Additional Configuration

With the mandatory configuration done, we can now focus on additional configuration aspects that allow tuning xorlab Security Platform according to your needs.

Actions, rules and profiles

If you would like to change anything in the default behavior of Inbound Email Security or Abuse Mailbox Automation, have a look at Actions, Rules and Profiles. Common use cases are:

Tune xorlab Security Platform to be more (or less) aggressive with incoming malicious emails.
Enable or disable feedback emails.
Enable more auto-handling of reported emails.

Event logging

The logging support of xorlab Security Platform allows you to send logs of specific events to remote systems. As an example, you can write a JSON email summary to a remote destination whenever XSP processed an email. Or, you can write audit logs whenever a user changes configuration. If you want to activate certain logging now, please go to Logging. It will guide you through the process and provide some common logging configurations in the Common examples section.

User authentication

xorlab Security Platform comes with a predefined local user through which you can access the Control Center GUI. If you would like to:

add more local users, change their password or change their roles,
integrate LDAP for user authentication or
integrate SAML2 for user authentication with SSO,

you can have a look at the Authentication guide for more details and instructions. For a list of all possible user roles and permissions, visit Users, Roles, and Permissions.

Email addresses

Optionally, you can adjust the sender email address that xorlab Security Platform will use to send the following emails:

Feedback or acknowledgment emails.
Quarantine notification
Bounce messages.

To change the default values, follow the instructions in xorlab Security Platform Email Addresses.

Attachment Airlock and Request Release

You can further improve the SSQ (Self-Service Quarantine) by:

Enable Attachment Airlock for a safe analysis of password-protected attachments.
Enable Request Release to allow end-users to request emails to be released from their quarantine.

VirusTotal integration

If you want to enable VirusTotal integration, all you need to do is add your VirusTotal API key to the xcc.yml config as follows:

virusTotal:
  apiKey: "add_your_key_here"
  ## Optional proxy configuration
  # http:
     # host: https://www.virustotal.com # Mandatory in case you provide settings for http
     # proxy:
      #  host: proxy.xorlab.com
      #  port: 8080
        ## Optional credentials:
        # credentials:
          # user: "proxy-user"
          # password: "pwd"
  ## Enables the TLS/SSL support with no certificate validation
  # trustAll: false

Please note:

XCC only sends the SHA256 hash of an attachment to VirusTotal, not the entire attachment. URLs are submitted as-is without prior hashing. By adding your VirusTotal key you agree that this information will be sent to VirusTotal. Please visit VirusTotal website for their Terms and Services and their Privacy Policy as by submitting data those will apply.
XCC only uses the VirusTotal API for items that are opened in XCC, e.g., when opening a message in the detail view. No VirusTotal API requests are performed for messages that are only processed by xorlab Security Platform and not viewed in XCC.
XCC uses the following VirusTotal API endpoints:
The free Public API has the following limitations:
- The Public API is limited to 500 requests per day and a rate of 4 requests per minute.
- The Public API must not be used in commercial products or services.
- The Public API must not be used in business workflows that do not contribute new files.
- You are not allowed to register multiple accounts to overcome the aforementioned limitations. Source: https://developers.virustotal.com/reference/public-vs-premium-api

​Actions, rules and profiles

​Event logging

​User authentication

​Email addresses

​Attachment Airlock and Request Release

​VirusTotal integration