Notifications Overview

xorlab can send email notifications to your end-users in the following situations:

The user reports an email and will then get a feedback email from xorlab
Quarantine notifications - for example daily digests
When configured via custom rules

This page provides an overview over the existing templates that are used for the above purposes. To change or extend the built-in templates, have a look at Template Customizations.

Available Templates

The table below lists the built-in notification templates.

Email notification	Description
`BEC`	For reports of business email compromise attacks
`BENIGN`	For reports of emails that do not contain anything suspicious
`CLOUD_STORAGE`	For reports of emails that contain a link to a cloud storage service
`EXTORTION`	For reports of extortion emails
`IMPERSONATION`	For reports of impersonation attacks
`POLICY_VIOLATION`	For reports of emails that violate company policies
`MALICIOUS`	For reports of emails that are suspicious
`MALWARE`	For reports of emails with an attachment that contains malware
`MARKETING`	For reports of emails of marketing newsletters
`PHISHING`	For reports of phishing emails
`REPORT_NOTIFICATION_ACKNOWLEDGEMENT`	To notify the user that xorlab received their report
`REPORT_NOTIFICATION_ERROR`	To notify the user that their report is missing a message to analyze
`SIMULATION`	For reports that are part of awareness campaigns
`SPAM`	For reports of spam emails
`USER_QUARANTINE_DIGEST`	To notify the user that xorlab quarantined multiple emails and put them into the SSQ
`USER_QUARANTINE_NOTIFICATION`	To notify the user that xorlab quarantined an email and put it into the SSQ
`VIP_FRAUD`	For reports of email attacks that impersonate people of your organization
`QUARANTINE_NOTIFICATION_IN`	Used for verdict-based quarantine notifications. Deprecated feature.

Example Emails

While all templates share the same structure, they differ in text and color depending on the type of notification. Below are a few examples:

BENIGN

PHISHING

REPORT_NOTIFICATION_ACKNOWLEDGEMENT

USER_QUARANTINE_DIGEST

Directory structure

Email notification templates are stored in the shared/email_templates directory, accessible via the Expert Editor.

Folder Structure

  shared/email_templates
  ├── BEC.yml                              # Template configuration files.
  ├── [... other templates ...]
  ├── config
  │   └── default.yml                # Default language settings
  |                                        
  ├── info
  │   └── default.yml                # Company information for footers
  |                                        
  ├── locale
  |   └── default_it.yml             # Italian localization file.
  |   └── default_fr.yml             # French localization file.
  │   └── default_de.yml             # German localization file.
  |   └── default_en.yml             # English localization file.
  |                                        
  ├── style
  │   └── default.yml                # Branding and styling
  |                                        
  ├── [... other templates ...]
  └── VIP_FRAUD.yml

Folder Descriptions

config – Defines the default language for notifications.
locale – Contains localized strings for different languages.
style – Controls visual elements such as colors, fonts, and logos.
info – Stores organization details like name, contact email, and links, used in the footers.
Template files – Each template (e.g., BEC.yml, PHISHING.yml) contains its configuration.

Multi-Tenancy Support

If your organization uses multiple tenants, you can customize templates per tenant. Tenant-specific customizations are controlled by the emailTemplateStyle attribute. By default, templates apply as default to all tenants, but you can introduce unique identifiers to manage styles, localization, and branding for other tenants. For more information, have a look at Customize Tenant Notifications.

​Available Templates

​Example Emails

​BENIGN

​PHISHING

​REPORT_NOTIFICATION_ACKNOWLEDGEMENT

​USER_QUARANTINE_DIGEST

​Directory structure

​Folder Structure

​Folder Descriptions

​Multi-Tenancy Support