Reporting Misclassification (False Positives/Negatives)

Suppose a message was mistakenly quarantined but is benign (false positive) or was delivered although it shouldn’t have been (false negative). In that case, you can report this email as misclassified when releasing or isolating it. This way, we can use your feedback to fine-tune xorlab Security Platform filters to act properly next time with such a message. You can also report misclassified messages while resolving user-reported emails. To report a misclassified email:

Click the message in XCC to open it in the Message detail view.
Click the red button in the top-right area of the screen: Release for mistakenly quarantined benign messages or Isolate for mistakenly delivered malicious messages.
When the Release/Isolate Message dialog appears, click to select the Report misclassification option, select the severity of the issue with a slider (see the guide below to pick the right level), optionally add a comment in the input box below the slider, and select one of the three available options of what information you want to share with us:
When you click Release or Isolate, the message will be released or isolated, and the misclassification report will be sent to xorlab (note that we will not send any feedback to you).

The same options are available when you click the Resolve button in the Reported message detail view, and when you click a three-dot menu of actions:

On the next screen, you will see a familiar dialog for reporting:

Severity levels

Please follow these guides to find the severity level that fits your case best:

When reporting a misclassified malicious email

Low: unwanted mail with no security impact (e.g., newsletters & marketing, promotions; usually legitimate senders).
Moderate: pure spam with no/little security impact (e.g., shady promotions, obvious spam, high-volume spam).
Major: harmful spam or threat with potential security impact (e.g., adult/drug spam, shady financial proposals, phishing, extortion, fraud, impersonation, malware, deceiving, creating a sense of urgency).
Critical: high-quality, targeted or new, advanced threat with clear harm potential that requires immediate attention (e.g., a missed phishing attack that needed remediation). Please include a comment with critical issues to help us assess them quickly.

When reporting a misclassified benign email

Low: wanted informational mail (e.g., newsletters & marketing, promotions, legitimate senders).
Moderate: wanted non-business-relevant or personal email (e.g., notifications from services, no action required after receiving the email, all emails for private purposes).
Major: business-relevant or critical emails (e.g., business communication, action required after receiving the email, password-reset emails, invoices, travel tickets).
Critical: business-critical email that required immediate attention (e.g., a quarantined email that required an immediate response, causing potential for business damage, required immediate remediation). Please include a comment with critical issues to help us assess them quickly.

Report a misclassified topic

To report a misclassified topic, please see Report misclassified topics.

Configuration

To change the default behavior of misclassification reporting, configure the relevant parameters in the xcc.yml file using the Expert Editor. The values shown below are the defaults. You only need to override the parameters you want to modify, the others can be left out.

misclassificationSubmission:
  ## Global switch to turn the feature on/off.
  enabled: true
  ## Pre-selected values in the graphical user interface (GUI)
  uiPreselection:
    ## Pre-selected Privacy Profile. Choose one of the following options:
    ##   - SHARE_EVERYTHING
    ##   - SHARE_EVERYTHING_EXCEPT_RAW_EML
    ##   - DO_NOT_SHARE_SENSITIVE_INFORMATION
    privacyProfile: "SHARE_EVERYTHING"
    ## Pre-selected value of the Share Misclassification checkbox in the GUI
    shareMisclassification: true

Disable misclassification reporting

To fully disable the misclassification reporting feature, add the following to xcc.yml:

misclassificationSubmission:
  enabled: false

Turn off auto-selected misclassification checkbox

Per default, the “Report misclassification” checkbox is always selected. To turn the auto-selection off, add the following to xcc.yml:

misclassificationSubmission:
  uiPreselection:
    shareMisclassification: false

​Severity levels

​When reporting a misclassified malicious email

​When reporting a misclassified benign email

​Report a misclassified topic

​Configuration

​Disable misclassification reporting

​Turn off auto-selected misclassification checkbox