xorlab Abuse Mailbox Automation automates the triage, analysis, and response to suspicious emails reported by staff to an organization’s abuse mailbox. It streamlines case management and ensures timely feedback to reporters, decreasing threat response times, employee awareness and engagement, and resilience to email threats.
xorlab Security Platform has two built-in mechanisms that will automatically handle reported emails for you:
- Verdict-based automation
- Campaign automation
Based on your preference, these mechanisms will automatically send feedback emails back to the reporter and close the case without any manual interaction.
The verdict-based automation generically handles emails depending on the verdict and the confidence. For example, high-confidence spam emails are handled automatically, while low-confidence spam emails create an open case that should be resolved manually. For more information about verdict and confidence, please see Verdict and confidence.
The campaign automation allows you to specify automation based on an arbitrary search query. All future emails that will match your search query will automatically be handled according to your specified configuration. The most common (and powerful) use case is a similarity-based campaign, where all similar emails will be automatically handled in the future.
For more information about the campaign automation, please watch Video Tutorials. This article will not go into more details about campaigns.
Verdict-based automation
The verdict-based automation follows the same principles as the verdict-based actions described in Inbound Email Security. Depending on the verdict and its confidence, a case is either automatically resolved with a corresponding feedback email or kept open for manual inspection.
The default verdict-based automations per confidence are shown in the table below. Auto-handled means that the case is handled automatically, while open means that the case is kept open and needs to be resolved manually.
The defaults are chosen conservatively. In order to change them, please read Actions, Rules and Profiles.
Forwarded is a verdict only available for reported emails. It is assigned when a user reports an email that has been forwarded before and thereby lost all its header information. Those cases cannot be classified correctly and need to be resolved manually.
Benign is a special case and does not stand for a verdict. It stands for any reported email where xorlab Security Platform is highly sure that the email is benign. The actual verdict can be any of the benign verdicts listed in Verdicts but the email must fulfill more strict requirements in order to be automatically handled as benign.
Default feedbackBy default, automatically resolved cases will always trigger a corresponding feedback to the reporter.
