> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details.md). # Issue Details From the issue detail view, review more detailed information about why the issue was created and who it's affecting then classify it and update the remediation and response, if needed. ## Issue detail view **Click any issue title to open the issue detail view view.** From here you can dig deeper in a few areas and update remediations and responses to customize on a case by case basis. The issue detail view contains extensive, detailed information about the issue and its detected, similar messages. Learn more in each of these sections:


Highlights	Identify the objectives and tactics used in the issue's messages.	#highlights
Headers and Message Routing	Leverage headers and message routing as needed in downstream tools.	#headers-and-message-routing
Timeline and Metrics	View issue history and multiple data points to help you analyze trends	#timeline
Detected and Similar Messages	Review the message content and learn what was flagged, view similar messages in the issue, and update similarity matching.
Response and Remediation	View and edit the classification, and default response and remediation that was applied. Apply future responses to incoming messages and also to original reporters.

## Analysis #### About this issue This section provides a high-level overview of the detected threat, including: * The detection source * The last update timestamp * **Issue Summary:** a plain-language explanation of why the message was flagged, generated automatically for every email threat issue so you can see the risk at a glance instead of piecing it together from the raw signals. * Sender reputation: A full reputation analysis for senders of suspicious or malicious messages. Includes type of sender (rare, new, etc.), how many accounts reported the message, SPF, DKIM, and DMARC. * Message analysis: a summary of why the message was flagged. This section is expanded by default, so the detail and reasoning are in front of you as soon as you open the issue. * Suggested classification {% hint style="info" %} **Sender Reputation signals are descriptive context, not detection reasons.** The Sender Reputation panel, including chips such as `New Sender Domain`, describes historical sending patterns for your organization. A `new` or `rare` sender label means the sender has little or no prior contact history with your organization. These signals don't cause the email threat classification. The actual reasons a message was flagged come from Material's named detections and AI models, and appear separately in the issue detail view. {% endhint %} If the same message was both detected by Material and reported by one of your users, a single issue is created. The detection source shown here reflects whichever triggered first. When a message matches more than one detection, for example if you have overlapping custom detections, the issue detail view shows the primary detection that created the issue and notes the additional matches.

Issue detail view showing the primary detection and a related issues table — Issue Detail View

#### Campaign Summary The Campaign Summary provides metadata about the campaign, such as the total message count and details regarding specific attachments and links. #### Recipient Summary The Recipient Summary tracks user interaction and impact. It includes: * Total number of recipients. * The number of users who read the email before remediation. * The total number of times users accessed attachments or links. Each threat type is defined so you can make an informed decision on issue classification and remediation choices.

Additional definitions

**SPF Check:** An SPF check (Sender Policy Framework check) is a method used to verify that an email message comes from an authorized server. It involves checking the SPF record of the sending domain to see if the server's IP address is listed as an authorized server. This helps prevent email spoofing and reduces the chances of phishing attacks by ensuring that only legitimate sources can send emails on behalf of a domain. We'll display this as a **pass** or **fail** in the case detail highlights.

*** ## Headers and Message Routing Use header and router data to troubleshoot issues in external tools, such as an MX record checker. For example, you can copy the message ID to view the full message trace in your email provider. * Use **Headers** and **Values** to triage messages and troubleshoot delivery or security issues. * Message **Routing** displays the domain path an email takes. Use this data to help diagnose and identify fraudulent senders. * The **Notes** field displays pass if the authentication check is successful. *** ## Timeline The timeline displays a history of updates to the issue classification, remediation, and response. When similar messages are added, these additions are also displayed in the timeline.

*** ## Copy Issue ID or Share With Material When troubleshooting, you may be asked to send us the Issue ID. To copy this ID: 1. From an issue, click **All Actions** (or `⌘K`). 2. Click **Copy Issue ID**.

All actions menu in an issue showing the Copy Issue ID option — Copy Issue ID

To share the issue directly, click **Share Feedback** then describe what happened in the comment box. **Share Feedback** sends your comments and the issue context to Material for review. Use it to report a false positive, a missed true positive, or other issue-specific feedback.

Issue detail view showing the Give Feedback option — All actions > Give Feedback

You can also share messages in bulk. From the Explorer, select one or more messages, then from the bottom toolbar click **Share with Material**. Learn more in Support Settings. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.