> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/detect/user-reporting-methods.md).

# User Reporting Methods

One of the most valuable ways to detect and remediate phishing emails is to have your employees report suspected messages for you to evaluate. Material places messages similar to each other in an issue, but how you respond to a user reported message is important. It gives you opportunity to reinforce this action, educate your users in addition to remediating in bulk rather than having to go one by one.

In addition to response defaults, specify your remediation defaults to automate your strategy.

### Issue grouping across detection sources

Material deduplicates across all detection sources. If one of your users reports a message that Material has already flagged, or if Material later detects a message your users already reported, a single issue is created, not two separate issues.

The issue is filed under whichever detection source triggered first. Your users who reported the message still receive any configured reporter acknowledgments, regardless of which source created the issue.

{% hint style="success" %}
We generally recommend enabling and configuring all methods of accepting user reports, using the steps below.
{% endhint %}

### Navigate to Settings

To begin, navigate to User Reporting [Settings](/learn-more/risk-areas/email-threats/detect.md#navigate-to-settings).

<figure><img src="/files/mVvMUDTrKE9JROG0Dzbf" alt="" width="224"><figcaption><p>User Reporting Settings</p></figcaption></figure>

***

## Forwarding

To streamline processing and support user awareness and training, you can include a specific email to forward user reported messages to. This is called a **Reporting Address**.

1. Toggle the option **on** to enable forwarding, then enter any email addresses in the **Reporting Addresses** field. Separate multiple addresses with commas, for example `email1, email2`
2. Click **Save**.
3. If you're leveraging the Outlook "report phishing" button, also update your Microsoft Settings with the [details described here](#outlook).

<figure><img src="/files/7f0qqxVWjJUsdfkmvjcv" alt="" width="375"><figcaption><p>Include a Forwarding Address</p></figcaption></figure>

{% hint style="success" %}
Include however many dedicated existing email addresses you have today for reporting phishing, however **don't include multipurpose mailboxes** here (e.g. where users contact your security team about issues that aren't phishing related).
{% endhint %}

### Intermediary Address

Sometimes reporting users forward emails to the wrong email by mistake. Include an **intermediary address** to ensure these emails get to the correct address.

{% hint style="success" %}
Intermediary addresses are only useful when there's an address (or set of addresses) where forwarded phishing reports are misdirected (e.g. if you have a phishing@ and security@ aliases and people accidentally send the reports to security@). Setting up an intermediary address ensures that Material doesn't treat security@ as the account reporting the message.
{% endhint %}

To use intermediary addresses, toggle the option on, then separate with commas same as reporting addresses above.

<figure><img src="/files/keN4DXcJrpfsuRO7dVW5" alt="" width="375"><figcaption><p>Intermediary Address</p></figcaption></figure>

## Label

Make it even simpler for your users to report a suspicious message by allowing them to apply a Gmail label or Outlook category.

Toggle the Label option to **On**.

<figure><img src="/files/SEfwAa50SzIUzRiLOOBr" alt="Label setting" width="375"><figcaption><p>Email Threat Settings - User Reporting</p></figcaption></figure>

* Note, the label name is `Suspicious`, and that is not changeable.
* If a user applies the label and also forwards the email, only one issue is created or similar message added; we deduplicate repeated reports about the same message.

## Email Provider UI (User Interface)

Email Service Providers (ESPs) often have a built-in mechanism for reporting email threats, usually a button. You can leverage this function to detect messages in Material as well. Check the box next to your ESP(s) to enable.

To learn more about Gmail phishing reporting functionality, review [Google's Workspace Admin guides](https://support.google.com/a/answer/7490898?hl=en).

<figure><img src="/files/lHZon8BkqLnAOJGLkRi1" alt="Email Provider UI" width="375"><figcaption><p>Email Threat Settings - User Reporting</p></figcaption></figure>

Even if Email Threat Protection is disabled for a specific user or group, we still ingest any email they report using the methods above.

### Outlook

To avoid issue creation delay when users click the "report phishing button" in Outlook:

1. Set up a [Reporting Address](#forwarding).
2. Once you have the Reporting address designated, as a Microsoft admin navigate to <https://security.microsoft.com/securitysettings/userSubmission> and update the settings to send to that reporting mailbox in addition to Microsoft:

   <figure><img src="/files/aESRnYReuTwd8TBbZoyI" alt="" width="361"><figcaption></figcaption></figure>

To learn more about Outlook phishing reporting, review [Outlook's guides.](https://learn.microsoft.com/en-us/defender-office-365/submissions-users-report-message-add-in-configure)

***

## Identify who reported the message

1. If you're in settings, click **back to workspace,** on the bottom left.
2. From the left navigation, expand **Issues** then click **User Reports**..
3. Open an issue.
4. The **Detected By** field displays the user who reported the message. Scroll down to the bottom and hover over their name to view the report method. Click the user name to view more details about their account and related issues.

<figure><img src="/files/5VWWksep6FjX0dLqnaMw" alt=""><figcaption><p>View User Reports</p></figcaption></figure>

You can also search messages by user in the [Explorer](/learn-more/risk-areas/email-threats/investigate/email-threat-issue-search.md).

{% hint style="success" %}
**Currently deploying?**

Click here to return to the [Enable Email Threat Protection](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/configure-user-reporting.md#user-reporting) guide.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/email-threats/detect/user-reporting-methods.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.