Less reaches your queue
Reported email and quarantine releases resolve themselves. What is left is what automation could not decide.
Every verdict shows its reasoning
Indicators, sender relationship, authentication and file analysis in one view. Down to the individual detection rules.
You correct it yourself
Activate search queries as standing policies. No configuration file, no support ticket, reversible afterward.
Capabilities you may not have today
Search by what a message is about, group a whole wave from one email, pull delivered mail back out.
Less reaches your queue
Two parts of the platform can take work off your desk before you see it. Employee-reported email. Reports arrive as cases, each carrying xorlab’s own analysis of the message. Cases can be closed without you in two ways: by verdict, so anything the platform has already classified confidently is resolved automatically. Or by a campaign, so a pattern you have handled once is handled the same way every time after that. The employee who reported it gets feedback either way. See Handling the Abuse Mailbox. Quarantine release. End-users see their own quarantined email and release what they need themselves. For the quarantines you are not willing to hand over, they can only ask, and the request reaches you with the analysis already attached. See SSQ Overview and Handling Release Requests.Every verdict shows its reasoning
Nothing asks you to trust a score. Each message carries a verdict and a confidence, and the detail view shows what produced them: the relationship between sender and recipient, the result of SPF, DKIM and DMARC, the indicators that were found, the analysis of every attachment and link, and so on. From there you can go further and read the individual rules that contributed. See Understanding an Email Verdict. That is what lets you tell an employee why their report was closed, a user why their email was held, and an auditor why the platform did what it did. The reasoning rests on models that are documented rather than described as magic: how xorlab learns who normally communicates with whom, what content is normal in your environment, and what it makes of sender authentication. See Concepts Overview.You correct it yourself
A recurring false positive does not have to become a support ticket. Any search query can be turned into a campaign: a standing policy that overrides the default decision for exactly the messages it matches, and leaves everything else alone. A campaign can quarantine, deliver, rewrite or classify a an email, and it stays visible and reversible afterward. See Using Campaigns. Smaller corrections are quicker still. Releasing an email from quarantine is itself a signal: xorlab becomes less aggressive toward that sender each time it happens. The step-by-step measures are in Fix a False Positive and Fix a False Negative, with Tune Detection for the cases where the overall balance needs to shift, and Lists Overview for sender-level exceptions such as VIPs, blacklists and whitelists.Capabilities you may not have today
Where to start
Quick Walkthrough
Fifteen minutes in the web interface: search for an email, build a campaign, run a similarity search, answer a report.
Evaluate xorlab
How a trial runs on your own traffic, and what you can measure the results against before anything is blocked.
Analyst Overview
The full analyst path: core concepts, the daily workflows, and the reference material behind them.
Video Tutorials
The same ground covered on screen, if you would rather watch than read.