Investigate

An issue represents a single threat identified by a detection. Issues are created when detection logic matches an entity in your Google Workspace or Microsoft 365 environment.

As issues are created, you should:

1. Analyze the evidence presented in the issue
2. Change default responses if needed

Issues Page and Issue Detail View

The All Issues page allows you to view and prioritize issues based on their severity.

You can group issues by entity type (File, Tenant, Message, Account, Group, App) and search by issue name. To group issues by type or detection, click Display Options:

Display Options

Additionally, you can filter issues by status, severity, entity type, and adjust the columns displayed.

• The Trend reports on the right display a high level overview of issue creation. Use them to identify potential spikes and to see issue creation increase or decrease over time.
• Consider the best strategy for triaging your issues — sorting by severity or status, group by entity, etc.

From the All Issues page, click an Issue name to open the Issue detail view. Depending on the entity, different properties display in the analysis card:

Learn more about analysis card properties in Evidence.

Copy Issue ID

When troubleshooting, you may be asked to share the issue with us and/or to send us the Issue ID. To copy this issue ID onto your clipboard, use the ⌘K shortcut then click Copy issue ID.

⌘K opens shortcuts

Open Shortcuts with ⌘K

Filter Definitions

Detection

Filter by a specific detection. Find detection names and descriptions in the Detection View and Detection Detail View.

Detection Category

We've grouped detection types into a few typical categories to help you triage quickly based on your strategy:

Status

• Open: New issue are labeled open
• In Progress: These issues have been marked in progress by a team member.
• Resolved:

  • State-based issues are auto resolved on a cadence as state changes are registered.
  • You, as the analyst, need to close event-based issues. Once you're confident all actions have been taken, change the status to resolved. (An ignored status also closes the issue/removes it from the active issue count).
  • If a new email matches the same threat pattern to an issue that has already been manually resolved, it's attached to the existing issue but doesn't reopen it. The resolved status is preserved. To act on the new message, reopen the issue manually first.
• Ignored: These issues have been marked ignored by a team member, to indicate they're not a threat or need no other action.
• Snoozed: Users can snooze issues for a custom amount of time. Choosing this filter displays all those snoozed issues.

Entity Type

Learn more about entity types here.

Severity

Learn more about severity here.

Tactic

• Account Compromise: occurs when attackers gain unauthorized access to a user's account, often through stolen credentials

  • Compromised External Sender: an external email account that has been hacked, used to send phishing or fraudulent messages to unsuspecting recipients
  • Compromised Internal Sender: an internal email account that has been hacked, typically used to launch phishing attacks or manipulate communications within an organization
  • Thread Hijacking: taking control of an existing email conversation to deceive participants, often used in phishing attacks to gain sensitive information or money
• External Redirection: directs users to malicious websites by misleading them into clicking links that appear legitimate
• Legitimate Service Abuse: exploiting trusted platforms, like Dropbox notifications, to trick users into revealing sensitive information
• Obfuscation: disguises malicious links or content to confuse users, making it harder to identify fraudulent intentions
• Social Engineering: manipulates individuals into divulging confidential information by exploiting trust and psychological tactics
• Spoofing: faking identities to deceive users into revealing sensitive information through fraudulent emails or websites

Analysis

Material automatically assigns analysis labels to issues when suspicious emails are detected. We're constantly updating the objectives we identify based on current trends so this list can update frequently.

• Credential Theft: Unauthorized access to sensitive information, like usernames and passwords

  • Brand Impersonation: Disguising a phishing attempt as a legitimate brand to deceive users into providing sensitive information
  • Fake Login Page: A fraudulent webpage that mimics a legitimate login site to capture user credentials
• Fraud and BEC (Business Email Compromise): targeted scams exploiting email to manipulate business transactions

  • Callback Fraud: a scam where attackers trick victims into calling a fake number, leading to financial theft or personal information compromise
  • Crypto Fraud: Involving cryptocurrencies to trick individuals into losing money or providing sensitive information
  • Extortion: coercing someone into paying money or providing information through threats, often involving the release of sensitive data
  • Gift Card Fraud: victims are deceived into purchasing gift cards and sharing codes, often to pay for nonexistent services or debts.
  • Invoice Fraud: attackers send fake invoices to businesses, tricking them into making unauthorized payments
  • Payroll Fraud: manipulation of payroll processes to steal funds, often by creating fake employees or altering payment amounts
  • PII Theft: unauthorized acquisition of personally identifiable information (PII), such as names, addresses, and social security numbers, for malicious use
• Malware and Ransomware: Malware is malicious software designed to harm systems; ransomware encrypts files, demanding payment for decryption. Both can be delivered via email phishing attacks.

  • Malware Link: A URL that directs users to download malicious software, often disguised within phishing emails or messages to compromise systems
  • Malware Payload: the malicious code or software delivered by an attack, designed to execute harmful actions on a victim's system
  • Ransomware Link: a URL that leads to the download or execution of ransomware, typically disguised in phishing emails to infect the victim's device
  • Ransomware Payload: the specific code or malicious software within ransomware that encrypts files, rendering them inaccessible until a ransom is paid.

You can also filter by creation and resolution dates.

Overview Dashboard

When you log in to Material, you land on the Overview Dashboard (introduced in Version 1.33). This is a great place to begin investigating as it highlights key security insights ready for review or action including. Drill down into any number to open a pre-filled issue search or click any issue title to open the issue detail view.

This dashboard data updates on a daily cadence, and reflects activity through the previous day.