Skip to main content
If you are looking for a more general approach to tune the overall detection, have a look at Tune Detection. Most false positives can be resolved by following the primary measures below in order. However, in certain special cases (described in the second part), you may need to use a special approach.
Report MisclassificationWe recommend to report all false positives to xorlab via Reporting a Misclassification, where possible. This helps improving the detection in a sustainable way.

​
Primary measures

​
1️⃣Let the system handle it

xorlab learns whenever an email is released from the quarantine. It will reduce the chance that the next email from the same sender will be quarantined again.
Auto-learningFor a specific sender: The more emails are released, the less aggressive the detection is for that sender. However, it will never fully disable all checks.
Therefore the first step is to just release the email from the quarantine, and this might fix the false positive. Requirements:
  1. The sender needs to have authentication (#auth).
  2. The false positives must come from the same sender address.
Action:
  1. Release the email from quarantine.

​
2️⃣Add sender to the low trusted sender list

This is the go-to action for most situations that do not resolve on its own. It will reduce the phishing and spam detection for that sender to a minimum, but keeps malware and BEC rules still active. For the full list of trust levels and what each one changes, see Trusted Senders and Infrastructure. Requirements:
  1. The sender needs to have authentication (#auth).
  2. You do not expect to receive malicious emails from there.
  3. It is not a BEC or malware false positive. (1)
  4. Some of the more aggressive malware rules will also be deactivated by the Low trusted sender list. Therefore in some cases the list also works for malware verdicts.
Action:
  1. Open the email in the detail view.
  2. Press W, or click on the three dots in the upper right and choose Whitelist.
  3. Select Low trusted sender addresses and save.

​
3️⃣ Create a campaign

Campaign are used when the requirements for the Low trusted sender list are not fulfilled. It allows you to let through very specific emails by creating a search that matches only the desired emails. The full guide about campaigns can be found here: Campaigns.
Campaigns overwrite built-in detectionA campaign overwrites all built-in detections, therefore be careful with campaigns that set the action to Deliver. They should be as narrow as possible to only match the desired emails.
Requirements:
  1. None. Campaigns can always be used, but they require a bit more effort for creation and life-cycling.
Action:
  1. Find aspects of the email that are present in all of the false positives. Examples are: subject keywords, display name, sender address, etc.
  2. Create a search query that is as specific as possible and only matches the false positives. Examples: from:sender@example.com AND subject:*Notification*.
  3. Create a campaign for that search query and set the action to Deliver.
    1. Tip: You can still exclude certain verdicts from the Deliver campaign, for example to exclude malware: from:sender@example.com AND subject:*Notification* AND NOT #malware.

​
Special cases

​
Malware false positives with #networkactivity

If an attachment makes suspicious DNS requests in the Sandbox, the email might be quarantined even though it is legitimate. In such cases, you can allow specific domains for DNS requests. Requirements:
  1. The malware false positive needs to have the tag #networkactivity.
Action:
  1. For the affected email, open the Attachments tab and click on the attachment with the red Sandbox symbol.
  2. In the new dialog, copy the domain marked as SUSPICIOUS in the Network tab.
  3. Go to Settings → Lists → Whitelists and add the domain to the Dynamic DNS request whitelist, see Whitelists.