> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Search
In Release 7.0, xorlab introduced a more intuitive search feature to streamline the user experience. This new search bar eliminates the need for complex query languages and offers more user-friendly features, such as autocomplete, filters, and time range selection.
## Key features
* **Autocomplete Suggestions:** As you type, the search bar provides real-time suggestions, reducing the need to memorize search syntax.
* **Filter Options:** You can easily filter your results by sender, recipient, subject, or other key attributes by selecting options from a dropdown menu.
* **Time Range Selection:** The search bar includes a built-in time range selector to refine your searches by date without manually entering date strings.
* **Wildcard Characters:** Wildcards are automatically supported with `?` matching a single character and `*` matching zero or more characters.
* **Tag-based Search:** Easily search and aggregate emails using case-insensitive tags (e.g., #phishing, #highrisk) to filter or group emails. For the complete list, please see *[Tags](/9.0/tags)*.
* **Recent Searches:** Access the four last searches by clicking the search bar, allowing easy recall of previous queries for ongoing investigations or repetitive tasks.
* **Campaign Creation:** If a search query is [Campaign](/9.0/query-based-classifiers) compatible, you can click the icon in the search bar to directly turn the query into an adaptive policy.
* **Save Searches:** There's also an icon in the search bar that enables you to save the search query for later use.
## Search Query Basics
You can build powerful search queries using a combination of **filters**, **verdicts** and **tags**, and simple **logic** like `and`, `or`, and `not`.
### How the Logic Works
Search queries are made up of **statements** — simple conditions like filters (`status:open`) or tags (`#quarantine`) — connected using logical operators:
* `and`: both conditions must match
* `or`: at least one condition must match
* `not`: exclude anything that matches the expression
#### For example:
`#domainonlyinbound #inc #untrusted not(#crm or #marketing or #newsletter)`
The strongest operator is `not` followed by `and` and afterwards by`or`. Multiple statements without any operator are always treated as `and`.
## Email attributes
Every email has base attributes automatically set by xorlab, such as the sender, recipient, and timestamp. You can search using these attributes with the syntax `attribute:value`.
### Senders and recipients
| Query | Description |
| ---------------------- | ------------------------------------------------------------------------------------------------------ |
| `sender:` | Returns emails where the header `from:` or the SMTP `from` address matches `` |
| `recipient:` | Returns emails where the header `to:` or `cc:` or the SMTP `to` address match `` |
| `from:` | Returns emails where the header `from:` (a.k.a. `mail-from` or `5322.From`) matches `` |
| `to:` | Returns emails where the header `to:` matches `` |
| `cc:` | Returns emails where the header `cc:` matches `` |
| `involves:` | Returns emails where either `from`, `to`, `cc`, `envfrom`, or `envrecipient` match `` |
| `reporter:` | Returns incidents reported by `` |
| `envfrom:` | Returns emails where the SMTP `from` address (a.k.a. `envelope-from` or `5321.From`) matches `` |
| `envrecipient:` | Returns emails where the SMTP `to` address (a.k.a. `envelope-to` or `5321.To`) matches `` |
| Argument | Description |
| :--------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| ` ` | Accepts fully qualified email addresses and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------- |
| `from:albert@timespace.com` | Returns all emails where the header `from:` field contains `albert@timespace.com` |
| `to:*.net` | Returns all emails that contain a .net domain in the header `to:` field |
| `from:[marie@radio.org,isaac@gravity.net]` | Returns all emails with `mail-from = from:marie@radio.org` OR `mail-from = from:isaac@gravity.net` |
| `cc:[marie*,*isaac]` | Returns all emails whose header `cc:` field starts with the token `marie` or ends with the token `isaac` |
| Query | Description |
| ------------------------------- | ---------------------------------------------------------------------------------- |
| `.displayname:` | Returns all emails for the specified address type that have the given display name |
| Argument | Description |
| :---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `` | Accepts `sender`, `recipient`, `from`, `to`, `cc`, `involves` |
| `` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the display name to be matched contains spaces, then you must enclose it in double quotes. Use `\` to escape quotes |
| Query | Result |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `from.displayname:"Albert E."` | Returns all emails where a sender display name contains `Albert E.` |
| `from.displayname:"R* Fey*"` | Returns all emails where the sender display name starts with the character `R` and ends with the string `Fey` separated by a space |
| `to.displayname:[Albert, Richard]` | Returns all emails with `mail-from = from:marie@radio.org` OR `mail-from = from:isaac@gravity.net` |
| `cc:[marie*,*isaac]` | Returns all emails where the receiver display name is either `Albert` or `Richard` |
### Multi-tenant
| Query | Description |
| ----------------------- | ------------------------------------------------------------------------------------ |
| `tenant:` | Returns emails where the tenant's human readable identifier matches `` |
| `tenant.uid:` | Returns emails where the tenant's unique `uid` identifier matches `` |
| Argument | Description |
| :----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| `` | Accepts the value of the `uid` attribute defined in `/shared/guarded_tenants.yml` |
| `` | Accepts the value of the `authtenantid` attribute defined in `/shared/guarded_tenants.yml` |
| These search attributes do not support use of wildcard characters `?` and `*`. | |
| Query | Result |
| -------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| `tenant:timespace.com` | Returns all emails of the tenant `timespace.com` |
| `tenant.uid:db3953f5-2aba-42b1-b038-115d55c56f422` | Returns emails of the tenant whose `uid` matches `db3953f5-2aba-42b1-b038-115d55c56f422` |
| `tenant:[radio.org,gravity.net]` | Returns all emails of the tenant `timespace.com` OR the tenant `gravity.net` |
### Direction
| Query | Description |
| ----------------------- | ------------------------------------------------------------------------------------------------------ |
| `direction:` | Returns emails that were sent, received, exchanged internally, or processed on behalf of a third party |
| Argument | Description |
| :------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `` | Accepts `incoming`, `outgoing`, `internal`, `external`. Multiple direction matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `direction:incoming` | Returns emails sent from external parties to recipients inside the protected organization |
| `direction:outgoing` | Returns emails sent from the members of the protected organization to external parties |
| `direction:internal` | Returns emails sent from external parties to recipients inside the protected organization |
| `direction:external` | Returns emails sent from external parties to external parties (as it typically happens if an MTA forwards external emails) |
### Date and time
| Query | Description |
| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| `received:since: \| \|` | Returns emails that were received since the specified date and time |
| `received:before: \| \|` | Returns emails that were received before the specified date and time |
| `received:[ TO ]` | Returns emails that were received in the specified date and time interval (inclusive) |
| Argument | Description |
| :------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Keyword` | Accepts `today`, `noon`, `midnight`, `yesterday` |
| `DateString` | Accepts a date time string in the following formats:
- `dd.mm[.yyyy][,hh:mm]` where `yyyy` and `hh:mm` are optional
- `[yyyy-]mm-dd[,hh:mm]` where `yyyy` and `hh:mm` are optional
- `[yyyy-]mmm-dd[,hh:mm]` where `mmm = {jan, feb, mar, apr, jun, jul, aug, sep, oct, nov, dec}` and `yyyy` and `hh:mm` are optional |
| `RelativeDateString` | Accepts a string in the following format `` that indicates the current date minus `` number of `` days, of `` weeks, or of `` months |
| Query | Result |
| ---------------------------------------------------------- | ------------------------------------------------------------------------- |
| `received:since:noon` or `received:since:today,noon` | Returns all emails received since today 12:00 |
| `received:since:today,midnight` | Returns all emails received since today 00:00 |
| `received:since:sep-20,12:30` | Returns all emails received since 12:30, September 20 of the current year |
| `received:since:2020-09-20` or `received:since:20.09.2020` | Returns all emails received since September 20, 2020 |
| `received:since:3d` | Returns all emails received within the past three days (current time—72h) |
### Tags
xorlab Security Platform enriches processed emails with tags to simplify correlation and retrieval.
| Query | Description |
| ----------- | --------------------------------------------------- |
| `#` | Returns all emails that were tagged with `` |
| Argument | Description |
| :------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `String` | Accept any string. String values are parsed as described in the *[Tags](/9.0/tags)* reference. Multiple tags are combined with logical `AND` |
| Query | Result |
| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `#inc` | Returns all incoming emails |
| `#inc AND #trusted AND #word` | Returns all incoming emails from trusted senders that have a Word file attached |
| `#out AND #encryptedarchive` | Returns all outgoing emails that have an encrypted archive attached |
| `#inc AND #highrisk AND #newsender AND #exposedhvt AND #file` | Returns all incoming emails from senders never-before-seen to a high-value target that have a high-risk score and at least one file attached |
| `#untrusted AND #newdomain AND #exposedhvt` | Returns all emails from untrusted senders to high-value targets that contain at least one link with a domain never-before-seen |
| `#inc AND #highrisk AND #untrusted AND #newsender AND #cloudstorage` | Returns all incoming emails with a high-risk score from untrusted and unknown senders that contain at least one link to a cloud storage platform |
| `#inc AND #highrisk AND #newsender AND #shortenednolocalreputation` | Returns all incoming emails with a high-risk score from senders never-before-seen that contain a shortened link which points to a URL that has no local reputation (meaning it is not relevant to the organization) |
| `#inc AND #trusted AND #dangerousvbascript` | Returns all incoming emails from trusted senders that contain at least one Office file with a VBA script that makes use of potentially dangerous functions |
| `#inc AND #trusted AND #cracked AND #executable` | Returns all incoming emails from trusted senders with a cracked, encrypted attachment and an executable file attached |
| `#inc AND #runtime` | Returns all incoming emails with an attachment that triggered a suspicious runtime event (as observed during dynamic analysis) |
| `#pdf AND #cfiviolation` | Returns all emails with a PDF document attached that triggered a CFI violation during dynamic analysis (most likely an exploit) |
### Scores
xorlab Security Platform generates several scores for each processed email. Each score is a function of the organization’s email history and the email being processed.
| Query | Description |
| -------------------------------- | ------------------------------------------------------------------------- |
| `::` | Returns all emails with the specified score in a given range |
| `:[ TO ]` | Returns all emails with a `` in the specified interval (inclusive) |
| Argument | Description |
| :--------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Score` | Accepts `trust`, `reputation`, `risk`, `threat`, `spam`, and `rsd`:
- `trust` denotes the overall trust score and assumes a value between 0 and 100
- `reputation` denotes the reputation of the sending domain and assumes a value between 0 and 100
- `risk` quantifies the attack surface of an email and assumes a value between 0 and infinity
- `threat` is a function of `risk`, `trust`, `reputation` and classification, and quantifies the threat that an email poses to the organization; the score assumes a value between 0 and 100
- `spam` quantifies the likelihood of an email being spam; the score assumes a value between negative and positive infinity
- `rsd` is the rspamd score of the email; the score assumes a value between negative and positive infinity |
| `Relation` | Accepts `eq` (equal), `gt` (greater than), `gte` (greater than or equal), `lt` (less than) and `lte` (less than or equal) |
| `Number` | Accepts integers (for scores `trust`, `reputation`, `risk`, `threat`) and floating point values (for `spam`) |
| Query | Result |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `reputation:gt:50` | Returns all emails where the reputation score is greater than 50. The reputation is a score associated with authenticated senders based on the global and local reputation of the domain |
| `spam:lt:0` | Returns all emails with a negative spam score |
| Query | Description |
| ----------------- | ------------------------------------------------------ |
| `:` | Returns all emails with a `` at least `` |
| Argument | Description |
| :------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Score` | Accepts `trust`, `reputation`, `risk`, and `threat` (see previous table) |
| `Level` | Accepts `low`, `medium`, `high` and additionally `noauth` and `trusted` if `Score = reputation`:
- `noauth` indicates that the sender of an email could not be authenticated
- `trusted` indicates that the email sender could be authenticated and that sender `trust` is greater than 0
- `low` captures values between 0 and 50 if `Score = risk` and values between 0 and 34 otherwise
- `medium` captures values between 51 and 75 if `Score = risk` and values between 35 and 67 otherwise
- `high` captures values greater 75 if `Score = risk` and values between 68 and 100 otherwise |
### Verdicts
| Query | Description |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `verdict: \| \|` | Returns all emails from a given verdict class or with a specific verdict. For more information about verdicts, please see *[Verdicts](/9.0/verdicts)* |
| Argument | Description |
| :------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Class` | Accepts `benign`, `malicious`, and `undecided` |
| `Malicious Verdict` | Accepts `bec`, `extortion`, `fraud` (deprecated), `impersonation`, `malware`, `phishing`, `policy`, `vipfraud`, and `simulation`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[, ...]` |
| `Benign Verdict` | Accepts `bulk`, `business`, `cloudstorage`, `crm`, `freemail`, `marketing`, `newsletter`, `nonreputable`, `partner`, `personal`, `poll`, `popular`, `reputable`, `socialnetwork`, `survey`, `internal`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[, ...]` |
| Query | Result |
| -------------------- | --------------------------------------------------------------------- |
| `verdict:malware` | Returns all emails containing malware |
| `verdict:simulation` | Returns all emails that are part of some simulated awareness campaign |
| `verdict:bulk` | Returns all emails that are part of a bulk campaign |
### Verdict confidences
To search for emails with a certain verdict confidence, you need to make use of the `rule:` search feature described [further in this article](#predefined-filters). The verdicts that are not listed in the following table do not have different confidences, as described in *[Actions](/9.0/inbound-email-defense#actions)*.
| Verdict | Description |
| :-------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Phishing | **High:** `rule:PHISHING_high_confidence_decision`
**Med:** `rule:PHISHING_medium_confidence_decision`
**Low:** `rule:PHISHING_low_confidence_decision` |
| Spam | **High:** `rule:SPAM_high_confidence_decision`
**Med:** `rule:SPAM_medium_confidence_decision`
**Low:** `rule:SPAM_low_confidence_decision` |
| VIP Fraud | **High:** `rule:VIP_FRAUD_high_confidence_decision`
**Med:** `rule:VIP_FRAUD_medium_confidence_decision` |
| Impersonation | **High:** `rule:IMPERSONATION_high_confidence_decision`
**Med:** `rule:IMPERSONATION_medium_confidence_decision` |
| Policy (Filter) | **High:** `rule:FILTER_high_confidence_decision`
**Med:** `rule:FILTER_medium_confidence_decision` |
### Processing status
| Query | Description |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `status:` | Returns emails that are in the specified processing status. The value of `` depends on the type of email, whether it was quarantined or whether somebody reported it as suspicious |
| Argument | Description |
| :----------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ProcessingStatus` | - Accepts `delivered`, `quarantined`,` released`, `dropped`, `bounced`, `pending`, `smtperror` for emails from the normal mail flow
- Accepts `open`, `resolved`, and `pending` for emails reported as suspicious
- Accepts `completed` and `pending` for reported and uploaded suspicious files
- Emails with `status:pending` can be in the state of `processing:ongoing` or `processing:error`
- Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `status:delivered` | Returns all emails from normal mail flow that were delivered either to the recipient’s mailbox (incoming emails) or to the Internet (outgoing emails) |
| `status:quarantined` | Returns all emails from normal mail flow that were quarantined. Emails in this state can be [filtered](#predefined-filters) with `quarantine:` |
| `status:released` | Returns all emails that were released from quarantine |
| `status:dropped` | Returns all emails from normal mail flow that were dropped (i.e., deleted and not delivered) |
| `status:pending` | Returns all emails that are currently being processed or caused an error while processing. Emails in this status can be filtered with `processing:ongoing` or `processing:error` |
| `status:smtperror` | Returns all emails that have failed in delivery |
| `status:open` | Returns all reported emails that require further analysis |
| `status:resolved` | Returns all reported emails that were resolved, either automatically by the platform or manually by an analyst |
## Email content
### Body
The `body` keyword allows searching in the email's plaintext or HTML body parts.
| Query | Description |
| -------------------- | -------------------------------------------------------------------------------- |
| `body.topic:` | Returns all emails with a given topic in the email body (HTML or plaintext part) |
| Argument | Description |
| :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings (case-insensitive). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. See [topic detection](/9.0/topic-detection) for possible values |
| Query | Result |
| ------------------------------------ | ---------------------------------------------------------------------------------------- |
| `body.topic:sexualcontent` | Returns all emails with the topic `sexualcontent` in the email body |
| `body.topic:[sexualcontent,invoice]` | Returns all emails with one of the topics `sexualcontent` or `invoice` in the email body |
### Subject
| Query | Description |
| ----------------- | --------------------------------------- |
| `subject:` | Returns all emails with a given subject |
| Argument | Description |
| :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings (case-insensitive) and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the subject to be matched contains spaces, then you must enclose the subject string in double quotes. Use `\` to escape quotes |
| Query | Result |
| ------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| `subject:"How the world works"` | Returns all emails with a subject equal to `How the world works` |
| `subject:"This is \"a laser\""` | Returns all emails with a subject equal to `This is "a laser"` |
| `subject:[The*,*world*]` | Returns all emails with a subject that begins with `The` or contains `world`, e.g., `The world works like this` |
| Query | Description |
| ----------------------- | ---------------------------------------------------- |
| `subject.topic:` | Returns all emails with a given topic in the subject |
| Argument | Description |
| :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings (case-insensitive). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. See [topic detection](/9.0/topic-detection) for possible values |
| Query | Result |
| --------------------------------------- | ------------------------------------------------------------------------------------- |
| `subject.topic:sexualcontent` | Returns all emails with the topic `sexualcontent` in the subject |
| `subject.topic:[sexualcontent,invoice]` | Returns all emails with one of the topics `sexualcontent` or `invoice` in the subject |
### Embedded links
xorlab Security Platform extracts links from the email body and attached documents.
| Query | Description |
| -------------- | ------------------------------------------------- |
| `link:` | Returns all emails that contain the matching link |
| Argument | Description |
| :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the link to be matched contains the reserved characters (i.e., `:`, `#`, `(`, `)`, `[`, `]` ), then you must enclose the link in double quotes. Use `\` to escape quotes |
| Query | Result |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------- |
| `link:"http://www.xorlab.com"` | Returns all emails that contain at least one link to [xorlab.com](http://www.xorlab.com/) |
| `link:"http://www.xorlab.*"` | Returns all emails that contain at least one link that starts with *[http://www.xorlab](http://www.xorlab)* |
| Query | Description |
| -------------------------- | ---------------------------------------------------------------------- |
| `link.displaytext:` | Returns all emails that contain a link matching the given display text |
| | Description |
| :------ | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the display text of a link to be matched contains spaces, then you must enclose the display text string in double quotes. Use `\` to escape quotes |
| Query | Result |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `link.displaytext:"Click me!"` | Returns all emails that contain at least one link with the display text `Click me!` |
| `link.displaytext:"Click *!"` | Returns all emails that contain at least one link with the display text that starts with `Click ` and that ends with `!` |
| `link.displaytext:["Click me!", "Click here!"]` | Returns all emails that contain at least one link with the display text `Click me!` or `Click here!` |
| Query | Description |
| -------------------------- | --------------------------------------------------------------------------------------------------------- |
| `link.location:` | Returns all emails that contain a link in the given location (e.g., message body or a message attachment) |
| Argument | Description |
| :--------- | :------------------------------ |
| `Location` | Accepts `body` and `attachment` |
| Query | Result |
| -------------------- | ------------------------------------------------------------------- |
| `link.location:body` | Returns all emails that contain at least one link within their body |
### Embedded domains
xorlab Security Platform extracts domains from the links it finds in the email body and attachments. This includes domains that surface in network activity during dynamic file analysis.
| Query | Description |
| ---------------- | ---------------------------------------------- |
| `domain:` | Returns all emails that contain a given domain |
| Argument | Description |
| :------- | :------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `domain:xorlab.com` | Returns all emails that contain at least one link to the [xorlab.com](http://www.xorlab.com/) domain |
| `domain:[*xorlab.com,*xorlab.ch]` | Returns all emails that contain at least one link to the subdomains of [xorlab.com](http://www.xorlab.com/) and [xorlab.ch](http://www.xorlab.ch/) |
| Query | Description |
| ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| `domain.date:since: \| \| ` | Returns emails that contain a domain registered since the specified [date and time](#date-and-time) |
| `domain.date:before: \| \| ` | Returns emails that contain a domain registered before the specified [date and time](#date-and-time) |
| `domain.date:[ TO ]` | Returns emails that contain a domain registered in the specified date and time interval (inclusive) |
| `domain.ip:` | Returns emails that contain a domain with the specified IP |
| Argument | Description |
| :-------- | :------------------------------------------------------------------------------------------------------------------------------- |
| `IpValue` | Accepts a valid IP version 4. Multiple IP matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| ------------------------- | ---------------------------------------------------------------------------------------- |
| `domain:ip:172.217.10.78` | Returns all emails that contain at least one domain with the IP matching `172.217.10.78` |
| Query | Description |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| `domain.(local \| global)::` | Returns emails that contains a domain with the local or global reputation system score within [a given range](#scores) |
| Argument | Description |
| :--------- | :------------------------------------------------------------------------------------------------------------------------ |
| `Relation` | Accepts `eq` (equal), `gt` (greater than), `gte` (greater than or equal), `lt` (less than) and `lte` (less than or equal) |
| `Number` | Accepts integers (for scores `trust`, `reputation`, `risk`, `threat`) and floating point values (for `spam`) |
| Query | Result |
| -------------------- | -------------------------------------------------------------------------------- |
| `domain.global:gt:5` | Returns all emails that contain a domain with a global reputation greater than 5 |
| `domain.local:lt:5` | Returns all emails that contain a domain with a local reputation lower than 5 |
## Email attachments
xorlab Security Platform supports file name and file hash filters as well as specific file analysis verdicts.
| Query | Description |
| ------------------- | -------------------------------------------------------------- |
| `file.name:` | Returns all emails that contain a file matching the given term |
| Argument | Description |
| :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the link display text to be matched contains spaces, then you must enclose the link display text string in double quotes. Use `\` to escape quotes |
| Query | Result |
| ------------------------------ | ------------------------------------------------------------------------------------- |
| `file.name:"Please open.exe"` | Returns all emails with an attachment named `Please open.exe` |
| `file.name:*.exe` | Returns all emails with an attachment that ends with `.exe` |
| `file.name:[*exe, *hta, *bat]` | Returns all emails with attachments name ending with the tokens `exe`, `hta` or `bat` |
| Query | Description |
| -------------------- | --------------------------------------------------------------------------- |
| `file.hash:` | Returns all emails that contain a file matching the given SHA256 hash value |
| Argument | Description |
| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `SHA256` | Accepts hash values computed with the SHA256 algorithm. Multiple hash value matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `file.hash:275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f` | Returns all emails with an attachment whose SHA256 hash value equals 5a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f |
| Query | Description |
| ------------------- | ------------------------------------------------------------------------------------------------ |
| `file.type:` | Returns all emails that contain a file matching the xorlab Security Platform extracted file type |
| Argument | Description |
| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings and wildcards (using `matches:`). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. |
| Query | Result |
| --------------------------- | ------------------------------------------------------------------- |
| `file.type:document` | Returns all emails with attachments of the `document` type |
| `file.type:[exe, document]` | Returns all emails with attachments of the `exe` or `document` type |
| Query | Description |
| -------------------- | ------------------------------------------------------ |
| `file.topic:` | Returns all emails with a given topic in an attachment |
| Argument | Description |
| :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Match` | Accepts strings (case-insensitive). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. See [topic detection](/9.0/topic-detection) for possible values |
| Query | Result |
| ------------------------------------ | --------------------------------------------------------------------------------------- |
| `file.topic:sexualcontent` | Returns all emails with the topic `sexualcontent` in an attachment |
| `file.topic:[sexualcontent,invoice]` | Returns all emails with one of the topics `sexualcontent` or `invoice` in an attachment |
| Query | Description |
| -------------------- | -------------------------------------------------------------------------------------------- |
| `verdict: ` | Returns all emails that contain a file with a given verdict class or with a specific verdict |
| Argument | Description |
| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Verdict` | Accepts `activex`, `archive`, `data`, `dde`, `document`, `embobject`, `encrypted`, `exploit`, `executable`, `extobject`, `flash`, `image`, `iso`, `legacy`, `script`, `shortcut`, and `vbascript`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[, ...]` |
| Query | Result |
| ----------------- | ---------------------------------------------------------------- |
| `verdict:activex` | Returns all emails containing an attachment with ActiveX content |
### Processing status
| Query | Description |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `status:` | Returns emails that are in the specified processing status. The value of `` depends on the type of email, whether it was quarantined or whether somebody reported it as suspicious |
| Argument | Description |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `ProcessingStatus` | Accepts `delivered`, `quarantined`,` released`, `dropped`, and `pending` for emails from the normal mail flow, and `open`, `resolved`, and `pending` for emails reported as suspicious
Emails with `status:pending` can be in the state of `processing:ongoing` or `processing:error`
Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `status:delivered` | Returns all emails from normal mail flow that were delivered either to the recipient’s mailbox (incoming emails) or to the Internet (outgoing emails) |
| `status:quarantined` | Returns all emails from normal mail flow that were quarantined. Emails in this state can be [filtered](#predefined-filters) with `quarantine:` |
| `status:released` | Returns all emails that were released from quarantine |
| `status:dropped` | Returns all emails from normal mail flow that were dropped (i.e., deleted and not delivered) |
| `status:pending` | Returns all emails that are currently being processed or caused an error while processing. Emails in this status can be filtered with `processing:ongoing` or `processing:error` |
| `status:open` | Returns all reported emails that require further analysis |
| `status:resolved` | Returns all reported emails that were resolved, either automatically by the platform or manually by an analyst |
## Email headers
xorlab Security Platform supports searching across the message header name and values.
| Query | Description |
| ----------------------- | ------------------------------------------------------------------------- |
| `header.:` | Returns all emails that contain a header matching the given name or value |
| Argument | Description |
| :------- | :------------------------------------------------------------------------------------------------------------------------- |
| `Part` | Accepts `name` or `value` |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| ------------------------------------------------------------ | ------------------------------------------------------------------------ |
| `header.name:"x-spam-score"` | Returns all emails that contain a header with the `x-spam-score` name |
| `header.name:"*malicious"` | Returns all emails that contain a header name that ends with `malicious` |
| `header:{name:"x-spam-result" AND value:"*MIME_HTML_ONLY*"}` | Returns all emails with `MIME_HTML_ONLY` in the `x-spam-result` header |
## Predefined filters
| Filter | Description |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `messages` | Returns all processed emails from regular mail traffic |
| `reported` | Returns all emails that were reported as suspicious |
| `quarantine:` | Returns all emails from a given quarantine, where `` accepts `malware`, `phishing`, `extortion`, `impersonation`, `fraud` (deprecated), `filter`, and `spam`
**Examples:**
- `quarantine:malware` returns all emails that contained malware
- `quarantine:impersonation quarantine:phishing` returns all emails that impersonated somebody to deliver a phishing link |
| `files` | Returns all uploaded files |
### Queries using rules
xorlab Security Platform automatically analyses emails via a powerful [rule language](/9.0/actions-rules-and-profiles) to extract information about the email to decide whether to deliver or to quarantine the email.
| Query | Description |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| `rule:` | Returns all emails for which the specified rule has been executed during the processing of the email |
| `passiverule:` | Returns all emails for which the specified rule has been executed, but was configured as passive, so it did not influence the decision or tags |
| Argument | Description |
| -------- | --------------------------------------------------------------------------------------------------------------------------- |
| `Rule` | Accepts any rule name. A rule name must contain only lower and upper-case letters and no other character except underscore |
| Query | Result |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `rule:TAG_link_no_reputation` | Returns all emails for which the rule `TAG_link_no_reputation` was applied. The rule adds the `#noreputation` hashtag to an email, as the name of the rule suggests |