> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/1.15-to-1.43/version-1.27/unified-phishing-issue-experience.md). # Unified Phishing Issue Experience ## Email Threat Improvements {% @arcade/embed url="" flowId="vHCjQJWuMdxR6pTyINO1" %} ### Cases are now Issues, located in the Issue view Collections of similar emails based on their detection method, content, etc. (formerly known as cases) are now all unified in the global issue list. From the left navigation, select either **Email Threats** to view all or focus in on **User Reports** specifically:

### Phishing Detections new location Phishing issues are triggered by one of three detection methods: * [Material detected messages](/learn-more/risk-areas/email-threats/detect/material-email-threat-detections.md) * User reported messages * Admin created rules (custom detections) To view — from the [Detections](/getting-started/fundamentals/detect.md) list, filter by **Detection Category** to the **Email Security** type:

### Default responses when there are multiple detection types Material automatically assigns the lead detection based on which method flagged the threat first. For example, if Material detects the issue **then** a user also reports it after Material detected it — the issue's initial detection is "Material detected". This is important because remediation actions follow the response configured for the message source. If you've configured a different response for user reports than for Material detected messages, the default response for the issue will be for the lead detection type (in our example above, the Material detected default). Auto Threat Hunt runs for 30 days post-Issue creation, whether or not the issue's been resolved. ### Entity and Sender columns

#### View by issue detection source We're replacing the `Detected By` with a new `Detected By` filter — **very soon**. We'll update you in release notes when that change is officially made. {% hint style="info" %} **Update:** This change is now available. You can filter Email Threat issues by detection source using the **Detected By** filter. Learn more in [Email Threat issue details](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details). {% endhint %} Until then, to view issues by a specific detection source, from the Email Threats issue page, **group by Detection** then click into the detection type to view issues detected by a specific source:

### Customize Auto Threat Hunt Attributes From the issue detail view, you can manually select (or de-select) attributes to match similar messages with. Matching messages are then added to the issue. One example for this is to stop adding messages to an issue that are matching only on a generic subject line. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/whats-new/previous-releases/1.15-to-1.43/version-1.27/unified-phishing-issue-experience.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.