Issue Closure and Manual Classification

Issue Closure

• For state-based issues (e.g. vulnerabilities or misconfigurations), Material automatically detects if the vulnerability is fixed then resolves the issue.
• You, as the analyst, need to close event-based issues (e.g. notification about unusual behavior). Once you're confident all actions have been taken after investigating them, change the status to resolved. (An ignored status also closes the issue/removes it from the active issue count).

Manual Classification

After reviewing the evidence, you may want to update the classification on an issue to better match your analysis.

Default Remediation Actions

When you manually change an issue's classification, Material stages the default remediation for that classification. Click Save to apply it.

To configure the default remediation:

1. From the left navigation, expand Email Threats, expand Settings, then click Issue Triage.
2. Set remediation per classification just as you would with User Report Auto Classification.

Mark suspicious or sensitive

From an issue, click All actions (⌘K) then choose mark suspicious or mark sensitive:

Mark suspicious or mark sensitive from the All actions menu.