> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Relationship
> The relationship (trust) model of who communicates with whom in your organization, built and maintained automatically.
The relationship is a key indicator for the detection engine.
**Key Takeaways**
* Use the relationship to assess how frequently your organization communicates with a sender.
* The relationship is learned on domains and mailboxes separately. The more back and forth emails are seen, the higher its value. It will decay over time if no communication is seen.
* The detection engine filters emails with a lower relationship more aggressively.
* In xorlab, instead of whitelisting a sender, you can manually increase its relationship to make the detection more permissive.
* Relationship requires a successful authentication of the sender.
## Learning phase
The relationship model needs an initial learning phase before it is ready to be used. Normally, detection is disabled during learning phase (*Toothless* mode, in which xorlab delivers all emails and only records the actions it would have taken) and manually enabled afterward.
It is possible to enable partial protection already during learning phase. If this is required, contact [support@xorlab.com](mailto:support@xorlab.com).
To get an indication of the learning, have a look at the *Business Relevant* percentage in the dashboard.
The duration of the learning phase and the expected *Business Relevant* range are documented in
[Detection Defaults → Learning phase](/latest/detection-defaults#learning-phase). Access to that page is restricted.
The relationship model is designed such that it is not affected by special cases like out-of-office messages, subdomain providers, freemail providers, etc.
## Understanding relationship values
A relationship value is between 0 and 100. 0 means there was no back and forth communication yet. Each email is assigned three values:
* **Personal**: Relationship between sender and recipient mailbox
* **Person - Organization**: Relationship between sender mailbox and recipient domain
* **Organization**: Relationship between sender domain and recipient domain
The overall relationship of an email is the maximum of those three. However, the detection engine may use these values individually. For example, it weights the Personal value higher than the Organization one.
The relationship value only increases if emails were seen in both directions.
**Relationship value and trust score**
The relationship value is also referred to as the **trust score**. They are the same number, and the terms are used interchangeably across xorlab.
In [Search](/latest/search#scores), it is the `trust` score: `trust:gte:15` matches every email whose relationship value is 15 or higher.
To see how much each side contributed to the current relationship, hover over one of the values to see the one-sided relationship:
## Using relationship tags
To search and filter for emails based on their relationship, you can use these built-in tags:
| Tag | Description |
| :--------------- | :--------------------------------------------------------------------------- |
| `#untrusted` | No or negligible relationship. Sender has not been seen or communicated with |
| `#lowtrusted` | Small back and forth communication seen |
| `#mediumtrusted` | Consistent back and forth communication seen |
| `#hightrusted` | Frequent back and forth communication seen |
| `#business` | The *Organization* relationship is at least `#lowtrusted` |
| `#partner` | The domains with the highest relationship |
**Detection**
The biggest difference in detection happens between `#untrusted` and `#lowtrusted`. In general, xorlab allows only very little attack surface in `#untrusted` emails.
The actual threshold values for the different tags are only indicative and subject to change; they are documented in [Detection Defaults → Relationship trust tiers](/latest/detection-defaults#relationship-trust-tiers) (password required). For more tags about relationship, have a look at [Tags](/latest/tags#relationship-tags).