Data Retention

xorlab Security Platform stores different types of information for a specified time period (for an overview, please see Data Flow and Data Storage). You can adjust the data retention settings using the XCC Expert Editor.

Email subject and body retention

By default, XSP stores the subject for all emails and always discards the body of processed emails (except for quarantined emails). If you would like to change this default (for example, to always keep the subject), you can do that in activeguard/core/active_guard.yml:

# Default values
pipelineTypeConfig:
  emails:
    keepEmailSubject: ALWAYS
    keepEmail: NEVER

Quarantined emailsThe keepEmail parameter does not affect quarantined emails. Quarantined emails are always kept, even if keepEmail is set to NEVER.

The following values are supported for keepEmailSubject and keepEmail:

Value	Description
`NEVER` (default for `keepEmail`)	Discard
`ALWAYS` (default for `keepEmailSubject`)	Keep
`ON_DROP_BOUNCE_AND_QUARANTINE`	Keep only if the email was quarantined or dropped
`ON_DROP_BOUNCE_QUARANTINE_AND_REWRITE`	Keep only if the email was either quarantined or dropped, or if it was delivered with a modified subject

Don’t forget to activate your changes in active_guard.yml as described in How to Activate the Configuration.

Quarantines

XSP provides several built-in quarantines for different email classifications. They are visible in XCC in the Quarantines menu section. Every quarantine has an associated retention time, after which emails will be deleted. This section explains how to adjust the retention time of the built-in quarantines and how to add additional custom quarantines.

Retention timeEmails that are removed from quarantine after reaching the retention time are entirely deleted from xorlab Security Platform with all their metadata. This means these emails are not searchable and are not shown in the GUI anymore, even if they haven’t yet reached the metadata retention time configured in deliveredTtlDays.

Configuration

You can configure quarantines in the shared/guarded_tenants.yml file:

shared/guarded_tenants.yml

tenants:
  - name: xorlab
    bccFallbackDomain: xorlab.com
    domains:
      - xorlab.com
    ## Data retention configuration
    dataRetention:
      ## Duration after which benign mails are deleted.
      deliveredTtlDays: 90
      ## Duration after which file upload results are deleted.
      fileAnalysisTtlDays: 90
      ## Default duration after which quarantined messages are deleted.
      ## This value can be overwritten per quarantine type.
      quarantinedDefaultTtlDays: 30
      ## Duration after which reported messages are deleted.
      reportedTtlDays: 730
    quarantine:
      quarantines:
          ## Overwrite the default quarantinedDefaultTtlDays for a specific quarantine
          - name: Malware
            ttlDays: 10

To set the default retention time for all quarantines, configure the quarantinedDefaultTtlDays value to the desired number of days.
To overwrite the retention time of a specific quarantine, add the corresponding quarantine under quarantines and set the ttlDays accordingly.
To add a new quarantine, simply add it under quarantines.

Default quarantinesWhen specifying entries under quarantines, it is not necessary to list all other built-in quarantines. Just add the quarantines that you want to change or create.

xorlab Sandbox

When a Sandbox scan is done, you are presented with screenshots of your email attachments. You can decide on when and how to keep them—please refer to Control how Sandbox stores assets depending on a verdict.

Email previews configuration

Email previews differ substantially from screenshots of email attachments: the former are static images generated by MTA, and the latter are VM screenshots taken during the dynamic analysis of email attachments (see xorlab Sandbox above). By default, email previews are enabled for most malicious (red) verdicts and disabled for legitimate (green) ones. For reported emails, they are always enabled. You can configure the preview per verdict by setting the *_email_screenshot=true variable in the local.properties file. For example, you can enable an email preview for the following verdicts that have it disabled by default:

PHISHING_low_confidence_decision_email_screenshot=true
VIP_FRAUD_medium_confidence_decision_email_screenshot=true

It’s also possible to configure XSP to show email previews for all verdicts by adding the following line to /activeguard/core/rule_sets/90_local/params/local.properties

DEFAULT_email_screenshot_value=true

Log retention

Please see the Built-in logging section to adjust the retention time of logfiles.

​Email subject and body retention

​Quarantines

​Configuration

​xorlab Sandbox

​Email previews configuration

​Log retention

Email subject and body retention

Quarantines

Configuration

xorlab Sandbox

Email previews configuration

Log retention