> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Fix a False Negative

> React to a missed threat so that xorlab quarantines similar emails in future.

If you are looking for a more general approach to tune the overall detection, have a look at [Tune Detection](/latest/detection-tuning).

Below we list the most common measures for a false negative and when they should be applied.

<Note>
  **Report Misclassification**

  We recommend to report all false negatives to xorlab via [Reporting a Misclassification](/latest/reporting-misclassification). This helps improving the detection in a sustainable way.
</Note>

## Add sender to blacklist

If you expect more false negatives from the same sender, add its address to the sender blacklist.

**Requirements**:

1. The sender does not send legitimate or wanted emails.

**Action**:

1. Open the email in the detail view.
2. Press <kbd>B</kbd>, or click on the three dots in the upper right and choose **Blacklist**.
3. Select **Sender address blacklist** and save. For the accepted entry formats and how subdomain matching behaves, see [Blacklists](/latest/blacklists).

## Add link to blacklist

If you expect more false negatives with the same phishing link, add the link to the link domain blacklist.

**Requirements**:

1. The link domain is not used in legitimate emails.

**Action**:

1. Open the email in the detail view.
2. Click on the **LINKS** tab.
3. Select the corresponding links and click on **Blacklist**. This adds them to the **Link domain blacklist**, see [Blacklists](/latest/blacklists).

## Create a campaign

Create a campaign when the false negatives cannot be tied to a specific sender, or if a sender might send both legitimate and unwanted emails.

The full guide about campaigns can be found here: [Campaigns](/latest/campaigns).

**Requirements**:

1. None. Campaigns can always be used, but they require a bit more effort for creation and life-cycling.

**Action**:

1. Create a search query that matches all the required false negatives. This can differ a lot from case to case. Some examples:
   1. Use the built-in **content similarity**. This is the go-to method for all false negatives that vary in sender, display name, subject, etc. For this, open the email in the detail view and click on **SIMILAR**.
   2. Often the display name or parts of the subject stays the same through a wave of similar emails. This can be used in a search query like this: `from.displayname:Abc AND subject:"*Password Reset*"`.
   3. Sometimes the attackers re-use some URL patterns in the same wave. This can be leveraged with a query like this: `link:"*/special/url-path/*"`.
2. Create a campaign based on the search and set the action to **Quarantine**. If you use the SSQ, choose the quarantine name such that the end-users can or cannot release the email.