Campaigns - xorlab

Campaigns (a.k.a. query-based classifiers) allow you to hot-update the detection engine with smart classifiers based on custom search queries. For more information about how to use them, please see Video Tutorials. Here you can take a look at a quick preview of what campaigns can be used for:

The following table lists all currently supported search queries that can be used to create a query based classifier:

Search	Example
`From`, `To`, `CC` email address and display name Envelope `from` and envelope recipient email address.	`from:search@xorlab.com`, `from.displayname:search`, `envfrom:search@xorlab.com`, `sender:search@xorlab.com`, `recipient:search@xorlab.com`, `involves:search@xorlab.com` Supports wildcards
Tags (note that the `#quarantine` and `#subjectrewrite` tags can’t be used in campaigns)	`#untrusted #newdomain`
Domains in the email (incl. sender domains as well as URL domains in the email body)	`domain:test.xorlab.com` Supports wildcards
Attachment name and hash	`file.name:text.exe`, `file.hash:abcdefg` Supports wildcards
Spam score	`spam:gt:4`
Rspamd score	`rsd:gt:2`
Subject	`subject:"hi there"` Supports wildcards
Content similarity	N/A The similarity search query is automatically generated in the similarity detail view
Links URL and display text	`link:"https://www.test.com"`, `link.displaytext:"click here!"` Supports wildcards
Headers	`header.name:x-xor-example`, `header.value:abcdefg`, `header:{ name:x-xor-example value:abcdefg }` Supports wildcards