> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/investigate.md).
# Investigate
The [issue view](/getting-started/fundamentals/investigate.md#issues-page-and-issue-detail-view) contains all the high level information you need to triage and start investigating.
Material automatically analyzes reported messages to find similar threats and automatically de-escalate false positives. You can investigate these issues to:
* Understand attack methods and trends
* Review and classify email threat issues in the issue detail view
* Override default responses and remediations on a case by case basis in the issue detail view
## Email Threat Issues
**Email Threat Issues** in Material are collections of similar emails based on their detection method, content, etc. All issues display on the issue page.
To filter to Email Threat issues specifically,
1. From the left navigation, expand Issues.
2. Click **Email Threats**.
From the Issue page, you have a high level view of the message that triggered issue creation, what/who detected/reported it, a quick analysis, scope, classification, current remediation, and creation time.
{% hint style="info" %}
You can also filter issues by custom criteria using the search criteria described in [Issue Search](/learn-more/risk-areas/email-threats/investigate/email-threat-issue-search.md).
{% endhint %}
Triage efficiently by filtering your view based on a number of fields and also drill down into the issue itself, and the issues contained within. Analyze and if needed, [classify the issue and update the response or remediation](/learn-more/risk-areas/email-threats/investigate/issue-details/response-and-remediation.md).
## Filter Issue by Source
Email Threat issues fall under one of three detections:
* **Message flagged by Material**
* For User Reported issues, click **User Reports** in the left navigation:
You can also group by detection (rather than issue). Click **Display Options**, then **Group By: Detection**
Group By Detection
{% hint style="info" %}
[Filter descriptions](/getting-started/fundamentals/investigate.md#filter-definitions) are located in the Fundamentals guides.
{% endhint %}
### Exclude closed and/or ignored issues
To exclude [resolved](#open-vs.-resolved-issues) and/or ignored[^1] issues from your view, click the **List Options** button then toggle on or off:
***
## Open vs. Resolved Issues
Issues auto-resolve in 30 days. Most phishing attacks occur over a few days then end. 30 days allows us to detect any similar emails and move them into a issue for you to review (an **open** issue). Once the 30 days is up, we resolve the issue and stop sending emails to it (a **resolved** issue).
Any emails detected with similar parameters once an issue resolves are likely a new attack, so a new issue is opened for these emails.
There's no need to reopen a issue (and you can't reopen) because anything with a similar attack method will just create a new open issue. In other words, nothing is missed because a issue is resolved. Unlike a ticketing system or similar, a resolved issue doesn't mean we stop detecting.
To view your closed issues:
1. Navigate to the [Email Threats Issue dashboard](#email-threat-issues).
2. Click the **List Options** button then toggle on or off:
[^1]: admins can change the issue status to ignored to remove them from the triage view
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/learn-more/risk-areas/email-threats/investigate.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.