> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Enable Attachment Removal

> Strip suspicious attachments and deliver the remaining email. The Self-Service Quarantine is generally the better option.

Removed attachments can be replaced with a text file.

<Note>
  **Use SSQ instead**

  In general, we recommend to enable the [SSQ](/latest/ssq-overview) instead of attachment removal. It provides a safer environment and no attachments are lost.
</Note>

Attachment removal can be activated in different ways:

* **Verdict based**: Remove all attachments from emails classified as Malware or Filter/Policy.
* **File based**: Remove attachments that match certain file criteria (e.g. extension)
* **Custom rule based**: Remove attachments based on arbitrary custom rules - contact [support@xorlab.com](mailto:support@xorlab.com) for this

<Warning>
  After an attachment was replaced or removed, the original attachment is deleted and cannot be recovered anymore.
</Warning>

To enable attachment removal or replacement:

1. Open the `activeguard/core/rule_sets/90_local/params/local.properties` file in Expert Editor and add:
   ```ini local.properties theme={null}
   # Global switch for enabling attachment removal/replacement
   POLICY_attachment_transform_state=ACTIVE
   # Control the file name of the text file which replaces the attachment. Use %s to include the original file name
   POLICY_attachment_replace_filename_formatstring=removed-%s.txt
   ```

2. Specify the email direction on which attachment removal is activated:
   ```ini local.properties theme={null}
   # Supported values: ALL, INCOMING (default) and OUTGOING
   POLICY_attachment_transform_direction=INCOMING
   ```

3. For **verdict based** attachment removal, use the following configuration:
   ```ini local.properties theme={null}
   # Supported values: keep(default)/remove/replace
   # Add only the verdicts where you want to enable attachment removal
   POLICY_malware_dynamic=replace
   POLICY_malware_static=replace
   # Use attachment removal/replacement on filter verdicts with care.
   POLICY_attachment_filter=
   ```

4. For **file based** attachment removal, use the following configuration:
   ```ini local.properties theme={null}
   # Supported values: keep(default)/remove/replace
   POLICY_encrypted_archive_file=
   POLICY_excessive_nesting=
   # Replace/remove all executable files
   POLICY_executable_file=
   # Replace/remove all files with blacklisted extensions/hashes/file outputs 
   POLICY_file_extension_is_blacklisted= # (1)
   POLICY_file_hash_is_blacklisted=
   POLICY_file_output_is_blacklisted=
   # Replace/remove all flash files
   POLICY_flash=
   POLICY_legacy_archive_file=
   POLICY_html_file=
   POLICY_iso_file=
   POLICY_office_encrypted=
   # Replace/remove all files with VBA script
   POLICY_office_vbascript=
   # Replace/remove all files with dangerous VBA script (executable, file, network or registry directives)
   POLICY_office_dangerous_vbascript=
   POLICY_shortcut_file=
   ```
   1. Attachment removal based on blacklists only works if the quarantine action for blacklist matches is disabled. If you need help adjusting this setting, contact [support@xorlab.com](mailto:support@xorlab.com).

5. For every use case above, you can specify the text in the replacement file with the following properties:
   ```ini local.properties theme={null}
   # If attachment replacement is enabled, this is the generic fallback text which goes into the text file replacing the file.
   POLICY_attachment_replace_text=This attachment got removed as it violated our security policy.
   # Specific replacement tests:
   POLICY_attachment_replace_text_executable_file=This attachment got removed as it was an executable file and thus violated our security policy.
   POLICY_attachment_replace_text_legacy_archive_file=This attachment got removed as it was an archive and thus considered dangerous.
   POLICY_attachment_replace_text_excessive_nesting=This attachment got removed because of excessive nesting of files.
   POLICY_attachment_replace_text_encrypted_archive_file=This attachment got removed as it was an encrypted archive and thus violated our security policy.
   POLICY_attachment_replace_text_file_extension_is_blacklisted=This attachment got removed as it had a blacklisted file extension.
   POLICY_attachment_replace_text_file_hash_is_blacklisted=This attachment got removed as it was blacklisted.
   POLICY_attachment_replace_text_file_output_is_blacklisted=This attachment got removed as it had a blacklisted file extension.
   POLICY_attachment_replace_text_flash=This attachment got removed as it was a flash file and thus violated our security policy.
   POLICY_attachment_replace_text_html_file=This attachment got removed as it was a html file and thus violated our security policy.
   POLICY_attachment_replace_text_iso_file=This attachment got removed as it was an iso file and thus violated our security policy.
   POLICY_attachment_replace_text_office_encrypted=This attachment got removed as it was an office file with encrypted content and thus violated our security policy.
   POLICY_attachment_replace_text_office_vbascript=This attachment got removed as it was an office file with active content and thus violated our security policy.
   POLICY_attachment_replace_text_shortcut_file=This attachment got removed as it was a shortcut file and thus violated our security policy.
   POLICY_attachment_replace_text_office_dangerous_vbascript=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
   POLICY_attachment_replace_text_malware_dynamic=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
   POLICY_attachment_replace_text_malware_static=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
   POLICY_attachment_replace_text_filter=This attachment got removed as it violated our security policy.
   ```

6. Click **Publish**. The rule-set configuration becomes active within about one minute.