email` is the entity and `Account has a non-phishing-resistant MFA factor registers in Microsoft 354` is the detection you can find on the [Detections page](/getting-started/fundamentals/detect.md) (also linked directly in the issue).
* The **description** describes the detection itself.
{% endtab %}
{% tab title="Creation Details" %}
Issue detail view
* **Created**: The time that an event or state triggered the detection to create this issue.
* **Last Updated:** The last time anything was changed about this issue
* **Categories**: Material Detections and their issues are classified into five categories. [Learn more here.](/getting-started/fundamentals/detect.md#categories)
* **Tactics:** Each detection considers a number of tactics, to pinpoint attacks as precisely as possible. These tactics are derived from the [MITRE ATT\&CK Matrix](https://attack.mitre.org/matrices/enterprise/). The tactics relevant to this issue are
* **Triaged By:** The most recent analyst who updated anything in this issue
* **Severity:** Issues inherit their severity from the [detection's default severity.](/getting-started/fundamentals/detect.md#severity-status-and-response)
{% endtab %}
{% tab title="Status" %}
* **Open**: The issue hasn't been triaged yet.
* **In Progress**: This issue is being addressed, but isn't yet resolved.
* **Snoozed**: Snooze an issue when it can't be ignored , but you have others to work on first.
* **Ignored**: Choose this if the issue is expected, like for testing purposes.
* **Resolved**: This indicates the issue is fixed and doesn't need any additional updates.
{% endtab %}
{% endtabs %}
Additional evidence varies based on the detection logic and entity involved. Some properties to consider as you analyze are:
Account entity
Issue Detail View
All Account based issues contain:
* The account holder's name and associated email addresses
* The account holder's roles in either Microsoft 365 or Google
* The account holder's title in either Microsoft 365 or Google
* The account type, either Microsoft or Google
* Last Sync
Microsoft related issues also include:
* User Registration data, relevant to the detection that created this issue. To see JSON data, click the **ellipsis (...)** then select **View Data**.This is useful if you need the exact property name to search with.
* Microsoft Sign-In Logs
Google related issues also include:
* [Google 2-Step Configuration](https://support.google.com/a/answer/9176657?hl=en) (2SV) data
* [Google Admin Configuration](https://workspace.google.com/products/admin/) data
File entity
All File based issues contain:
* **File Type**
* **Location**: Click this to navigate directly to the affected drive
* **Owner**: the current file owner
* **Share With**: users and access levels for the files
* **General Permissions**: derives from the Google settings
* **Created:** issue creation date and time
* **Last Modified:** last time this file was updated
* **Content analysis:** highlighted, potential vulnerabilities depending on the detection that created this issue
* A list of any users that have access to the affected file, and their permissions
Group entity
Similar to Account based issues, Group based issues contain:
* Email addresses associated with the issues
* Any roles affected
* Protections
* A hyperlinked member count; click it to navigate to the explorer and view a list of all affected accounts and analyze more
* Last Sync
Group based issues may contain:
* Google Group Settings
* Microsoft User Registration
{% hint style="info" %}
App, Message, and Tenant entities can appear in the issue list with similar properties.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/getting-started/fundamentals/investigate/evidence.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.