> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Review Static Policies

> The static policies enforced on every email regardless of relationship or context, and the Filter quarantine they trigger.

Below you find the static policies that are active by default. Normally, they do not need to be changed.

<Accordion title="Disabling a static policy">
  To disable one of the static policies below, add a corresponding line to `local.properties`:

  ```ini local.properties theme={null}
  # Syntax: <Rule name>_state=PASSIVE
  FILTER_iso_state=PASSIVE
  ```
</Accordion>

| Static policy (`FILTER` rule)                        | Description                                                                                                                                          |
| :--------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- |
| `FILTER_executable`                                  | Quarantine all emails with executable files                                                                                                          |
| `FILTER_flash`                                       | Quarantine all emails with flash files                                                                                                               |
| `FILTER_iso`                                         | Quarantine all emails with ISO files                                                                                                                 |
| `FILTER_legacy_archive`                              | Quarantine all emails with archive files that are considered legacy                                                                                  |
| `FILTER_shortcut`                                    | Quarantine all emails with shortcut files                                                                                                            |
| `FILTER_windows_script`                              | Quarantine all emails with windows scripts                                                                                                           |
| `FILTER_office_dde`                                  | Quarantine all emails with Office documents containing Dynamic Data Exchange (DDE) fields                                                            |
| `FILTER_office_external_frame`                       | Quarantine all emails with Office documents containing external frame(s)                                                                             |
| `FILTER_office_external_webvideo`                    | Quarantine all emails with Office documents containing external videos                                                                               |
| `FILTER_wwwdata_sender`                              | Quarantine all emails where the sender’s FROM address is matched by this regex: `.*www-data.*`                                                       |
| `FILTER_UNTRUSTED_new_file_type_from_unknown_sender` | Quarantine all emails from unknown senders that contain new file types. A new file type means that it has not been seen yet in trusted communication |

<Info>
  The file extensions blocked by each static policy are documented in
  [Detection Defaults → Static policy file extensions](/latest/detection-defaults#static-policy-file-extensions).
  Access to that page is restricted.
</Info>

**Malware rules still apply**: Even if the above static policies (filters) are disabled, xorlab will still block the majority of their associated file types because of the built-in malware rules. Malware rules depend on the relationship, for example they might block a script file from an untrusted sender, but allow it from a partner. With the static policy, you can enforce blocking it independently of the relationship.