Skip to main content
In the following code blocks, we are referring to the templateDomain property (not a variable) which is configured in the activeguard/core/active_guard.yml file. For SaaS customers, this domain is provided by xorlab as a part of the onboarding. In case of on-premises xorlab, this domain has been setup as a part of the VM Setup Guide.

​
Feedback emails

Feedback emails are sent after a user reports a suspicious email. They can be manually triggered by an analyst through resolving a case as well as automatically generated through a campaign or an auto-close rule. By default, these emails are send from threatanalyst@<templateDomain>, with templateDomain referring to the property that’s set in active_guard.yml. If you like to customize the sender address, add the following block (if it does not already exist) to the activeguard/core/active_guard.yml file:
Afterward, click Publish, then restart all MTAs. The emailReporting setting in active_guard.yml requires an MTA restart; see How to Activate the Configuration.

​
SMTP auth for feedback emails

If you want the feedback emails to be sent to an SMTP server requiring authentication, please follow the steps outlined in SMTP auth for specific email addresses.

​
Quarantine notifications

Quarantine notifications are sent to the end-user when an email addressed to them has been put in quarantine. By default, these emails are send from quarantine@<templateDomain>, with templateDomain referring to the property that’s set in active_guard.yml. If you like to customize the sender address, add the following block (if it does not already exist) to the activeguard/core/active_guard.yml file:
Afterward, click Publish, then restart all MTAs. The mailDelivery setting in active_guard.yml requires an MTA restart; see How to Activate the Configuration.

​
Custom bounce and notification messages

The xorlab Security Platform rule language allows configuring custom bounce or notification messages that are triggered for certain events (for example, when using the rule context keys SenderNotification.Template or ReceiverNotification.Template). By default, these emails are send from notification@<templateDomain>, with templateDomain referring to the property that’s set in active_guard.yml. If you like to customize the sender address, add the following block (if it does not already exist) to the activeguard/core/active_guard.yml file:
Afterward, click Publish, then restart all MTAs. The mailDelivery setting in active_guard.yml requires an MTA restart; see How to Activate the Configuration.