Before You Begin

​

Configure your guarded domains

tenants:
- name: xorlab
  # Add all domains that should be protected
  domains:
  - xorlab.com
  - "**.xorlab.com" # To include subdomains; note the required quotes

​

Define data retention

tenants:
- name: xorlab
  ## Default data retention
  dataRetention:
    ## Duration after which benign mails are deleted.
    deliveredTtlDays: 90
    ## Duration after which reported messages are deleted.
    reportedTtlDays: 730
    ## Duration after which quarantind emails are deleted.
    quarantinedDefaultTtlDays: 30

​

Choose between Inline and Monitoring mode

​

Configure Inline mode

1. In activeguard/core/active_guard.yml, configure the SMTP handlers and the sender/recipient extraction settings:
   active_guard.yml

   scanSources:
     smtp:
       port: 10025
       handler:
       # Inline mode - filter and forward processed emails
         smtpInline: {}
         smtpReport: {}
   
2. Open activeguard/mta/startup_cfg/postfix_custom/master.cf and set the following lines to bounce.
   master.cf

   # Enable all delivery status notifications
   bounce    unix  -       -       n       -       0       bounce
   defer     unix  -       -       n       -       0       bounce
   trace     unix  -       -       n       -       0       bounce
   
3. Open activeguard/mta/startup_cfg/postfix_custom/main.cf and configure it like this.
   main.cf

   # Enable delay warnings
   delay_warning_time = 1h
   confirm_delay_cleared = yes
   # Ativate DSNs
   smtpd_discard_ehlo_keywords = silent-discard
   

4. Optional: Enable toothless mode during learning phase. This will force xorlab to deliver all emails, even malicious ones.
   Toothless mode

   In toothless mode, xorlab will not take any actions on emails and always deliver them. This is only used for the first few weeks to avoid false positives during the learning phase. Afterward, this profile needs to be removed again. In toothless mode, you can search for #quarantine to find the emails that xorlab would have quarantined.
   guarded_tenants.yml

   tenants:
   - name: xorlab
     ruleProfiles:
     - default_dana.properties
     - default_actions.properties
     # Add this line to enable toothless mode
     - no_subject_rewrite_no_quarantine.properties
   
5. Click Publish. The new configuration becomes active within about one minute.

​

Configure Monitoring mode

1. In activeguard/core/active_guard.yml, configure the SMTP handlers and the sender/recipient extraction settings:
   active_guard.yml

   scanSources:
     smtp:
       port: 10025
       handler:
       # Activate Monitoring mode - all emails will be dropped after processing.
         smtpOffline:
           senderRecipientExtraction:
             # Get the recipients from the TO and CC headers
             recipientExtraction: MAIL_HEADER
             # Get the envelope sender from email headers
             senderExtraction: HEADER
         smtpReport: {}
   
   For M365 integrations, set senderRecipientExtraction.senderExtraction to MAIL_ENVELOPE instead of HEADER.
2. Open activeguard/mta/startup_cfg/postfix_custom/master.cf and set the following lines to discard.
   master.cf

   # Disable all delivery status notifications
   bounce    unix  -       -       n       -       0       discard
   defer     unix  -       -       n       -       0       discard
   trace     unix  -       -       n       -       0       discard
   
3. Open activeguard/mta/startup_cfg/postfix_custom/main.cf and configure it like this.
   main.cf

   # Comment out the following two lines. This will deactivate delay notifications.
   #delay_warning_time = 1h
   #confirm_delay_cleared = yes
   # Disable Delivery Status Notification (DSN) extension
   smtpd_discard_ehlo_keywords = silent-discard, dsn
   

4. Click Publish. The new configuration becomes active within about one minute.