Change Quarantine Retention

RetentionAs soon as an email is removed from the quarantine, it is not visible and searchable anymore in xorlab.

You can configure the quarantine retention in the shared/guarded_tenants.yml file:

There is a default quarantine retention for all quarantines
And you can overwrite the default per quarantine

guarded_tenants.yml

tenants:
  - name: xorlab
    domains:
      - xorlab.com
    dataRetention:
      ## Default quarantine retention
      ## This value can be overwritten per quarantine type.
      quarantinedDefaultTtlDays: 30
    quarantine:
      quarantines:
          ## Overwrite the default quarantinedDefaultTtlDays for a specific quarantine
          - name: Malware
            ttlDays: 10

You can find the list of all quarantines here: List of Quarantines. When specifying entries under quarantines, it is not necessary to list all other built-in quarantines. Just add the quarantines that you want to change.

⌘I