Skip to main content
If you are looking for a more general approach to tune the overall detection, have a look at Tune Detection. Below we list the most common measures for a false negative and when they should be applied.
Report MisclassificationWe recommend to report all false negatives to xorlab via Reporting a Misclassification. This helps improving the detection in a sustainable way.

​
Add sender to blacklist

If you expect more false negatives from the same sender, add its address to the sender blacklist. Requirements:
  1. The sender does not send legitimate or wanted emails.
Action:
  1. Open the email in the detail view.
  2. Press B, or click on the three dots in the upper right and choose Blacklist.
  3. Select Sender address blacklist and save. For the accepted entry formats and how subdomain matching behaves, see Blacklists.
If you expect more false negatives with the same phishing link, add the link to the link domain blacklist. Requirements:
  1. The link domain is not used in legitimate emails.
Action:
  1. Open the email in the detail view.
  2. Click on the LINKS tab.
  3. Select the corresponding links and click on Blacklist. This adds them to the Link domain blacklist, see Blacklists.

​
Create a campaign

Create a campaign when the false negatives cannot be tied to a specific sender, or if a sender might send both legitimate and unwanted emails. The full guide about campaigns can be found here: Campaigns. Requirements:
  1. None. Campaigns can always be used, but they require a bit more effort for creation and life-cycling.
Action:
  1. Create a search query that matches all the required false negatives. This can differ a lot from case to case. Some examples:
    1. Use the built-in content similarity. This is the go-to method for all false negatives that vary in sender, display name, subject, etc. For this, open the email in the detail view and click on SIMILAR.
    2. Often the display name or parts of the subject stays the same through a wave of similar emails. This can be used in a search query like this: from.displayname:Abc AND subject:"*Password Reset*".
    3. Sometimes the attackers re-use some URL patterns in the same wave. This can be leveraged with a query like this: link:"*/special/url-path/*".
  2. Create a campaign based on the search and set the action to Quarantine. If you use the SSQ, choose the quarantine name such that the end-users can or cannot release the email.