Custom Alerts - xorlab

Emails matching one of these lists get tagged #alert. The lists are accessible by selecting Settings → Lists → Alerts in XCC. Modify any of the lists below:

List name	Description	Accepted entries
Domain alerts	Use this list to flag emails that contain link domains in the email body or any of its attachments	Domain name as `String`, e.g., `cloudservice.com`
Email address alerts	Use this list to flag emails sent from certain email addresses	Email address as `String`, e.g., `user@suspicious.com`
File extension alerts (regex)	Use this list to flag emails that contain file attachments with a given file extension	File extension as `Regex`, e.g., `(?i)\.exe$` for case-insensitive matching
File hash alerts	Use this list to flag emails that contain file attachments with a given SHA256 hash value	File hash value as `String`, e.g., `9db4 4391 dbfa 43bc 9b13 4440 00f6 9c77 a395 95c9 bac5 710e 0a78 a638 60b0 69a2`
Keyword alerts	Use this list to flag emails that contain any given keyword	Keyword as `String`