> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Data Retention

xorlab Security Platform stores different types of information for a specified time period (for an overview, please see [Data Flow and Data Storage](/9.0/data-flow-and-data-storage#locally-stored-data)). You can adjust the data retention settings using the XCC [Expert Editor](/9.0/expert-editor).

## Email subject and body retention

By default, XSP stores the subject for all emails and always discards the body of processed emails (except for quarantined emails). If you would like to change this default (for example, to always keep the subject), you can do that in `activeguard/core/active_guard.yml`:

```yaml theme={null}
# Default values
pipelineTypeConfig:
  emails:
    keepEmailSubject: ALWAYS
    keepEmail: NEVER
```

<Note>
  **Quarantined emails**

  The `keepEmail` parameter does not affect quarantined emails. Quarantined emails are always kept, even if `keepEmail` is set to `NEVER`.
</Note>

The following values are supported for `keepEmailSubject` and `keepEmail`:

| Value                                     | Description                                                                                              |
| ----------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `NEVER` (default for `keepEmail`)         | Discard                                                                                                  |
| `ALWAYS` (default for `keepEmailSubject`) | Keep                                                                                                     |
| `ON_DROP_BOUNCE_AND_QUARANTINE`           | Keep only if the email was quarantined or dropped                                                        |
| `ON_DROP_BOUNCE_QUARANTINE_AND_REWRITE`   | Keep only if the email was either quarantined or dropped, or if it was delivered with a modified subject |

Don’t forget to activate your changes in `active_guard.yml` as described in [*How to Activate the Configuration*](/9.0/activate-configuration).

## Quarantines

XSP provides several built-in quarantines for different email classifications. They are visible in XCC in the `Quarantines` menu section. Every quarantine has an associated retention time, after which emails will be deleted.

This section explains how to adjust the retention time of the built-in quarantines and how to add additional custom quarantines.

<Warning>
  **Retention time**

  Emails that are removed from quarantine after reaching the retention time are entirely deleted from xorlab Security Platform with all their metadata. This means these emails are not searchable and are not shown in the GUI anymore, even if they haven’t yet reached the metadata retention time configured in [`deliveredTtlDays`](/9.0/configuration-guide#basic-settings).
</Warning>

### Configuration

You can configure quarantines in the `shared/guarded_tenants.yml` file:

```yaml title="shared/guarded_tenants.yml" theme={null}
tenants:
  - name: xorlab
    bccFallbackDomain: xorlab.com
    domains:
      - xorlab.com
    ## Data retention configuration
    dataRetention:
      ## Duration after which benign mails are deleted.
      deliveredTtlDays: 90
      ## Duration after which file upload results are deleted.
      fileAnalysisTtlDays: 90
      ## Default duration after which quarantined messages are deleted.
      ## This value can be overwritten per quarantine type.
      quarantinedDefaultTtlDays: 30
      ## Duration after which reported messages are deleted.
      reportedTtlDays: 730
    quarantine:
      quarantines:
          ## Overwrite the default quarantinedDefaultTtlDays for a specific quarantine
          - name: Malware
            ttlDays: 10

```

* To set the default retention time for all quarantines, configure the `quarantinedDefaultTtlDays` value to the desired number of days.

* To overwrite the retention time of a specific quarantine, add the corresponding quarantine under `quarantines` and set the `ttlDays` accordingly.

* To add a new quarantine, simply add it under `quarantines`.

<Note>
  **Default quarantines**

  When specifying entries under `quarantines`, it is not necessary to list all other built-in quarantines. Just add the quarantines that you want to change or create.
</Note>

## xorlab Sandbox

When a [Sandbox scan is done](/9.0/dynamic-analysis#default-behavior), you are presented with screenshots of your email attachments. You can decide on when and how to keep them—please refer to [*Control how Sandbox stores assets depending on a verdict*](/9.0/dynamic-analysis#control-how-sandbox-stores-assets-depending-on-a-verdict).

## Email previews configuration

Email previews differ substantially from screenshots of email attachments: the former are static images generated by MTA, and the latter are VM screenshots taken during the dynamic analysis of email attachments (see [*xorlab Sandbox*](#xorlab-sandbox) above).

By default, email previews are **enabled** for most malicious (red) verdicts and **disabled** for legitimate (green) ones. For reported emails, they are always **enabled**.

You can configure the preview per verdict by setting the `*_email_screenshot=true` [variable](/9.0/actions-rules-and-profiles#parameters) in the `local.properties` file. For example, you can enable an email preview for the following verdicts that have it disabled by default:

```
PHISHING_low_confidence_decision_email_screenshot=true
VIP_FRAUD_medium_confidence_decision_email_screenshot=true
```

It's also possible to configure XSP to show email previews for all verdicts  by adding the following line to `/activeguard/core/rule_sets/90_local/params/local.properties`

```
DEFAULT_email_screenshot_value=true
```

## Log retention

Please see the *[Built-in logging](/9.0/logging-configuration-files#built-in-logging)* section to adjust the retention time of logfiles.