> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Notifications Overview
> When xorlab sends end-user notifications: report feedback, quarantine digests, and custom notifications.
xorlab can send email notifications to your end-users in the following situations:
* The user reports an email and will then get a feedback email from xorlab
* Quarantine notifications - for example daily digests
* When configured via custom rules
This page provides an overview over the existing templates that are used for the above purposes. To change or extend the built-in templates, have a look at [Template Customizations](/latest/email-template-modifications).
## Available Templates
The table below lists the built-in notification templates.
| Email notification | Description |
| ------------------------------------- | ------------------------------------------------------------------------------------ |
| `BEC` | For reports of business email compromise attacks |
| `BENIGN` | For reports of emails that do not contain anything suspicious |
| `CLOUD_STORAGE` | For reports of emails that contain a link to a cloud storage service |
| `EXTORTION` | For reports of extortion emails |
| `IMPERSONATION` | For reports of impersonation attacks |
| `POLICY_VIOLATION` | For reports of emails that violate company policies |
| `MALICIOUS` | For reports of emails that are suspicious |
| `MALWARE` | For reports of emails with an attachment that contains malware |
| `MARKETING` | For reports of emails of marketing newsletters |
| `PHISHING` | For reports of phishing emails |
| `REPORT_NOTIFICATION_ACKNOWLEDGEMENT` | To notify the user that xorlab received their report |
| `REPORT_NOTIFICATION_ERROR` | To notify the user that their report is missing a message to analyze |
| `SIMULATION` | For reports that are part of awareness campaigns |
| `SPAM` | For reports of spam emails |
| `USER_QUARANTINE_DIGEST` | To notify the user that xorlab quarantined multiple emails and put them into the SSQ |
| `USER_QUARANTINE_NOTIFICATION` | To notify the user that xorlab quarantined an email and put it into the SSQ |
| `VIP_FRAUD` | For reports of email attacks that impersonate people of your organization |
| `QUARANTINE_NOTIFICATION_IN` | Used for verdict-based quarantine notifications. Deprecated feature. |
## Example Emails
While all templates share the same structure, they differ in text and color depending on the type of notification. Below are a few examples:
### BENIGN
### PHISHING
### REPORT\_NOTIFICATION\_ACKNOWLEDGEMENT
### USER\_QUARANTINE\_DIGEST
## Directory structure
Email notification templates are stored in the `shared/email_templates` directory, accessible via the [Expert Editor](/latest/expert-editor).
## Folder Structure
```text theme={null}
shared/email_templates
├── BEC.yml # Template configuration files.
├── [... other templates ...]
├── config
│ └── default.yml # Default language settings
|
├── info
│ └── default.yml # Company information for footers
|
├── locale
| └── default_it.yml # Italian localization file.
| └── default_fr.yml # French localization file.
│ └── default_de.yml # German localization file.
| └── default_en.yml # English localization file.
|
├── style
│ └── default.yml # Branding and styling
|
├── [... other templates ...]
└── VIP_FRAUD.yml
```
## Folder Descriptions
* `config` – Defines the default language for notifications.
* `locale` – Contains localized strings for different languages.
* `style` – Controls visual elements such as colors, fonts, and logos.
* `info` – Stores organization details like name, contact email, and links, used in the footers.
* Template files – Each template (e.g., `BEC.yml`, `PHISHING.yml`) contains its configuration.
## Multi-Tenancy Support
If your organization uses multiple tenants, you can customize templates per tenant. Tenant-specific customizations are controlled by the `emailTemplateStyle` attribute. By default, templates apply as `default` to all tenants, but you can introduce unique identifiers to manage styles, localization, and branding for other tenants.
For more information, have a look at [Customize Tenant Notifications](/latest/multi-tenancy-email-templates).