Inline and Monitoring Mode

• Monitoring: xorlab Security Platform is located out-of-band of the email flow and is only used to monitor the traffic (it cannot actively intervene). Usually, it receives the email traffic as an additional BCC recipient and all emails are dropped after processing. This mode allows email traffic monitoring with low impact on the infrastructure.
• Inline: xorlab Security Platform is inline in the email flow and actively filters emails. This mode is configured whenever XSP is used for inbound email security. Emails are forwarded after they have been processed.

​

Monitoring mode

1. Open Expert Editor and navigate to the activeguard/core/active_guard.yml file.
2. Under scanSources.handler, add the smtpOffline {} entry to the list and remove any existing entries named smtpInline {}.
3. Under pipelineTypeConfig, set recipientRetrievalStrategy: MAIL_HEADER and envelopeFromRetrievalStrategy: HEADER:
   For M365 integrations, the value for the envelopeFromRetrievalStrategy key should be ENVELOPE_FROM.
   pipelineTypeConfig:
     emails:
       # Get the recipients from the TO and CC headers
       recipientRetrievalStrategy: MAIL_HEADER
       # Get the envelope `FROM` from email headers
       envelopeFromRetrievalStrategy: HEADER # (1)!
   ...
   scanSources:
   - smtp
     port: 10025
     handler:
     - smtpReport {}
     # The following line activates monitoring mode.
     # All emails will be dropped after processing.
     - smtpOffline {}
   
   1. ENVELOPE_FROM in M365 integrations
4. Under rules.params, add the monitoring_mode.properties entry as described in Profiles and change any DANA profile to monitoring_dana_offline_only.properties:
   rules:
     params:
     - default.properties
     - monitoring_dana_offline_only.properties
     - monitoring_mode.properties
     - local.properties
     - ui.properties
   
5. Set up SMTP properly as described in Email routing.
6. Disable delivery status notifications.
7. Restart MTAs. For all MTAs, SSH connect to the MTA and execute:
   cd /etc/xorlab/activeguard
   docker compose stop core && docker compose down && sleep 2 && docker compose up -d
   

scanSources:
  - smtp
    port: 10025
    ## Default handler configuration - applied if nothing else specified
    #handler:
    #- smtpReport
    #- smtpOffline

​

Envelope FROM and recipient configuration

pipelineTypeConfig:
  emails:
    recipientRetrievalStrategy: MAIL_HEADER
    envelopeFromRetrievalStrategy: HEADER # (1)!

1. ENVELOPE_FROM in M365 integrations

pipelineTypeConfig:
  emails:
    recipientRetrievalStrategy: MAIL_HEADER
    envelopeFromRetrievalStrategy: HEADER
    # Specify a custom header that contains the original envelope `FROM`
    envelopeFromHeaderName: "x-original-envelope-from"

    envelopeFromHeaderName: x-one-envelope-from|x-other-envelope-from

​

Disable delivery status notifications (e.g., bounce messages)

1. Open the Expert Editor and navigate to the activeguard/mta/startup_cfg/postfix_custom/master.cf file.
2. Find the three lines starting with bounce unix, defer unix, and trace unix, and set the last word on all three lines to discard:
   # Disable all delivery status notifications
   bounce    unix  -       -       n       -       0       discard
   defer     unix  -       -       n       -       0       discard
   trace     unix  -       -       n       -       0       discard
   
3. Open the activeguard/mta/startup_cfg/postfix_custom/main.cf file and comment out (e.g., using the Ctrl+/ or Cmd+/ keyboard shortcut) the delay_warning_time property (if you have multiple main.cf files, do it in each of them):
   ## Deactivate delivery delay notifications through commenting it out
   #delay_warning_time = 1h
   #confirm_delay_cleared = yes
   
4. Disable Delivery Status Notification (DSN) for bcc deployments in each main.cf file.
   ## ActiveGuard bcc deployment specific settings
   # Disable Delivery Status Notification (DSN) for bcc deployments
   smtpd_discard_ehlo_keywords = silent-discard, dsn
   

​

Inline mode

1. Open Expert Editor and navigate to the activeguard/core/active_guard.yml file.
2. Under scanSources.handler, add the smtpInline {} entry to the list and remove any existing entries named smtpOffline {}.
3. Under pipelineTypeConfig, set envelopeFromRetrievalStrategy: ENVELOPE_FROM and recipientRetrievalStrategy: MAIL_ENVELOPE:
   pipelineTypeConfig:
     emails:
       # Get the recipients from the SMTP connection (RCPT TO command)
       recipientRetrievalStrategy: MAIL_ENVELOPE
       # Get the envelope `FROM` from the SMTP connection (MAIL FROM command)
       envelopeFromRetrievalStrategy: ENVELOPE_FROM
   ...
   scanSources:
   - smtp
     port: 10025
     handler:
     - smtpReport {}
     # The following line activates the inline mode.
     - smtpInline {}
   
4. Under rules.params, add the default_actions.properties entry as described in Profiles and change any Sandbox profile to default_dana.properties:
   rules:
     params:
     - default.properties
     - default_dana.properties
     - default_actions.properties
     - local.properties
     - ui.properties
   
5. Make sure that bounce messages are enabled in activeguard/mta/startup_cfg/postfix_custom/master.cf:
   # bounce, defer and trace must be set to "bounce"
   bounce    unix  -       -       n       -       0       bounce
   defer     unix  -       -       n       -       0       bounce
   trace     unix  -       -       n       -       0       bounce
   
6. Activate delivery delay notifications in activeguard/mta/startup_cfg/postfix_custom/main.cf:
   ## Enable delivery delay notifications
   delay_warning_time = 1h
   confirm_delay_cleared = yes
   
7. Set up SMTP properly as described in Email routing.
8. Make sure to Publish the configuration changes in the Expert Editor.
9. Restart MTAs. For all MTAs, SSH connect to the MTA and execute:
   cd /etc/xorlab/activeguard
   docker compose stop core && docker compose down && sleep 2 && docker compose up -d