> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# What xorlab Changes for Analysts
> For analysts weighing up the platform: which work it takes over, how much of each decision it shows you, and which corrections you can make on your own.
This page summarizes some of the major benefits analysts can get out of using xorlab.
Reported email and quarantine releases resolve themselves. What is left is what automation could not decide.
Indicators, sender relationship, authentication and file analysis in one view. Down to the individual detection rules.
Activate search queries as standing policies. No configuration file, no support ticket, reversible afterward.
Search by what a message is about, group a whole wave from one email, pull delivered mail back out.
## Less reaches your queue
**Two parts of the platform can take work off your desk before you see it.**
**Employee-reported email.** Reports arrive as cases, each carrying xorlab’s own analysis of the message. Cases can be closed without you in two ways: by verdict, so anything the platform has already classified confidently is resolved automatically. Or by a campaign, so a pattern you have handled once is handled the same way every time after that. The employee who reported it gets feedback either way. See [Handling the Abuse Mailbox](/latest/abuse-mailbox).
**Quarantine release.** End-users see their own quarantined email and release what they need themselves. For the quarantines you are not willing to hand over, they can only ask, and the request reaches you with the analysis already attached. See [SSQ Overview](/latest/ssq-overview) and [Handling Release Requests](/latest/handling-release-requests).
## Every verdict shows its reasoning
**Nothing asks you to trust a score.**
Each message carries a verdict and a confidence, and the detail view shows what produced them: the relationship between sender and recipient, the result of SPF, DKIM and DMARC, the indicators that were found, the analysis of every attachment and link, and so on. From there you can go further and read the individual rules that contributed. See [Understanding an Email Verdict](/latest/understand-verdict).
That is what lets you tell an employee why their report was closed, a user why their email was held, and an auditor why the platform did what it did.
The reasoning rests on models that are documented rather than described as magic: how xorlab learns who normally communicates with whom, what content is normal in your environment, and what it makes of sender authentication. See [Concepts Overview](/latest/concepts-overview).
## You correct it yourself
**A recurring false positive does not have to become a support ticket.**
Any search query can be turned into a campaign: a standing policy that overrides the default decision for exactly the messages it matches, and leaves everything else alone. A campaign can quarantine, deliver, rewrite or classify a an email, and it stays visible and reversible afterward. See [Using Campaigns](/latest/campaigns).
Smaller corrections are quicker still. Releasing an email from quarantine is itself a signal: xorlab becomes less aggressive toward that sender each time it happens. The step-by-step measures are in [Fix a False Positive](/latest/fix-false-positives) and [Fix a False Negative](/latest/fix-false-negatives), with [Tune Detection](/latest/detection-tuning) for the cases where the overall balance needs to shift, and [Lists Overview](/latest/lists) for sender-level exceptions such as VIPs, blacklists and whitelists.
## Capabilities you may not have today
| Capability | What it gives you |
| :----------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Search email the way you search logs** | Query the whole corpus by what a message is about — an invoice, a credential prompt, a package delivery — as well as by link, domain, attachment property, tag, verdict and authentication result. Save the query, come back to it, or promote it to a campaign.
[Search](/latest/search) · [Use Topics for Searches and Campaigns](/latest/topic-detection) |
| **Find the rest of a wave from one message** | Similarity search groups an email with the others that belong to it, on content rather than on sender or subject, so a wave that varies both is still one result set. The grouping can be saved as a search or promoted to a campaign.
[Quick Walkthrough](/latest/quick-walkthrough) |
| **Pull a delivered email back out** | Case Isolation removes a message from the mailboxes it reached, through the Microsoft Graph API.
[Activate Case Isolation](/latest/m365-case-isolation) |
| **Analyze email that arrived before xorlab did** | On Microsoft 365, past email is imported from the mailboxes and analyzed, so you have history to work with instead of waiting out a learning phase.
[Import Past M365 Emails](/latest/m365-retrospective-email-scanning) |
| **Feed the rest of your stack** | Verdicts, SMTP logs, threat intelligence extracted from your own mail and the full audit trail go out over Syslog in JSON or CEF, and lists are managed over a REST API.
[Connect a SIEM](/latest/integrations-siem) · [Automate with a SOAR](/latest/integrations-soar) |
## Where to start
Fifteen minutes in the web interface: search for an email, build a campaign, run a similarity search, answer a report.
How a trial runs on your own traffic, and what you can measure the results against before anything is blocked.
The full analyst path: core concepts, the daily workflows, and the reference material behind them.
The same ground covered on screen, if you would rather watch than read.