> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Evaluate xorlab

> For teams who have not decided yet: how a trial is set up, how long each phase takes, and what you can measure the results against before anything is blocked.

You can find out what xorlab catches without committing to it. The platform runs alongside the filtering you already have, analyzes your real email traffic, and reports what it would have done — no MX record change, no software on your servers, and no email blocked until you decide it should be.

The setup is short. Most of the trial is you reading results.

## How a trial runs

<div className="eval-timeline">
  <div className="eval-phase">
    <p className="eval-when">Day 0</p>

    <p className="eval-what">Decide where xorlab runs</p>

    Two deployment options, you get the same results for both:

    * **xorlab SaaS** — hosted and operated by xorlab. Nothing to provision, so it is the quickest way into a trial.
    * **On-premises** — you run the xorlab Control Center (XCC) and one or more xorlab MTAs on your own virtual infrastructure.
  </div>

  <div className="eval-phase">
    <p className="eval-when">Day 1</p>

    <p className="eval-what">Ask for an instance</p>

    Write to [sales@xorlab.com](mailto:sales@xorlab.com). Your own trial instance can be ready as early as the next working day.
  </div>

  <div className="eval-phase">
    <p className="eval-when">Day 1</p>

    <p className="eval-what">Connect your email flow</p>

    You choose how far into the mail flow xorlab goes. Both options are reversible in minutes, and neither touches your MX records:

    * **Monitoring Mode** — xorlab receives a copy of every email as an additional BCC recipient and drops it after the analysis.
    * **Inline Mode** — xorlab sits in the mail flow but delivers every email anyway, including the ones it would have quarantined.
  </div>

  <div className="eval-phase">
    <p className="eval-when">Day 1–2 on M365</p>

    <p className="eval-what">Finish the learning phase</p>

    The [Relationship](/latest/concepts-relationship) model and [Local Reputation](/latest/concepts-local-reputation) have to observe your traffic before detection can rely on them. On M365 xorlab bootstraps the process by importing the past months of email from the mailboxes and analyzes them. The import runs before you connect the mail flow. Without M365, expect the models to start settling in after some days.
  </div>

  <div className="eval-phase">
    <p className="eval-when">Once it has learned</p>

    <p className="eval-what">See what is getting through</p>

    xorlab assigns a [verdict](/latest/verdicts) and a confidence to every email, and assigns categories to the malicious ones: Phishing, Malware, BEC, VIP Fraud, Impersonation, Extortion, Spam, etc. are separate verdicts you can filter and count. Because nothing is blocked yet, each one is a message that reached the mailbox regardless of what you run today.

    For any of them, xorlab shows the indicators and reasoning behind the decision — see [Understanding an Email Verdict](/latest/understand-verdict).
  </div>

  <div className="eval-phase">
    <p className="eval-when">Two weeks</p>

    <p className="eval-what">Compare it with what you run today</p>

    We recommend two weeks of side-by-side traffic: long enough to cover the weekly rhythm of your mail, short enough that the trial does not stall. Compare it either way:

    * **In xorlab** — search the traffic, save what you are tracking as a saved search, and export it to work through outside the platform.
    * **In your SIEM** — stream the verdicts and the analysis results extracted over Syslog, then put them next to what your existing controls reported.

    Write to [support@xorlab.com](mailto:support@xorlab.com) and we will go through the evaluation with you.
  </div>

  <div className="eval-phase">
    <p className="eval-when">Along the way</p>

    <p className="eval-what">Tune it to your own risk appetite</p>

    You can shift the balance between catching more and flagging less, and correct individual decisions as they come up — see [Fix a False Positive](/latest/fix-false-positives) and [Fix a False Negative](/latest/fix-false-negatives).
  </div>

  <div className="eval-phase">
    <p className="eval-when">Go live</p>

    <p className="eval-what">Switch protection on</p>

    When the results convince you, protection is a configuration change rather than a new project. If you ran in Inline Mode, enabling a switch is all it takes, and quarantining is active about a minute later. From Monitoring Mode, you switch to Inline Mode first. Nothing else about the integration changes.
  </div>
</div>

## Two ways to connect your mail flow

Both let you evaluate on live traffic without blocking anything. The difference is how much of the final setup you have already built by the end of the trial.

|                           | Monitoring Mode                                                     | Inline Mode                                                      |
| :------------------------ | :------------------------------------------------------------------ | :--------------------------------------------------------------- |
| Where xorlab sits         | Out of band. It receives a BCC copy and drops it after the analysis | In the mail flow. Every email passes through and is forwarded on |
| Your mail flow            | Untouched                                                           | Carries one more hop                                             |
| MX records                | Unchanged                                                           | Unchanged, unless xorlab replaces your gateway on premises       |
| What users notice         | Nothing at all                                                      | Nothing at all                                                   |
| Import of past M365 email | Available                                                           | Available                                                        |
| Going live afterward      | Requires switching to Inline Mode                                   | Just activate a parameter                                        |
| Pick it when              | Any change to the mail flow needs its own approval                  | You want the trial to end in one configuration change            |

## What the trial does not touch

* **Your MX records.** On M365, email keeps arriving at Microsoft, which hands it to xorlab and takes it back for delivery.
* **Your current filtering.** Your existing filters keep running. xorlab is layered on top, which is what makes the comparison possible.
* **Your servers, clients and mailboxes.** Nothing is installed and nothing is migrated. Reporting uses the button your users already have.
* **Your outbound sending identity.** On M365, outgoing email still leaves through Microsoft, so SPF and DKIM stay as they are. Same for on-premises.

Ready to see it on your own traffic? Write to [sales@xorlab.com](mailto:sales@xorlab.com).