Skip to main content

​
Manually resolve

​
Review a case

  1. To view open cases, click on Abuse Mailbox in the left menu or on the diagram in the dashboard. Accessing Abuse Mailbox
  2. Click on a message to view in detail
  3. Review the email, paying attention to:
    • Message Preview
    • From and Envelope From address
    • Authentication
    • Relationship
    • Attachment Analysis (if applicable)
    • Reputation of links (if applicable)
  4. Resolve the case Resolve Case
  5. The pop-up enables you to modify:
    • The verdict of the email
    • The Feedback Template for the employee
    • Add a comment to the feedback
    • Report the misclassification

​
Resolve multiple cases

In the Abuse Mailbox view, you can also select multiple cases and resolve them simultaneously. Resolving multiple cases

​
Auto resolve cases

xorlab Security Platform provides two mechanisms to automatically send feedback emails to reporters and close corresponding cases without manual interaction.
  • Verdict-based Automation – determines actions based on the verdict and confidence of reported emails.
  • Campaign Automation – enables a fine-tune approach when a reported email matches a specific campaign query.

​
Verdict-based automation

The verdict-based automation of reported emails is enabled by default and can be modified via the Actions configuration screen.
  1. In the dashboard, click the tiles icon next to your account name to click the Admin icon.
  2. On the Admin page, click the Actions tile.
  3. In the left menu, click Abuse Mailbox
  4. Hover over the verdict to modify the action: Selecting Abuse Mailbox Actions
  5. Choose whether to resolve cases automatically or manually. For automatically resolved cases, select the email template to send to the employee. Modifying Abuse Mailbox Actions

​
Campaign automation

You can use Campaigns to automatically resolve reported emails that match a campaign query. This option is suitable when you detect a pattern in reported emails and wish to fine-tune the system accordingly.
  1. Define the Search Query
    • In the Abuse Mailbox view, enter a search query that captures the type of reported emails you want to handle automatically.
    • You can use tags and attributes such as sender, domain, or attachment type to make the query more specific.
    • Avoid using fields related to verdicts or actions, as they are not compatible with campaigns.
  2. Review the Results
    • Inspect the list of matching emails to make sure your query captures only the messages you want to automate.
    • To reduce false matches, add inclusion tags like #auth or #trusted to narrow the scope.
    • Exclusion tags like not #document or not #cloudstorage can also be helpful in avoiding false matches.
  3. Create the Campaign
    • When the search query is ready, press Enter to refresh the search results.
    • Then click on the campaign icon next to the search bar to create a new campaign.
    • If the icon is grayed out, your query contains unsupported fields — remove them and try again.
  4. Configure the Campaign
    • Message Action: None
    • Resolve Action:
      • Benign – for legitimate, safe emails; specify which feedback message to send to the employee who reported the email.
      • Malicious – for unwanted or harmful emails; also choose a feedback message to inform the employee who reported the email.

​
Campaign examples

The following examples show some ideas on how to automatically resolve reported cases with campaigns.
  • Resolve all reported messages with young domains (sender domain or embedded URL): (#365daysoldsender or #365daysold) and (#spam or #phishing)
  • Resolve all reported messages with shortened URLs (all confidences): #phishing #shortened
  • Resolve all reported internal emails without attachments: #internal not #nolocalreputation not #document
  • Resolve all reported partner emails without attachments or links to cloud storage: #partner #auth #trusted not #nolocalreputation not #cloudstorage not #document
  • Resolve all greymail without attachments or links to cloud storage: (#marketing or #crm or #newsletter or #bulk or #external) not #nolocalreputation not(#cloudstorage or #cloudstoragesender) not #document not #spffail not #dkimfail not #subjectcvip not #bodylt75words not #lowtrusted not #internal
Hints:
  • Use not #nolocalreputation not(#cloudstorage or #cloudstoragesender) to avoid any phishing false negatives.
  • Use not #document to avoid any malware false negatives.