Evidence

The Issue detail view displays all evidence and status information that led Material to create the issue in the analysis card. Analyze the core properties of the issues (the detection, creation time, triaged by, severity, etc.) and the relevant content or context as to why the detection created this issue in the Evidence section, then make response changes as needed.

All issues have these core properties in common:

Name and Detection

• The name is a combination of the primary entity (e.g. account, message, file) and the detection that created the issue. In the example above, example.email is the entity and Account has a non-phishing-resistant MFA factor registers in Microsoft 354 is the detection you can find on the Detections page (also linked directly in the issue).
• The description describes the detection itself.

Creation Details

Issue detail view

• Created: The time that an event or state triggered the detection to create this issue.
• Last Updated: The last time anything was changed about this issue
• Categories: Material Detections and their issues are classified into five categories. Learn more here.
• Tactics: Each detection considers a number of tactics, to pinpoint attacks as precisely as possible. These tactics are derived from the MITRE ATT&CK Matrix. The tactics relevant to this issue are
• Triaged By: The most recent analyst who updated anything in this issue
• Severity: Issues inherit their severity from the detection's default severity.

Status

• Open: The issue hasn't been triaged yet.
• In Progress: This issue is being addressed, but isn't yet resolved.
• Snoozed: Snooze an issue when it can't be ignored , but you have others to work on first.
• Ignored: Choose this if the issue is expected, like for testing purposes.
• Resolved: This indicates the issue is fixed and doesn't need any additional updates.

Additional evidence varies based on the detection logic and entity involved. Some properties to consider as you analyze are:

Account entity

Issue Detail View

All Account based issues contain:

• The account holder's name and associated email addresses
• The account holder's roles in either Microsoft 365 or Google
• The account holder's title in either Microsoft 365 or Google
• The account type, either Microsoft or Google
• Last Sync

Microsoft related issues also include:

• User Registration data, relevant to the detection that created this issue. To see JSON data, click the ellipsis (...) then select View Data.This is useful if you need the exact property name to search with.

• Microsoft Sign-In Logs

Google related issues also include:

• Google 2-Step Configuration (2SV) data
• Google Admin Configuration data

File entity

All File based issues contain:

• File Type
• Location: Click this to navigate directly to the affected drive
• Owner: the current file owner
• Share With: users and access levels for the files
• General Permissions: derives from the Google settings
• Created: issue creation date and time
• Last Modified: last time this file was updated

• Content analysis: highlighted, potential vulnerabilities depending on the detection that created this issue

• A list of any users that have access to the affected file, and their permissions

Group entity

Similar to Account based issues, Group based issues contain:

• Email addresses associated with the issues
• Any roles affected
• Protections
• A hyperlinked member count; click it to navigate to the explorer and view a list of all affected accounts and analyze more
• Last Sync

Group based issues may contain:

• Google Group Settings

• Microsoft User Registration

App, Message, and Tenant entities can appear in the issue list with similar properties.