Tune Detection

xorlab detection works out of the box, but you can adjust it to address specific issues or align it with your organization’s policies.

Step-by-step guide

We recommend adding the tag #tuned to emails that you performed some tuning actions on. This will help you avoid looking at the same issue twice. You can also supplement every search query with not #tuned to exclude these cases from the results.

1️⃣ Authentication

Step	Query	Measures
Check if some guarded domains are not configured.	`#ext #auth`	Add missing domains to the list of guarded domains.
Check if emails from your organization are not authentic.	`#impersonation or (#senderstguarded #noauth)`	Check Authentication and Trusted MTAs to fix these issues.
Check that there are no emails marked as external.	`#ext`	Usually, there should be no external emails left. Clarify if these emails are expected in the organization.

2️⃣ False positive tuning

Step	Query	Measures
Find all false positives.	`#quarantine`	Follow the steps below depending on the verdict.
Review false positives with phishing or spam verdicts.	`verdict:phishing or verdict:spam`	Will this sender gain trust during the learning phase? → No actions required. Will this sender never gain trust because they are only inbound? → Add sender to the Low trusted sender addresses list (see Trusted Senders and Infrastructure). Is this a specific recipient that frequently needs to receive emails from new senders? → Add recipient to “Exposed public contacts” list. Is there a more complex pattern? → Go to Advanced Tuning.
Check VIP fraud verdicts (often VIPs sending from personal addresses).	`verdict:vipfraud`	Add them to the VIP sender email whitelist.
Check impersonation verdicts.	`verdict:impersonation`	Fix missing Authentication.
Investigate malware verdicts to understand the root cause.	`verdict:malware`	Look at the Classifiers & Rules tab. Common issues are network requests made in the Sandbox. If they have benign reasons like loading a logo from SharePoint, you can add them to Dynamic DNS request whitelist.
Identify the responsible `FILTER` rule.	`verdict:filter`	Use Understand Verdicts and follow Advanced Tuning to decide whether to disable the specific filter rule.

3️⃣ False negative tuning

Use #inc #untrusted not verdict:reputable not verdict:popular #domainonlyinbound not #quarantine not #dmarcreport or parts of it to find suspicious emails.

Report false negative to xorlab.
Add sender or link to blacklists.
Create a campaign.
Follow Advanced Tuning to evaluate if you want to enable or disable specific rules.

4️⃣ Advanced tuning

This section explains how to tune individual detection rules for false positives and false negatives by checking impact and changing rule states when needed.

False positive tuning

Read Understanding Verdicts to learn what verdict rules are and how you can use the Classifiers & Rules tab to identify them.
Check if multiple false positives in your quarantine are caused by the same verdict rule.
1. To check the impact of this rule, search for rule:rule-name #quarantine (see Search).
2. Go through the results to assess the legitimacy of every email. For every true positive that you find, check if any other verdict rules (e.g., PHISHING_...) triggered on this email. If so, this email would still be blocked by the other rules. To only see emails that would be delivered after disabling the rule in question, exclude all other occurring verdict rules from the query like this: rule:verdict_rule-name not rule:verdict_other-rule-name #quarantine.
3. If you do this and only end up with false positives, you can disable this rule by adding its name appended with _state=PASSIVE to local.properties, for example PHISHING_risk_based_one_suspicious_state=PASSIVE
Check if a passive ADAPT_ rule would match the false positives in your quarantine.
1. To check the impact of this rule, search for passiverule:ADAPT_rule-name #quarantine (see Search).
2. Examine the search results to see if the other emails that matched this ADAPT_ rule are also false positives that should have been delivered.
3. If the passive rule mostly matched false positives, you can activate the rule by adding its name appended with _state=ACTIVE to local.properties, for example ADAPT_phishing_confidence_low_based_on_link_with_from_domain_state=ACTIVE

False negative tuning

Check if your false negatives are caused by a specific ADAPT_ rule.
1. To check the impact of this rule, search for rule:rule-name #deliver (see Search).
2. Go through the results to assess the legitimacy of every email. For every true negative that you find, exclude any other active ADAPT_ rules that also trigger on the same email from the query like this: rule:ADAPT_rule-name not rule:ADAPT_other-rule-name #deliver.
3. If you do this and only end up with false negatives, you can disable this rule by adding its name appended with _state=PASSIVE to local.properties, for example: ADAPT_phishing_confidence_high_state=PASSIVE
Check if a passive verdict- or FILTER_ rule would match your false negatives.
1. To check the impact of this rule, search for passiverule:VERDICT_rule-name #deliver (see Search).
2. Examine the search results to see if the other emails that matched this passive rule are also false negatives that should have been quarantined.
3. If the passive rule mostly matched false negatives, you can activate the rule by adding its name appended with _state=ACTIVE to /activeguard/core/rule_sets/90_local/params/local.properties, for example PHISHING_risk_based_one_suspicious_state=ACTIVE

​Step-by-step guide

​1️⃣ Authentication

​2️⃣ False positive tuning

​3️⃣ False negative tuning

​4️⃣ Advanced tuning

​False positive tuning

​False negative tuning

Step-by-step guide

1️⃣ Authentication

2️⃣ False positive tuning

3️⃣ False negative tuning

4️⃣ Advanced tuning

False positive tuning

False negative tuning