> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Additional Configuration

With the mandatory configuration done, we can now focus on additional configuration aspects that allow tuning xorlab Security Platform according to your needs.

## Actions, rules and profiles

If you would like to change anything in the default behavior of [*Inbound Email Security*](/9.0/inbound-email-defense) or [*Abuse Mailbox Automation*](/9.0/abuse-mailbox-automation), have a look at [*Actions, Rules and Profiles*](/9.0/actions-rules-and-profiles). Common use cases are:

* Tune xorlab Security Platform to be more (or less) aggressive with incoming malicious emails.
* Enable or disable feedback emails.
* Enable more auto-handling of reported emails.

## Event logging

The logging support of xorlab Security Platform allows you to send logs of specific events to remote systems.

As an example, you can write a JSON email summary to a remote destination whenever XSP processed an email. Or, you can write audit logs whenever a user changes configuration.

If you want to activate certain logging now, please go to [*Logging*](/9.0/logging). It will guide you through the process and provide some common logging configurations in the [*Common examples*](/9.0/logging#configuration-examples) section.

## User authentication

xorlab Security Platform comes with a predefined local user through which you can access the Control Center GUI. If you would like to:

* add more local users, change their password or change their roles,
* integrate LDAP for user authentication or
* integrate SAML2 for user authentication with SSO,

you can have a look at the [*Authentication*](/9.0/authentication) guide for more details and instructions. For a list of all possible user roles and permissions, visit [*Users, Roles, and Permissions*](/9.0/users-roles-and-permissions).

## Email addresses

Optionally, you can adjust the sender email address that xorlab Security Platform will use to send the following emails:

* Feedback or acknowledgment emails.
* Quarantine notification
* Bounce messages.

To change the default values, follow the instructions in [*xorlab Security Platform Email Addresses*](/9.0/activeguard-sender-addresses).

## Attachment Airlock and Request Release

You can further improve the SSQ (Self-Service Quarantine) by:

* Enable [Attachment Airlock](/9.0/attachment-airlock) for a safe analysis of password-protected attachments.
* Enable [Request Release](/9.0/request-release) to allow end-users to request emails to be released from their quarantine.

## VirusTotal integration

If you want to enable VirusTotal integration, all you need to do is add your VirusTotal API key to the `xcc.yml` config as follows:

```yaml theme={null}
virusTotal:
  apiKey: "add_your_key_here"
  ## Optional proxy configuration
  # http:
     # host: https://www.virustotal.com # Mandatory in case you provide settings for http
     # proxy:
      #  host: proxy.xorlab.com
      #  port: 8080
        ## Optional credentials:
        # credentials:
          # user: "proxy-user"
          # password: "pwd"
  ## Enables the TLS/SSL support with no certificate validation
  # trustAll: false
```

Please note:

* XCC only sends the SHA256 hash of an attachment to VirusTotal, not the entire attachment. URLs are submitted as-is without prior hashing. By adding your VirusTotal key you agree that this information will be sent to VirusTotal. Please visit [VirusTotal website](https://www.virustotal.com) for their Terms and Services and their Privacy Policy as by submitting data those will apply.
* XCC only uses the VirusTotal API for items that are opened in XCC, e.g., when opening a message in the detail view. No VirusTotal API requests are performed for messages that are only processed by xorlab Security Platform and not viewed in XCC.
* XCC uses the following VirusTotal API endpoints:
  * [https://developers.virustotal.com/reference#file-info](https://developers.virustotal.com/reference#file-info)
  * [https://developers.virustotal.com/reference#url-info](https://developers.virustotal.com/reference#url-info)
  * [https://developers.virustotal.com/reference#domain-info](https://developers.virustotal.com/reference#domain-info)
  * [https://developers.virustotal.com/reference#ip-info](https://developers.virustotal.com/reference#ip-info)
* The free Public API has the following limitations:
  * The Public API is limited to 500 requests per day and a rate of 4 requests per minute.
  * The Public API must not be used in commercial products or services.
  * The Public API must not be used in business workflows that do not contribute new files.
  * You are not allowed to register multiple accounts to overcome the aforementioned limitations.
    Source: [https://developers.virustotal.com/reference/public-vs-premium-api](https://developers.virustotal.com/reference/public-vs-premium-api)