> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Tune Detection
> Fine-tune detection to reduce false positives and false negatives. Intended for analysts.
xorlab detection works out of the box, but you can adjust it to address specific issues or align it with your organization's policies.
## Step-by-step guide
We recommend adding the tag `#tuned` to emails that you performed some tuning actions on. This will help you avoid looking at the same issue twice. You can also supplement every search query with `not #tuned` to exclude these cases from the results.
### 1️⃣ Authentication
| Step | Query | Measures |
| --------------------------------------------------------- | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| Check if some guarded domains are not configured. | `#ext #auth` | Add missing domains to the list of [guarded domains](/latest/before-begin-integration#configure-your-guarded-domains). |
| Check if emails from your organization are not authentic. | `#impersonation or (#senderstguarded #noauth)` | Check [Authentication](/latest/authentication-issues) and [Trusted MTAs](/latest/trusted-mtas) to fix these issues. |
| Check that there are no emails marked as external. | `#ext` | Usually, there should be no external emails left. Clarify if these emails are expected in the organization. |
### 2️⃣ False positive tuning
| Step | Query | Measures |
| ---------------------------------------------------------------------- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Find all false positives. | `#quarantine` | Follow the steps below depending on the verdict. |
| Review false positives with phishing or spam verdicts. | `verdict:phishing or verdict:spam` | - Will this sender gain trust during the learning phase? → No actions required.
- Will this sender never gain trust because they are only inbound? → Add sender to the **Low trusted sender addresses** list (see [Trusted Senders and Infrastructure](/latest/trusted-senders-infrastructure)).
- Is this a specific recipient that frequently needs to receive emails from new senders? → Add recipient to "Exposed public contacts" list.
- Is there a more complex pattern? → Go to [Advanced Tuning](#4️⃣-advanced-tuning).
|
| Check VIP fraud verdicts (often VIPs sending from personal addresses). | `verdict:vipfraud` | Add them to the **VIP sender email whitelist**. |
| Check impersonation verdicts. | `verdict:impersonation` | Fix [missing Authentication](/latest/authentication-issues). |
| Investigate malware verdicts to understand the root cause. | `verdict:malware` | Look at the [Classifiers & Rules](/latest/understand-verdict#get-an-in-depth-understanding) tab.
Common issues are network requests made in the Sandbox. If they have benign reasons like loading a logo from SharePoint, you can add them to **Dynamic DNS request whitelist**. |
| Identify the responsible `FILTER` rule. | `verdict:filter` | Use [Understand Verdicts](/latest/understand-verdict#understanding-verdict-rules) and follow [Advanced Tuning](#4️⃣-advanced-tuning) to decide whether to disable the specific filter rule. |
### 3️⃣ False negative tuning
Use `#inc #untrusted not verdict:reputable not verdict:popular #domainonlyinbound not #quarantine not #dmarcreport` or parts of it to find suspicious emails.
* [Report false negative](/latest/reporting-misclassification) to xorlab.
* Add sender or link to blacklists.
* [Create a campaign](/latest/campaigns).
* Follow [Advanced Tuning](#4️⃣-advanced-tuning) to evaluate if you want to enable or disable specific rules.
### 4️⃣ Advanced tuning
This section explains how to tune individual detection rules for false positives and false negatives by checking impact and changing rule states when needed.
#### False positive tuning
1. Read [Understanding Verdicts](/latest/understand-verdict) to learn what *verdict rules* are and how you can use the *Classifiers & Rules* tab to identify them.
2. Check if multiple false positives in your quarantine are caused by the same verdict rule.
1. To check the impact of this rule, search for `rule:rule-name #quarantine` (see [*Search*](/latest/search#queries-using-rules)).
2. Go through the results to assess the legitimacy of every email. For every true positive that you find, check if any other verdict rules (e.g., `PHISHING_...`) triggered on this email. If so, this email would still be blocked by the other rules. To only see emails that would be delivered after disabling the rule in question, exclude all other occurring verdict rules from the query like this: `rule:verdict_rule-name not rule:verdict_other-rule-name #quarantine`.
3. If you do this and only end up with false positives, you can disable this rule by adding its name appended with `_state=PASSIVE` to `local.properties`, for example `PHISHING_risk_based_one_suspicious_state=PASSIVE`
3. Check if a *passive* **ADAPT\_** rule would match the false positives in your quarantine.
1. To check the impact of this rule, search for `passiverule:ADAPT_rule-name #quarantine` (see [*Search*](/latest/search#queries-using-rules)).
2. Examine the search results to see if the other emails that matched this **ADAPT\_** rule are also false positives that should have been delivered.
3. If the *passive rule* mostly matched false positives, you can activate the rule by adding its name appended with `_state=ACTIVE` to `local.properties`, for example `ADAPT_phishing_confidence_low_based_on_link_with_from_domain_state=ACTIVE`
#### False negative tuning
1. Check if your false negatives are caused by a specific **ADAPT\_** rule.
1. To check the impact of this rule, search for `rule:rule-name #deliver` (see [*Search*](/latest/search#queries-using-rules)).
2. Go through the results to assess the legitimacy of every email. For every true negative that you find, exclude any other active **ADAPT\_** rules that also trigger on the same email from the query like this: `rule:ADAPT_rule-name not rule:ADAPT_other-rule-name #deliver`.
3. If you do this and only end up with false negatives, you can disable this rule by adding its name appended with `_state=PASSIVE` to `local.properties`, for example: `ADAPT_phishing_confidence_high_state=PASSIVE`
2. Check if a *passive* verdict- or **FILTER\_** rule would match your false negatives.
1. To check the impact of this rule, search for `passiverule:VERDICT_rule-name #deliver` (see [*Search*](/latest/search#queries-using-rules)).
2. Examine the search results to see if the other emails that matched this passive rule are also false negatives that should have been quarantined.
3. If the passive rule mostly matched false negatives, you can activate the rule by adding its name appended with `_state=ACTIVE` to `/activeguard/core/rule_sets/90_local/params/local.properties`, for example `PHISHING_risk_based_one_suspicious_state=ACTIVE`