> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Context Variables
In the table below, you will find context variables that you can use in your rules to trigger particular actions and override global settings.
| Variable | Accepted values (case sensitive) | Description |
| ---------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `DynamicScanMode` | `AlwaysInline`
`NoDynamicScan`
`Inline`
`Offline` | Controls when and how to apply a dynamic email analysis. See *[Dynamic Analysis Configuration](/9.0/dynamic-analysis#configuration)* |
| `QuarantineName` | text | Sets the assigned [quarantine](data-retention.md/#quarantines) for a quarantined message |
| `ReportAcknowledgment.Template` | template name | Sets the template for an [acknowledgment email](/9.0/actions-rules-and-profiles#acknowledgment-emails) of a reported incident (if applicable). Default: [`REPORT_NOTIFICATION_ACKNOWLEDGEMENT`](/9.0/email-template-overview#report_notification_acknowledgement) |
| `ReportFeedback.Template` | template name | Sets the template for a reported email (normally, this is configured with a rule per verdict by the [`_template` parameter](/9.0/actions-rules-and-profiles#parameter-suffixes_1)) |
| `ReportFeedback.AttachIncidentEml` | `DELIVER\|DROP` | Specifies whether to attach the reported email to the report feedback template that can be set with `ReportFeedback.Template`; by default, the email is attached for the `DELIVER` decision |
| `EmailScreenshot` | `true`
`false` | If set to `true`, the .eml files will be rendered to .png images |
| `KeepDanaAssets` | `true`
`false` | If set to `true`, Sandbox assets will be preserved. See *[Sandbox assets for benign verdicts](/9.0/dynamic-analysis#sandbox-assets-for-benign-verdicts)* |
| `NotifyUser` | `true`
`false` | If set to true, the guarded recipient gets a notification mail about the quarantined message instead of the actual mail (you can set the template with `ReceiverNotification.Template`); the guarded sender gets a notification mail about their message not being delivered (you can set the template with `SenderNotification.Template`).
This feature is independent of SSQ notifications, and we recommend using the latter—just make sure you don’t use both as it might result in two notifications for the same quarantined message |
| `SenderNotification.Template` | template name | When `NotifyUser` is set to `false`, this variable sends a notification email to the sender using the selected template |
| `SenderNotification.GuardedOnly` | `true`
`false` | When `NotifyUser` is set to `false`, and this variable is set to `true` (default), a notification is sent to a guarded email sender only |
| `ReceiverNotification.Template` | template name | When `NotifyUser` is set to `false`, this variable sends a notification email to the recipient using the selected template |
| `ReceiverNotification.GuardedOnly` | `true`
`false` | When `NotifyUser` is set to `false`, and this variable is set to the default `true`, a notification is sent to a guarded email recipient only |
| `Delivery.SubjectPrefix` | text | Adds a prefix to the rewritten email subject. Works in inline mode only |
| `Delivery.Attachment.Remove` | `true`
`false` | Completely remove the attachment which contains a specifically marked ScanRequest |
| `Delivery.Attachment.Replace.Enable` | `true`
`false` | If enabled, the attachment which contains a specifically marked ScanRequest will be replaced with a text file (set with the optional `Delivery.Attachment.Replace.Text` and `Delivery.Attachment.Replace.NameFormatString` parameters) |
| `Delivery.Attachment.Replace.Text` | text | Content of a text file that will be displayed to the reader of the email instead of an attachment (default: `Attachment removed by policy`) |
| `Delivery.Attachment.Replace.NameFormatString` | text | Filename of a text file that will replace the attachment (default: `replaced-%s.txt`) |
| `PublishThreatIntel` | `true`
`false` | Selectively decide if threat intel should be published for this particular email (default: publish it only for malicious emails) |
| `KeepRawMail` | `true`
`false` | If set to true, the source .eml file will be published to XCC and available for download in the **Detail** view. The email will be kept until the global time-to-live is reached |
| `verdict.value` | text | Sets a [verdict](/9.0/verdicts) that will be displayed in the XCC, quarantine notification emails and a report |
## Rule example
Below is a rule example that sets seven context variables for an incoming email with a spam score equal to or higher than 8. This email will be put in the Spam quarantine with a `spam` verdict, and the following actions will be performed:
* The .eml file will be rendered as a .png image.
* All Sandbox assets will be kept.
* The subject won’t be changed.
* No notification will be sent to the recipient.
* Threat intel info will be published.
```xml theme={null}
Emails
#quarantine
```