Skip to main content
Local Reputation is the indicator this produces, and it helps distinguish relevant emails from potentially malicious ones.
Key Takeaways
  • Use the local reputation to assess the relevance of certain domains and file types in your organization.
  • The detection engine filters content without local reputation more aggressively.
  • The local reputation is built up continuously, and shown for domains and file types. The local reputation for additional objects like root domains, top-level domains, file extensions, etc. can be queried via custom rules.
  • The local reputation decays over time if the corresponding content is not seen anymore.
  • The local reputation is only built up based on legitimate traffic with a high Relationship.
The local reputation is specific to your organization. It is distinct from the Global Reputation provided by xorlab, which is identical across all xorlab customers and reflects a global relevance scoring.

​
Learning phase

As with the Relationship, the local reputation system relies on the initial learning phase to build up the reputation values. During this time, the values are expected to be inaccurate. Afterward, it stabilizes but the system keeps updating the local reputation values based on the email traffic it sees.

​
Understanding reputation values

The local reputation is a value between 0 and 100. 0 means it has not yet been seen in emails with a high relationship. The local reputation is a strong indicator to distinguish legitimate links from malicious ones, as it is difficult for an attacker to obtain local reputation for a domain. xorlab exposes the local reputation for the following objects. All can be found in the detail view:

URL Domain

URL Domain

File Type

File Type

Sender Domain

Sender Domain
Subdomains normally inherit the local reputation of the root domain.
Reputation and RelationshipIt is possible (but rare) that a sender domain has local reputation, but no Relationship. This happens when your organization did not exchange emails with that domain itself, but the domain was mentioned in communication with another domain that has a relationship. In such a case, the local reputation weights similarly strong as a normal relationship value.

​
Special cases

There are some special cases where the local reputation behaves differently:
  • Domains from Subdomain-Providers do not inherit the local reputation of the root domain.
  • The local reputation is not used for domains from Cloudstorage-Providers. While it is shown in the platform, the detection engine does not use it as indicator.
In general, all cases are exempted from local reputation where an attacker could easily obtain access to that domain.

​
Using reputation tags

To search and filter emails based on local reputation, you can use these built-in tags: For more tags about reputation, have a look at Tags.