Inbound Email Security

On this page, you will learn the concepts and default actions of the XSP inbound email security. Its configuration is described in Actions, Rules and Profiles. xorlab Security Platform assesses every incoming email and then decides what actions to take. The most common ones are:

• Deliver—email is benign.
• Deliver with a subject rewrite—email is suspicious.
• Deliver with one or more attachments removed—email has suspicious attachments.
• Quarantine—email is malicious and will be kept in quarantine. An optional quarantine notification can be sent to the recipients.
• Drop—email is highly malicious and will be dropped.
• Bounce—email is dropped, not delivered to the recipients, and a bounce message is sent to the sender.

What determines whether an email is incoming or outgoing? XSP makes this distinction based on the concept of Guarded Tenant Domains. Guarded tenant domains represent the domains and subdomains from your organization or the tenants you protect. Mail filtering is only applied to recipients whose email domain is defined in the guarded_tenants.yml configuration file (see step #5 in Basic settings). Here’s how the categorization works:

• Incoming: The domain of the recipient is a guarded, but the domain of the sender is not.
• Outgoing: The domain of the sender is a guarded, but the domain of the recipient is not.
• Internal: The domain of the sender and recipient are both guarded.

However, there is a case, when determining the direction based on the guarded tenant domains is not possible: this happens when a message has BCC recipients only. Then, depending on the configuration of the BCC sending server, the envelope from information is often lost, and the envelope rcpt is always lost. Therefore, xorlab Security Platform can’t find the reliable sender/recipient information in the mail envelope data (if you want to know how XSP retrieves this info, please read Inline and Monitoring Mode), so it uses the bccFallbackDomain parameter you set along with the domains of guarded tenants in step #5 in Basic settings.

​

Verdict and confidence

Every email is classified into a final verdict with corresponding confidence. The confidence denotes the certainty of the classification and can be either high, medium, or low. For example, a high-confidence phishing email is put into quarantine, while a low-confidence phishing email is delivered with a subject rewrite. For a list and description of all verdicts, please see Verdicts. You can see the final verdict of an email either in the VERDICT column under All Messages, or in the detailed view of an email: Searching for emails with a certain verdict and confidence is described in the Search article.

​

Actions

The standard actions of xorlab Security Platform, based on the verdict and confidence, are shown in the following table. Some verdicts do not have all confidence information available. If no malicious verdict matches, the email will be delivered. The actions specified above are configured through the default profile as described in Profiles. If you want to adjust the default actions, please follow the instructions in Actions, Rules and Profiles.