Actions, Rules and Profiles

Rules are the basis for all email actions of xorlab Security Platform. They define the characteristics and behavior of the inbound email security as well as the Abuse Mailbox Automation:

Email quarantining
Subject rewrites
Attachment removals
Quarantine notifications
Feedback and acknowledgments for reported emails
Auto-handling of reported emails

A profile is a predefined set of rule parameters that you can reuse to configure xorlab Security Platform for common use cases. There are a few different mechanisms to configure xorlab Security Platform for the above-mentioned aspects, varying in complexity and flexibility. Start with the first one and only move to the next if it does not cover your use case:

Simple and standardized: Go through the different provided profiles described below and configure the ones that fit your use case. Profiles are standardized, tested, and should cover most scenarios.
Advanced: Manually configure certain rule parameters. This can be used to fine-tune or override specific actions of xorlab Security Platform. Just go to the Actions panel in XCC or edit a config file.
Expert: Write custom rules. Rules provide high flexibility and can be tailored to cover most requirements. The xorlab Security Platform rule language allows combining indicators and actions in virtually every possible way. However, xorlab does not yet provide documentation for this. If you require custom rules, please contact support@xorlab.com.

Profiles

The active profiles are configured in the activeguard/core/active_guard.yml file:

rules:
  params:
  - default.properties
  - <profile1>
  - ...
  - local.properties
  - ui.properties

The profiles are applied in the specified order. This means that, in the example above, rule parameters from local.properties overwrite parameters from the default.properties, but the configuration that a user sets in UI (ui.properties) has the highest precedence and will be used by xorlab Security Platform. You can specify as many profiles as you want.

Always keep default.properties as the first entry and do not remove it. It contains the default parameters necessary for xorlab Security Platform to run properly.

The ui.properties profile should always be the last one and is empty by default. It allows you to override any parameters from the predefined profiles with settings configured in UI in the Actions panel in XCC. The following table lists the available profiles:

Profile	Description
`default_actions.properties`	Default profile for active inbound email security It uses subject rewrites for lower confidence decisions and quarantine actions for higher confidence decisions. Subject rewrite text is `[SPAM]` It does not use attachment removal nor quarantine notifications
`no_subject_rewrite_no_quarantine.properties`	“Toothless” mode This profile deactivates all quarantine actions and subject rewrites. This profile is usually used for evaluation purposes where XSP should not perform any actions on the email traffic
`no_auto_feedback.properties`	Deactivates all automatic feedback and acknowledgment emails for reported emails If used, users will not get any automatic reply after reporting an email Note: this profile does not prevent the sending of manual feedback through the GUI
`default_dana.properties`	Configures the default SaaS Sandbox settings Applies the default dynamic analysis scope, including the additional coverage for recipients in the Exposed accounts, High-value targets, and Recipient dynamic analysis lists
`monitoring_dana_offline_only.properties`	Configures the default SaaS Sandbox settings for monitoring mode Same scope as `default_dana.properties`, but scans are performed offline
`no_dana_except_for_specific_recipients.properties`	Disables Sandbox except for recipients in the Recipient dynamic analysis list
`fp_low.properties`	Configures the detection to be less aggressive to avoid false positives This profile should be added per default in all deployments and only removed when a more aggressive detection is required
`learning_mode.properties`	Can be used for active inbound email security during the learning phase of xorlab Security Platform Basic defense is active (quarantining and subject rewrites), but advanced filters that depend on the learning are disabled to prevent false positives
`monitoring_mode.properties`	Used when xorlab Security Platform runs in the monitoring mode Should not be used in other cases

The older profile fp_sensitive.properties is not listed here anymore as it will be deprecated in a future release. It can still be used, but new deployments should instead use fp_low.properties.

The duration of the learning phase is documented in Detection Defaults → Learning phase, and the delivered dynamic analysis values in Dynamic Analysis. Password required.

Common profile configurations

You can learn how to use the profiles by studying the following profile configurations and their purposes.

Standard

Standard inbound email security with feedback and acknowledgments:

rules:
  params:
  - default.properties
  - default_dana.properties
  - default_actions.properties
  - fp_low.properties
  - local.properties
  - ui.properties

Standard with no feedback

Standard inbound email security with deactivated feedback and acknowledgments:

rules:
  params:
  - default.properties
  - default_dana.properties
  - default_actions.properties
  # Disable feedback and acknowledgments for reported emails
  - no_auto_feedback.properties
  - fp_low.properties
  - local.properties
  - ui.properties

Learning phase with passive defense (evaluation mode)

Disable all actions on emails. Can be used as an evaluation mode as well as during learning phase if no actions should be taken:

rules:
  params:
  - default.properties
  - default_dana.properties
  - default_actions.properties
  # Disable quarantining and subject rewrites
  - no_subject_rewrite_no_quarantine.properties
  # Disable feedback and acknowledgments for reported emails
  - no_auto_feedback.properties
  - fp_low.properties
  - local.properties
  - ui.properties

Learning phase with active defense

Learning phase with active inbound email security:

rules:
  params:
  - default.properties
  - default_dana.properties
  - default_actions.properties
  # Disable certain rules that require completed learning phase
  - learning_mode.properties
  - fp_low.properties
  - local.properties
  - ui.properties

Monitoring mode

Used only when xorlab Security Platform runs in the monitoring mode (“BCC mode”):

rules:
  params:
  - default.properties
  - monitoring_dana_offline_only.properties
  - monitoring_mode.properties
  - fp_low.properties
  - local.properties
  - ui.properties

Actions panel

Rule parameters can be configured to fine-tune the system in addition to the predefined profiles. You can either use the Actions panel available in the Admin tools of XCC or manually enter the parameters in a config file. In fact, all parameters configured here end up as entries in the ui.properties profile that has the highest precedence. See the Actions panel in action:

Common actions are:

Changing the action of a verdict (e.g., subject rewrite instead of quarantining)
Changing the subject rewrite text
Disabling specific rules
Enabling or disabling certain feedback emails for reported emails

To access the Actions panel:

On the main screen, click the tiles icon next to your account name and click the Admin icon in the displayed menu:
On the resulting Admin page, click the Actions tile:
This opens the Actions panel where you can adjust rule parameters:

As you can see, the Actions panel allows configuring actions for verdicts in four categories from the menu on the left:

Inbound Threat Protection: Spam, Phishing, Impersonation, VIP Fraud, Extortion, Malware, BEC, Blacklist
Internal Threat Protection: Phishing, Extortion
Outbound Data Loss Protection: Data Loss
Case Reporting: Spam, Phishing, Impersonation, VIP Fraud, Extortion, Malware, BEC, Blacklist

To change settings for a particular verdict, just hover your mouse over its tile and click the pen icon that appears in the top-right corner:

The edit pane will present you with message actions for a specific confidence level (if available): you can choose to quarantine a message, deliver it, or deliver with subject rewrite with your custom prefix (option not available in the case of Outbound Data Loss protection). You can also disable the rule altogether:

For Case Reporting actions, the options differ slightly and allow you to decide whether the case should be resolved manually or automatically, and, if the latter, whether the reporter should be notified on case closing and which template to use for that:

We demonstrate Case Reporting actions in this short tutorial:

Rule parameters

If you don’t want to use the Actions panel described above and you prefer entering the rule parameters manually, you can do that in the activeguard/core/rule_sets/90_local/params/local.properties profile which is empty by default. Below you can find common rule parameters available for inbound email security as well as for the handling of reported emails.

Inbound email security

For a description of the concepts and defaults, please refer to Inbound Email Security.

Parameters

All available parameters are listed below:

BEC_decision_action
BEC_decision_email_screenshot
BEC_decision_keep_dana_assets
BEC_decision_notify_user
BEC_decision_subject_rewrite
EXPLOIT_dynamic_decision_action
EXPLOIT_dynamic_decision_email_screenshot
EXPLOIT_dynamic_decision_keep_dana_assets
EXPLOIT_dynamic_decision_notify_user
EXPLOIT_dynamic_decision_subject_rewrite
EXPLOIT_static_decision_action
EXPLOIT_static_decision_email_screenshot
EXPLOIT_static_decision_keep_dana_assets
EXPLOIT_static_decision_notify_user
EXPLOIT_static_decision_subject_rewrite
EXTORTION_decision_action
EXTORTION_decision_email_screenshot
EXTORTION_decision_keep_dana_assets
EXTORTION_decision_notify_user
EXTORTION_decision_subject_rewrite
BLACKLIST_decision_action
BLACKLIST_decision_email_screenshot
BLACKLIST_decision_keep_dana_assets
BLACKLIST_decision_notify_user
BLACKLIST_decision_subject_rewrite
FILTER_high_confidence_decision_action
FILTER_high_confidence_decision_email_screenshot
FILTER_high_confidence_decision_keep_dana_assets
FILTER_high_confidence_decision_notify_user
FILTER_high_confidence_decision_subject_rewrite
FILTER_medium_confidence_decision_action
FILTER_medium_confidence_decision_email_screenshot
FILTER_medium_confidence_decision_keep_dana_assets
FILTER_medium_confidence_decision_notify_user
FILTER_medium_confidence_decision_subject_rewrite
FILTER_low_confidence_decision_action
FILTER_low_confidence_decision_email_screenshot
FILTER_low_confidence_decision_keep_dana_assets
FILTER_low_confidence_decision_notify_user
FILTER_low_confidence_decision_subject_rewrite
IMPERSONATION_high_confidence_decision_action
IMPERSONATION_high_confidence_decision_email_screenshot
IMPERSONATION_high_confidence_decision_keep_dana_assets
IMPERSONATION_high_confidence_decision_notify_user
IMPERSONATION_high_confidence_decision_subject_rewrite
IMPERSONATION_medium_confidence_decision_action
IMPERSONATION_medium_confidence_decision_email_screenshot
IMPERSONATION_medium_confidence_decision_keep_dana_assets
IMPERSONATION_medium_confidence_decision_notify_user
IMPERSONATION_medium_confidence_decision_subject_rewrite
IMPERSONATION_low_confidence_decision_action
IMPERSONATION_low_confidence_decision_email_screenshot
IMPERSONATION_low_confidence_decision_keep_dana_assets
IMPERSONATION_low_confidence_decision_notify_user
IMPERSONATION_low_confidence_decision_subject_rewrite
MALWARE_dynamic_decision_action
MALWARE_dynamic_decision_email_screenshot
MALWARE_dynamic_decision_keep_dana_assets
MALWARE_dynamic_decision_notify_user
MALWARE_dynamic_decision_subject_rewrite
MALWARE_static_decision_action
MALWARE_static_decision_email_screenshot
MALWARE_static_decision_keep_dana_assets
MALWARE_static_decision_notify_user
MALWARE_static_decision_subject_rewrite
PHISHING_high_confidence_decision_action
PHISHING_high_confidence_decision_email_screenshot
PHISHING_high_confidence_decision_keep_dana_assets
PHISHING_high_confidence_decision_notify_user
PHISHING_high_confidence_decision_subject_rewrite
PHISHING_medium_confidence_decision_action
PHISHING_medium_confidence_decision_email_screenshot
PHISHING_medium_confidence_decision_keep_dana_assets
PHISHING_medium_confidence_decision_notify_user
PHISHING_medium_confidence_decision_subject_rewrite
PHISHING_low_confidence_decision_action
PHISHING_low_confidence_decision_email_screenshot
PHISHING_low_confidence_decision_keep_dana_assets
PHISHING_low_confidence_decision_notify_user
PHISHING_low_confidence_decision_subject_rewrite
SPAM_high_confidence_decision_action
SPAM_high_confidence_decision_email_screenshot
SPAM_high_confidence_decision_keep_dana_assets
SPAM_high_confidence_decision_notify_user
SPAM_high_confidence_decision_subject_rewrite
SPAM_medium_confidence_decision_action
SPAM_medium_confidence_decision_email_screenshot
SPAM_medium_confidence_decision_keep_dana_assets
SPAM_medium_confidence_decision_notify_user
SPAM_medium_confidence_decision_subject_rewrite
SPAM_low_confidence_decision_action
SPAM_low_confidence_decision_email_screenshot
SPAM_low_confidence_decision_keep_dana_assets
SPAM_low_confidence_decision_notify_user
SPAM_low_confidence_decision_subject_rewrite
VIP_FRAUD_high_confidence_decision_action
VIP_FRAUD_high_confidence_decision_email_screenshot
VIP_FRAUD_high_confidence_decision_keep_dana_assets
VIP_FRAUD_high_confidence_decision_notify_user
VIP_FRAUD_high_confidence_decision_subject_rewrite
VIP_FRAUD_medium_confidence_decision_action
VIP_FRAUD_medium_confidence_decision_email_screenshot
VIP_FRAUD_medium_confidence_decision_keep_dana_assets
VIP_FRAUD_medium_confidence_decision_notify_user
VIP_FRAUD_medium_confidence_decision_subject_rewrite
VIP_FRAUD_low_confidence_decision_action
VIP_FRAUD_low_confidence_decision_email_screenshot
VIP_FRAUD_low_confidence_decision_keep_dana_assets
VIP_FRAUD_low_confidence_decision_notify_user
VIP_FRAUD_low_confidence_decision_subject_rewrite
INTERNAL_EXTORTION_decision_action
INTERNAL_EXTORTION_decision_email_screenshot
INTERNAL_EXTORTION_decision_keep_dana_assets
INTERNAL_EXTORTION_decision_notify_user
INTERNAL_EXTORTION_decision_subject_rewrite
INTERNAL_PHISHING_high_confidence_decision_action
INTERNAL_PHISHING_high_confidence_decision_email_screenshot
INTERNAL_PHISHING_high_confidence_decision_keep_dana_assets
INTERNAL_PHISHING_high_confidence_decision_notify_user
INTERNAL_PHISHING_high_confidence_decision_subject_rewrite
INTERNAL_PHISHING_medium_confidence_decision_action
INTERNAL_PHISHING_medium_confidence_decision_email_screenshot
INTERNAL_PHISHING_medium_confidence_decision_keep_dana_assets
INTERNAL_PHISHING_medium_confidence_decision_notify_user
INTERNAL_PHISHING_medium_confidence_decision_subject_rewrite
INTERNAL_PHISHING_low_confidence_decision_action
INTERNAL_PHISHING_low_confidence_decision_email_screenshot
INTERNAL_PHISHING_low_confidence_decision_keep_dana_assets
INTERNAL_PHISHING_low_confidence_decision_notify_user
INTERNAL_PHISHING_low_confidence_decision_subject_rewrite
WHITELIST_decision_action
SIMULATION_decision_action

Low-confidence rulesThe following low-confidence rules are disabled or passive by default, so configuring their parameters will only have an effect if you set their _low_confidence_decision_state to ACTIVE:

VIP_FRAUD
IMPERSONATION

Parameter suffixes

Available suffixes to the parameters for inbound email defense:

General parameter suffix	Function	Values
`_action`	Decides what should happen with the email	`QUARANTINE`, `DROP`, `DELIVER` or `UNDECIDED` `UNDECIDED` will result in a `DELIVER` if no other rule specifies another action
`_email_screenshot`	Enables or disables email content preview as a static image	`true` or `false`
`_keep_dana_assets`	Enables or disables storing Sandbox scan assets	`true` or `false`
`_notfiy_user`	Sends the recipient a notification that an inbound email has been quarantined	`true` or `false`
`_subject_rewrite`	Prepends a specified text to the email when delivered. Usually used in conjunction with the `DELIVER` or `UNDECIDED` action	text string

Those rule parameters can be adjusted per verdict and confidence. For example, the following configuration activates quarantining for high-confidence phishing, but delivers medium-confidence phishing with a subject rewrite:

# Quarantine high-confidence phishing emails
PHISHING_high_confidence_decision_action=QUARANTINE
# Do not send a quarantine notification
PHISHING_high_confidence_decision_notify_user=false
# Do not do a subject rewrite
PHISHING_high_confidence_decision_subject_rewrite=
 
# Deliver medium-phishing confidence emails (if no other verdict has another decision)
# Specifying DELIVER would force-deliver this email even if another verdict also applies
PHISHING_medium_confidence_decision_action=UNDECIDED
# Do not send a quarantine notification
PHISHING_medium_confidence_decision_notify_user=false
# Do a subject rewrite with [SPAM]
PHISHING_medium_confidence_decision_subject_rewrite=[SPAM]

Attachment removal and replacement

Based on your policy, xorlab Security Platform can remove attachments or replace them with a text file. By default, this happens only for incoming emails. You can activate this mechanism for:

Malware, exploit and filter (policy) verdicts—in this case, XSP will replace/remove all attachments that lead to a malware, exploit, or filter verdict.
File indicators—in this case attachments will be replaced/removed independently of the verdict but based on indicators like, for example, the file type or file content.

After an attachment was replaced or removed, the original attachment is deleted and cannot be recovered anymore.

To enable attachment removal or replacement:

Open the activeguard/core/rule_sets/90_local/params/local.properties file in Expert Editor and add the following two lines (you can adjust the second line if you want to change the name of the replacement file):

# Global switch for enabling attachment removal/replacement
POLICY_attachment_transform_state=ACTIVE
# Control the file name of the text file which replaces the attachment. Use %s to include the original file name
POLICY_attachment_replace_filename_formatstring=removed-%s.txt

You can apply attachment replacement to incoming and outgoing traffic (incoming is by default). In the activeguard/core/rule_sets/90_local/params/local.properties, you can select for what flow it is applicable. Please add the value below and change to what flow it should apply with the following commands: ALL, INCOMING and OUTGOING.
POLICY_attachment_transform_direction=INCOMING

To activate attachment removal/replacement for malware, exploit or filter verdict, add the following lines. Every line corresponds to a verdict and you can decide for each if you want to do an attachment removal (remove), an attachment replacement (replace), or nothing (keep, default).

# Enable attachment removal. Supported values are: keep(default)/remove/replace
POLICY_malware_dynamic=replace
POLICY_malware_static=replace
POLICY_exploit_static=replace
POLICY_exploit_dynamic=replace
# Use attachment removal/replacement on filter verdicts with care.
POLICY_attachment_filter=

To activate attachment removal/replacement for certain file indicators, you can configure one or more of the following lines:

# Enable attachment removal. Supported values are: keep(default)/remove/replace
POLICY_encrypted_archive_file=
POLICY_excessive_nesting=
# Replace/remove all executable files
POLICY_executable_file=
# Replace/remove all files with blacklisted extensions/hashes/file outputs 
POLICY_file_extension_is_blacklisted=
POLICY_file_hash_is_blacklisted=
POLICY_file_output_is_blacklisted=
# Replace/remove all flash files
POLICY_flash=
POLICY_legacy_archive_file=
POLICY_html_file=
POLICY_iso_file=
POLICY_office_encrypted=
# Replace/remove all files with VBA script
POLICY_office_vbascript=
# Replace/remove all files with dangeours VBA script (executable, file, network or registry directives)
POLICY_office_dangerous_vbascript=
POLICY_shortcut_file=

Attachment removal based on blacklists only works if the quarantine action for blacklist matches is disabled. If you need help adjusting this setting, please contact support@xorlab.com

For every use case above, you can specify the text in the replacement file with the following properties:

# If attachment replacement is enabled, this is the generic fallback text which goes into the text file replacing the file.
POLICY_attachment_replace_text=This attachment got removed as it violated our security policy.
# Specific replacement tests:
POLICY_attachment_replace_text_executable_file=This attachment got removed as it was an executable file and thus violated our security policy.
POLICY_attachment_replace_text_legacy_archive_file=This attachment got removed as it was an archive and thus considered dangerous.
POLICY_attachment_replace_text_excessive_nesting=This attachment got removed because of excessive nesting of files.
POLICY_attachment_replace_text_encrypted_archive_file=This attachment got removed as it was an encrypted archive and thus violated our security policy.
POLICY_attachment_replace_text_file_extension_is_blacklisted=This attachment got removed as it had a blacklisted file extension.
POLICY_attachment_replace_text_file_hash_is_blacklisted=This attachment got removed as it was blacklisted.
POLICY_attachment_replace_text_file_output_is_blacklisted=This attachment got removed as it had a blacklisted file extension.
POLICY_attachment_replace_text_flash=This attachment got removed as it was a flash file and thus violated our security policy.
POLICY_attachment_replace_text_html_file=This attachment got removed as it was a html file and thus violated our security policy.
POLICY_attachment_replace_text_iso_file=This attachment got removed as it was an iso file and thus violated our security policy.
POLICY_attachment_replace_text_office_encrypted=This attachment got removed as it was an office file with encrypted content and thus violated our security policy.
POLICY_attachment_replace_text_office_vbascript=This attachment got removed as it was an office file with active content and thus violated our security policy.
POLICY_attachment_replace_text_shortcut_file=This attachment got removed as it was a shortcut file and thus violated our security policy.
POLICY_attachment_replace_text_office_dangerous_vbascript=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_malware_dynamic=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_exploit_dynamic=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_malware_static=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_exploit_static=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_filter=This attachment got removed as it violates violated our security policy.

Adding analysis results to email headers

In the beginning of your xorlab Security Platform journey, it’s useful to have some information on analysis results while debugging email handling. If you want to have these results directly in emails that you’re inspecting, open Expert Editor, go to the activeguard/core/active_guard.yml file, scroll down to the pipelineTypeConfig group and under emails, set analysisResultInMimeHeader to EnabledInbound:

pipelineTypeConfig:
  emails:
    analysisResultInMimeHeader: EnabledInbound

With this feature enabled, the header of an analyzed email will look like the one below:

x-xor-id: 111111111111-1111-1111-1111-111111111111
x-xor-decision: DELIVER
x-xor-verdict: spam
x-xor-verdict-confidence: high
x-xor-tags: #spam, #highrisk, #hsrisk, #domainonlyinbound, #mprisk, #noreputation, #rsdmediumscore, #senderonlyinbound, #tldnoreputation, #untrusted, #auth, #lowscore, #spfpass, #banner, #deliver, #dkimfromsigned, #eachlinkmfrom, #htmlmessage, #inc

The x-xor-verdict-confidence header is only included when the verdict is either Phishing, Spam, VIP Fraud, Impersonation, or Policy. More info on the values each verdict might have can be found in Verdict confidences.

Reported email handling

For a description of the concepts and defaults, please refer to Abuse Mailbox Automation.

Parameters

The available parameters for all verdicts are listed below:

REPORTED_enable_filter_decision_state
REPORTED_enable_receipt_acknowledgement_state
REPORTED_enable_receipt_acknowledgement_template
REPORTED_BEC_decision_action
REPORTED_BEC_decision_template
REPORTED_BENIGN_early_decision_action
REPORTED_BENIGN_early_decision_template
REPORTED_EXPLOIT_dynamic_decision_action
REPORTED_EXPLOIT_dynamic_decision_template
REPORTED_EXPLOIT_static_decision_action
REPORTED_EXPLOIT_static_decision_template
REPORTED_EXTORTION_decision_action
REPORTED_EXTORTION_decision_template
REPORTED_FILTER_high_confidence_decision_action
REPORTED_FILTER_high_confidence_decision_template
REPORTED_FILTER_medium_confidence_decision_action
REPORTED_FILTER_medium_confidence_decision_template
REPORTED_FILTER_low_confidence_decision_action
REPORTED_FILTER_low_confidence_decision_template
REPORTED_BLACKLIST_decision_action
REPORTED_BLACKLIST_decision_template
REPORTED_IMPERSONATION_high_confidence_decision_action
REPORTED_IMPERSONATION_high_confidence_decision_template
REPORTED_IMPERSONATION_medium_confidence_decision_action
REPORTED_IMPERSONATION_medium_confidence_decision_template
REPORTED_IMPERSONATION_low_confidence_decision_action
REPORTED_IMPERSONATION_low_confidence_decision_template
REPORTED_INTERNALLY_FORWARDED_decision_action
REPORTED_INTERNALLY_FORWARDED_decision_template
REPORTED_MALWARE_dynamic_decision_action
REPORTED_MALWARE_dynamic_decision_template
REPORTED_MALWARE_static_decision_action
REPORTED_MALWARE_static_decision_template
REPORTED_PHISHING_high_confidence_decision_action
REPORTED_PHISHING_high_confidence_decision_template
REPORTED_PHISHING_low_confidence_decision_action
REPORTED_PHISHING_low_confidence_decision_template
REPORTED_PHISHING_medium_confidence_decision_action
REPORTED_PHISHING_medium_confidence_decision_template
REPORTED_SIMULATION_decision_action
REPORTED_SIMULATION_decision_template
REPORTED_SPAM_high_confidence_decision_action
REPORTED_SPAM_high_confidence_decision_template
REPORTED_SPAM_low_confidence_decision_action
REPORTED_SPAM_low_confidence_decision_template
REPORTED_SPAM_medium_confidence_decision_action
REPORTED_SPAM_medium_confidence_decision_template
REPORTED_VIP_FRAUD_high_confidence_decision_action
REPORTED_VIP_FRAUD_high_confidence_decision_template
REPORTED_VIP_FRAUD_medium_confidence_decision_action
REPORTED_VIP_FRAUD_medium_confidence_decision_template
REPORTED_VIP_FRAUD_low_confidence_decision_action
REPORTED_VIP_FRAUD_low_confidence_decision_template
REPORTED_WHITELIST_decision_action
REPORTED_WHITELIST_decision_template

REPORTED_FILTER
REPORTED_IMPERSONATION
REPORTED_VIP_FRAUD

Parameter suffixes

The parameters for the handling of reported emails allow you to specify when a case should be handled automatically and with which feedback email:

General parameter suffix	Function	Values
`_action`	Specifies whether the case should be kept open or automatically closed	`QUARANTINE` (keep case open), `DROP` (auto-handle case) and `UNDECIDED` `UNDECIDED` will result in `QUARANTINE` if no other rule specifies a different action
`_template`	Specifies which feedback template should be sent back to the reporter. If the case is auto-handled, this feedback template will be automatically sent. If the case is kept open, this feedback template will be pre-selected in the GUI, but not sent. If this parameter is left empty, no feedback template is sent. All available templates can be seen under `shared/email_templates`	Name of a template (for a list of all available templates, please refer to Email Notification Templates)
`_acknowledgement`	Enables or disables acknowledgment emails	`true` or `false`

ActionYou can specify the action (i.e., keep the case open or resolve it automatically) per verdict and confidence.

The following example shows how to auto-handle high-confidence phishing, but keep medium-confidence phishing cases open:

# Auto-handle emails classified as high-confidence phishing
REPORTED_PHISHING_high_confidence_decision_action=DROP
# Send back the phishing template
REPORTED_PHISHING_high_confidence_decision_template=PHISHING

# Keep case open if the email is classified as medium-confidence phishing
REPORTED_PHISHING_medium_confidence_decision_action=UNDECIDED
# Preselect the phishing template, but don't send it
REPORTED_PHISHING_medium_confidence_decision_template=PHISHING

Benign emails must fulfill additional requirements in order to be auto-handled based on the benign verdict (i.e., with REPORTED_BENIGN_early_decision_action=DROP). This should ensure that no malicious email is accidentally auto-handled as benign. Therefore, reported emails may be marked as benign, but not auto-handled. The most important requirements for auto-handling benign emails are:

All links must have a local reputation above 0.
Email must be internal or the sender must have at least medium trust.
No suspicious files attached (e.g., no HTML files).
No high spam or risk score.
No cloud storage links.

Acknowledgment emails

By default, acknowledgments are sent automatically to every reporter whenever a case is kept open. To disable acknowledgment emails:

On the main screen, click the tiles icon next to your account name and click the Admin icon in the displayed menu:
On the resulting Admin page, click the General Settings tile:
This opens General Settings panel where you can switch the Notify on report submission setting off.

From the drop-down list on the same screen, you can select a template used for report acknowledgment. Alternatively, you can configure the above settings in the activeguard/core/rule_sets/90_local/params/local.properties profile:

# Disable acknowledgment emails. Set to ACTIVE to enable it again
REPORTED_enable_receipt_acknowledgement_state=DISABLED

The email template used for the acknowledgment email can be configured in the following way (ACKNOWLEDGE_RECEIPT is the default):

# Specify the template used for acknowledgment emails
REPORTED_enable_receipt_acknowledgement_template=ACKNOWLEDGE_RECEIPT

​Profiles

​Common profile configurations

​Standard

​Standard with no feedback

​Learning phase with passive defense (evaluation mode)

​Learning phase with active defense

​Monitoring mode

​Actions panel

​Rule parameters

​Inbound email security

​Parameters

​Parameter suffixes

​Attachment removal and replacement

​Adding analysis results to email headers

​Reported email handling

​Parameters

​Parameter suffixes

​Acknowledgment emails

Profiles

Common profile configurations

Standard

Standard with no feedback

Learning phase with passive defense (evaluation mode)

Learning phase with active defense

Monitoring mode

Actions panel

Rule parameters

Inbound email security

Parameters

Parameter suffixes

Attachment removal and replacement

Adding analysis results to email headers

Reported email handling

Parameters

Parameter suffixes

Acknowledgment emails