> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Phishing Simulation Tools

There’s a myriad of services allowing you to launch simulated cyber attacks against your organization and measure its awareness of email-borne threats. To make sure that simulated emails reach the inbox of your staff, consult the documentation of a respective service and include its infrastructure, sender address, or sender domain in the Simulation lists.

xorlab Security Platform will mark simulated attacks with `verdict:simulation` if the distinctive mark of a service is known. Log in to XSP, navigate to **Settings → Lists → Simulation**, and add the distinctive mark of your simulation service to the appropriate list.

| List name                   | Description                                                                                                                                                                                     | Accepted entries                                                                                                                                         |
| :-------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Sender address**          | Use this list if your simulation service uses designated sender addresses.<br />No authentication is required                                                                                   | Email address as `String`, e.g., `awareness@myfakedomain.com`<br />Matches Header FROM and Envelope FROM                                                 |
| **Sender domain**           | Use this list if your simulation service uses a designated sender domain.<br />No authentication is required                                                                                    | Sender domain as `String`, e.g., `myfakedomain.com`<br />Matches Header FROM and Envelope FROM                                                           |
| **MTA EHLO (regex)**        | Use this list if your simulation service sends simulated attacks from designated host names                                                                                                     | Host names as `Regex`, e.g., `*.\.awarenesstool\.com`<br />Please be aware that the email needs to contain EHLO or EHLO IP for this verification to work |
| **MTA IP (regex)**          | Use this list if your simulation service sends simulated attacks from designated IPs                                                                                                            | IP records as `Regex`, e.g., `192\.168\.1\..`<br />Please be aware that the email needs to contain EHLO or EHLO IP for this verification to work         |
| **x-mailer header (regex)** | Use this list if your simulation service adds a designated x-mailer header to simulated attack emails.<br />Note that all emails matching any entries in this list will be marked as simulation | Header content as `Regex`, e.g., `Tool v5\..`                                                                                                            |