> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Abuse Mailbox / Reporting integration

xorlab Security Platform allows users to report suspicious messages, which are then checked and resolved by admins or automatically. This feature works out of the box—a user simply sends the email in question as an [.eml attachment](/9.0/reporting-emails#how-to-forward-an-email-as-an-attachment) to the default `suspicious@<templateDomain>` address, where the `templateDomain` property (not a variable) is configured in the `activeguard/core/active_guard.yml` file (see step #7 in [*Basic settings*](/9.0/configuration-guide#basic-settings)).

<Note>
  This reporting address can be changed to any address of your choice—please see [*Reporting address*](/9.0/activeguard-sender-addresses#reporting-address).
</Note>

After a user reports a suspicious message, an automatic reply is sent back to the user acknowledging the receipt of the email. Another notification is sent when the case is resolved. You can disable this automatic mailing for [acknowledgment emails](/9.0/actions-rules-and-profiles#acknowledgment-emails) and/or [particular verdicts](/9.0/actions-rules-and-profiles#reported-email-handling). In the latter case, you can also decide how the reported messages will be automatically handled and which notification template will be used for a given verdict.

Moreover, you can customize how these notifications look—please see *[Customizing notification templates](/9.0/email-template-modifications)*.

## Configuring the Report Message button

Before you start configuring the Report Message button in any app, you have to check the following settings in the `activeguard/core/active_guard.yml` file which affect feedback from xorlab Security Platform:

* `no_auto_feedback.properties`—make sure it is not active (more details in [*Profiles*](/9.0/actions-rules-and-profiles#profiles))
* `authorizedEmailReportRecipients` under `emailReporting`—it lists all domains that are allowed to receive notifications regarding reported emails (a reporter using an email address not listed here will not receive any feedback from XSP).

### Microsoft 365

In order to use the MS Outlook **Report Message** button with reporting service in xorlab Security Platform, you need to perform three actions: set up an Exchange Online mailbox for reported emails, opt for sending the reported messages there, and finally create a rule that redirects emails sent to this mailbox to a reporting account in XSP.

1. Add an Exchange Online mailbox for reported emails, if you don’t have it already. For example, name it `Reporting` and assign the address of `reporting@example.com`.

2. Go to the [Microsoft 365 Defender portal](https://security.microsoft.com/) and in the left pane scroll all the way down to select **Settings**. Click **Email & collaboration**, then **User reported settings**. Or you can go directly to the [User submissions](https://security.microsoft.com/securitysettings/userSubmission) page.

3. On the **User reported settings** page, make sure that the first switch is on. Depending on your preferences, select an Outlook report button configuration (you can leave the first default option selected), scroll down to the **Reported message destinations** section, and from the drop-down list under **Send reported messages to:** select the second option **My reporting mailbox only**. Then, in the input box under **Add an exchange online mailbox to send reported messages to:** enter your reporting mailbox address you have just set in step #1:

   <img src="https://mintcdn.com/xorlab/O_O2TUa6eRBR54aI/9.0/assets/reporting-address.png?fit=max&auto=format&n=O_O2TUa6eRBR54aI&q=85&s=01fee4688559933ddbde1709d27cca9a" alt="Email address for reported messages" style={{border: '1px solid #ddd'}} width="2704" height="1648" data-path="9.0/assets/reporting-address.png" />

   *Assigning a mailbox for user reported messages*

4. Click **Save**.

5. Follow the steps described in the *[Mail flow rule](/9.0/office365-inline#mail-flow-rule)* section and create a new rule, e.g., `MSReportingButtonIntegration`, on the **[Rules](https://admin.exchange.microsoft.com/#/transportrules)** page using these settings for rule conditions:

   * **Apply this rule if** → **The recipient** → **is this person** and select your Exchange Online reporting mailbox from the list, e.g., `Reporting` you created in step #1.
   * **Do the following** → **Redirect the message to** → enter the xorlab Security Platform reporting mailbox address, e.g., `suspicious@mx.xyz.activeguard.cloud`, where `xyz` is your customer ID for your XSP instances.

   <img src="https://mintcdn.com/xorlab/O_O2TUa6eRBR54aI/9.0/assets/reporting-rule-conditions.png?fit=max&auto=format&n=O_O2TUa6eRBR54aI&q=85&s=76d0ead8e1355878a2ee1871ad941957" alt="Reporting rule conditions" style={{border: '1px solid #ddd'}} width="2020" height="1644" data-path="9.0/assets/reporting-rule-conditions.png" />

   *Rule conditions for redirecting reported messages*

6. Click **Next** twice, review the settings for your rule on the last page and if they are OK, click **Finish**, then **Done** when the transport rule is created. Remember to enable this rule on the **Rules** page.

After you successfully integrate the reporting feature in M365, it should work like presented below:

<div style={{position: 'relative', paddingBottom: 'calc(57.20899470899471% + 41px)', height: '0'}}>
  <iframe src="https://demo.arcade.software/vrOTKZbMo1WEPqo5qOBS?embed" frameBorder="0" loading="lazy" webkitallowfullscreen mozallowfullscreen allowfullscreen style={{position: 'absolute', top: '0', left: '0', width: '100%', height: '100%', colorScheme: 'light'}} title="Automated Answer to Reported Emails" />
</div>

For more information, please refer to the [Microsoft documentation](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox?view=o365-worldwide).

### Other apps

The reporting feature in xorlab Security Platform can be integrated with a reporting button in practically all email solutions. All you have to do is to assign an action to this button that would forward the suspicious email as an .eml attachment to the [reporting email address you configured](/9.0/activeguard-sender-addresses#reporting-address).