System architecture
xorlab Security Platform (XCC) consists of three different components:- xorlab XCC: One single instance that offers a complete view of all processed emails. The xorlab Control Center (XCC) can be virtualized.
- xorlab MTA: A lightweight email processing node. Depending on the expected load, we operate multiple redundant nodes to distribute email traffic. Each MTA can be virtualized.
- xorlab Dynamic Analysis: Performs on-demand dynamic analysis of email attachments. Requires direct hardware access and cannot be virtualized.
Network Overview
xorlab xCloud
xorlab Security Platform will need to connect to web services provided by xorlab at any time to get the default configuration, the newest rule set, and reputation information data, as well as to send data around a reported misclassification of an email. Note that these connections are required and unrelated to the xorlab Dynamic Analysis service. Neither analyzed messages nor their attachments are uploaded to the xCloud servers. The following outgoing connections to TCP port 443 are required from any xorlab Security Platform VM (MTA and XCC):The production IP addresses of all endpoints listed on this page, for environments where
outbound rules cannot be expressed by hostname, are documented in
Deployment Defaults → Production endpoint addresses.
Password required.
Standard
CH-only infrastructure
Cloud-based Dynamic Analysis
If the deployment uses xorlab Dynamic Analysis in the cloud (instead of on-premise), the following changes apply to the network schema:- The arrows 2, 9, 13, 14, 15, and 16 from and to the Dynamic Analysis component can be ignored.
-
Arrow 10 becomes internet-facing and will point to
*.activeguard.io:443:Standard
CH-only infrastructure
xorlab Machine Intelligence
For every email that is analyzed by xorlab Security Platform, the MTAs do one or several requests tomlX.Y.activeguard.io where X is a number and Y stands for a region code. The data sent to the service is not client-identifying, meaning no sensitive data is stored or retained on the servers.
Standard
CH-only infrastructure
xorlab NLU services
The xorlab Natural Language Understanding (NLU) model enhances threat detection with in-house trained machine learning models. To perform this analysis, MTAs securely transmit email content (subject, body, and attachments) to xorlab NLU servers (mlX.Y.activeguard.io), where X represents a server instance and Y indicates the regional deployment No sensitive data is retained on the servers.
Standard
CH-only infrastructure
Firewall Configuration
To ensure full functionality of the xorlab Security Platform (XSP), specific outbound network connections must be allowed. The table below outlines required outbound access per component and service.
Note: The exact IP addresses behind
*.xorlab.com endpoints may change. If static IPs are required for firewall allowlisting, please contact xorlab Support for region-specific information.
Optional 3rd-party services
VirusTotal
xorlab Security Platform supports VirusTotal integration to get additional threat intelligence for analysis purposes. If configured, xorlab Control Center will query VirusTotal for every email which is opened in the GUI in the Detail View. Note that the VirusTotal queries are done only on-demand whenever an analyst opens an email in the Detail View. There are no VirusTotal queries done for the automated email classification. In order to issue VirusTotal queries, the Control Center must have access (proxy supported) to the following target:- virustotal: virustotal.com on port 443/TCP