Analyst Overview

This guide covers the work you do as an analyst in xorlab: understanding why an email received a particular verdict, handling reported emails and release requests, and correcting the detection when a message is classified incorrectly. If you are new to the platform, start with the core concepts and the walkthrough below. The remaining sections describe the day-to-day workflows and the reference material you will return to.

Start here

Core Concepts

Learn how the platform thinks: relationship, reputation and authentication.

Quick Walkthrough

A short guided tour through the web interface with hands-on introduction.

Video Tutorials

For visual learners — step-by-step description of the platform.

Essential workflows

Your work with xorlab will typically include:

Topic	Description
Using Campaigns	Create new detection rules via campaigns.
Understanding a Verdict	Understand why xorlab assigned an email a specific verdict.
Handling the Abuse Mailbox	How to handle the reported emails and give end-users feedback.
Handling Release Requests	How to handle quarantine release requests from end-users.
Reporting a Misclassification	Handle misclassifications and report them to xorlab.

Correcting the detection

These topics come up when a message is classified incorrectly:

How to Fix a False Positive
How to Fix a False Negative
How to Handle Authentication Issues
How to Tune Detection overall
Using Topics to improve searches and campaigns

Reference

Detailed material on the concepts you will encounter across the workflows above:

Tags - what tags exist and how to use them
Verdicts - list of verdicts with their description and precedence
Search Syntax - craft fast, accurate queries
Lists - description of all built-in lists

⌘I

​Start here