Verdict searchYou can search for the verdicts listed here with the
verdict: keyword as described in Search.Malicious verdicts
The following table shows all malicious verdicts.Additional verdicts for reported emails
The following additional verdicts can be used when resolving reported emails:Benign verdicts
A benign verdict does not necessarily mean that the email is 100% benign. Benign verdicts are applied when no malicious verdict could be derived. Based on the positive indicators in the email (e.g., trust), a more significant (trustworthy) benign verdict is chosen.Reputation and trust-based verdicts
Verdicts that are based on reputation or trust are usually the most trustworthy benign verdicts.Others
All other benign verdicts are based on certain indicators found in the email, but do not necessarily mean that the email is benign.Additional verdicts for reported emails
The following additional verdicts can be used when resolving reported emails:Verdict precedence
After analysis, XSP assigns a single final verdict to each email. This verdict is determined first based on its confidence (high, medium, or low), and then on its specificity. The final verdict controls which action (e.g., deliver with a subject rewrite or quarantine the email) is taken on the email. Confidence: All high-confidence verdicts and verdicts without confidence have priority over all medium-confidence verdicts. And all medium-confidence verdicts have priority over all low-confidence verdicts. Specificity: More specific verdicts have priority over more generic verdicts. Concretely, this is the now-enforced list of verdicts in order of precedence: Simulation > Whitelist > Blacklist > Filter > Airlock > Exploit > Malware > BEC > Extortion > VIP Fraud > Impersonation > Phishing > Spam. For example, if an email is determined to be Spam with high confidence, but also as Phishing with high confidence, the final verdict will be high-confidence Phishing. This is due to Phishing being a more specific verdict than Spam. If instead the email is only considered Phishing with medium confidence, then the final verdict would be high-confidence Spam because higher-confidence verdicts have precedence over lower-confidence verdicts.Rule priorities
The rules that determine the final verdict and decision are evaluated in a fixed priority order. The order applies to emails and reported emails, as well as for all email directions.The priority values of the built-in decision rules are documented in
Detection Defaults → Rule priorities.
Password required.