xorlab Sender Addresses

This page explains how to configure non-standard email addresses that xorlab Security Platform will use in the following situations:

Receiving reported emails
Sending feedback emails
Sending quarantine notifications
Sending custom bounce messages

The configuration file is activeguard/core/active_guard.yml—open it in the XCC Expert Editor to make changes.

In the following code blocks, we are referring to the templateDomain property (not a variable) which is configured in the activeguard/core/active_guard.yml file (see step #7 in Basic settings). For SaaS customers, this domain is provided by xorlab as a part of the onboarding. In case of on-premise xorlab Security Platform, this domain has been setup as a part of the xorlab Security Platform VM Setup Guide.

Reporting address

This configuration defines the email address under which xorlab Security Platform will receive the reported emails. All emails sent to this address will be treated as a report. Reporting works by default and there is no need to change the configuration below, unless you want to use a custom reporting address.

scanSources:
- smtp
  port: 10025
  handler:
  - smtpReport:
      # Default. <templateDomain> corresponds to the parameter templateDomain in active_guard.yml
      emailAddress: suspicious@<templateDomain>

Feedback emails

Feedback emails are sent after a user reports a suspicious email. They can be manually triggered by an analyst through resolving a case as well as automatically generated through a campaign or an auto-close rule. Add the following block (if it does not already exist) to the active_guard.yml file with <sender-address> being the desired sender address:

`active_guard.yml` (default)
`active_guard.yml` (custom)

emailReporting:
  # Default. <templateDomain> corresponds to the parameter templateDomain in active_guard.yml
  senderEmail: threatanalyst@<templateDomain>

emailReporting:
  senderEmail: <sender-address>

SMTP auth for feedback emails

If you want the feedback emails to be sent to an SMTP server requiring authentication, please follow the steps outlined in SMTP auth for specific email addresses.

Quarantine notifications

In order to configure the sender address used for quarantine notifications, open the activeguard/core/active_guard.yml file and set quarantineNotificationAddress. This is only needed if you use the quarantine notification feature.

mailDelivery:
  # Default. <templateDomain> corresponds to the parameter templateDomain in active_guard.yml
  quarantineNotificationAddress: quarantine@<templateDomain>

Custom bounce and notification messages

The xorlab Security Platform rule language allows configuring custom bounce or notification messages that are triggered for certain events (for example, when using the rule context keys SenderNotification.Template or ReceiverNotification.Template). If this feature is in use, the sender address for those bounce messages can be configured in the activeguard/core/active_guard.yml file using userNotificationAddress:

mailDelivery:
  # Default. <templateDomain> corresponds to the parameter templateDomain in active_guard.yml
  userNotificationAddress: notification@<templateDomain>

​Reporting address

​Feedback emails

​SMTP auth for feedback emails

​Quarantine notifications

​Custom bounce and notification messages

Reporting address

Feedback emails

SMTP auth for feedback emails

Quarantine notifications

Custom bounce and notification messages