> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/auto-respond/banner-custom-message-and-template-best-practices.md). # Banner, custom message, and template best practices ## Banners You can add custom banners[^1] to [Material Detections](/learn-more/risk-areas/email-threats/auto-respond.md#material-detected-responses-and-remediation). Banner content for [User Reported messages](/learn-more/risk-areas/email-threats/detect/user-reporting-methods.md) are added by default. {% hint style="info" %} **Banner vs. Custom Message** A banner will show up in the email body itself, while a custom message for a Speedbump/Block page shows up on the Material-hosted interstitial that appears after you click the speedbumped link. {% endhint %} ## Custom Messages Custom messages appear on a page your user is redirected to after a detected message is speedbumped or blocked. They are appended to the default messaging. Consider these best practices when you write your messages: * **Be clear, concise, and succinct**: Being with a straightforward statement about the situation. Clearly indicate that an email was identified as a potential phishing attempt and that you have taken steps to protect everyone. Avoid jargon to ensure everyone understands. * **Provide guidance:** Offer next steps for anything you want your users to do as a result of this remediation. For example, you could remind them to avoid clicking on suspicious links, report any suspicious emails, and ensure their security settings are up to date. * **Reassure and Educate**: End the message by reassuring employees that their security is a priority and that you’re taking necessary actions. If relevant, you could also reference recent security training or announcements. ## Templates Templates are default responses sent to users when they report a suspicious message. You can have multiple templates for **Response for messages marked safe**, **Response for messages marked malicious**, or **Response for messages marked spam** so that you can customize your response on a case by case basis once you classify the message. ### How to create a template 1. From **User Reporting Settings**, expand either **Response for messages marked safe**, **Response for messages marked malicious**, or **Response for messages marked spam** 2. From the template drop down, click **Create a New Template**

Create a new template

3. Enter the details for your template then **Save**. To choose an available variable to personalize your message, choose one from the drop-down. {% hint style="success" %} **Template Best Practices** Take a "warm, but loud" approach. Consider the level of disruption and risk that best supports your security strategy. Most detected emails responses are effective with default messaging. {% endhint %} *** ### Send classification responses to initial reporters Default responses once you've classified don't send to the users who reported per classification by default. However, you can update this on a case by case basis and trigger another response to let them know how the issue was classified. In the issue, choose **Also send to previous reporters.**

From the issue view, under Reporter Response

*** ### Send reporter acknowledgements with other tools You can use a webhook to create your own reporter acknowledgement via Slack or other tools. It's not represented in the issue timeline, but all the settings apply to it even if it's the event fires. [^1]: A **banner** is a visual alert displayed at the top of an email to inform users of potential risks. It may indicate that the email is from an external source or contains suspicious links, helping users exercise caution. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/learn-more/risk-areas/email-threats/auto-respond/banner-custom-message-and-template-best-practices.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.