> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Fix a False Positive

> React to a wrongly quarantined email so that xorlab stops quarantining that kind of message.

If you are looking for a more general approach to tune the overall detection, have a look at [Tune Detection](/latest/detection-tuning).

Most false positives can be resolved by following the primary measures below in order. However, in certain special cases (described in the second part), you may need to use a special approach.

<Note>
  **Report Misclassification**

  We recommend to report all false positives to xorlab via [Reporting a Misclassification](/latest/reporting-misclassification), where possible. This helps improving the detection in a sustainable way.
</Note>

## Primary measures

### 1️⃣Let the system handle it

xorlab learns whenever an email is released from the quarantine. It will reduce the chance that the next email from the same sender will be quarantined again.

<Note>
  **Auto-learning**

  For a specific sender: The more emails are released, the less aggressive the detection is for that sender. However, it will never fully disable all checks.
</Note>

Therefore the first step is to just release the email from the quarantine, and this might fix the false positive.

**Requirements**:

1. The sender needs to have authentication (`#auth`).
2. The false positives must come from the same sender address.

**Action**:

1. Release the email from quarantine.

### 2️⃣Add sender to the low trusted sender list

This is the go-to action for most situations that do not resolve on its own. It will reduce the phishing and spam detection for that sender to a minimum, but keeps malware and BEC rules still active. For the full list of trust levels and what each one changes, see [Trusted Senders and Infrastructure](/latest/trusted-senders-infrastructure).

**Requirements**:

1. The sender needs to have authentication (`#auth`).
2. You do not expect to receive malicious emails from there.
3. It is not a BEC or malware false positive. (1)
4. Some of the more aggressive malware rules will also be deactivated by the *Low trusted sender* list. Therefore in some cases the list also works for malware verdicts.

**Action**:

1. Open the email in the detail view.
2. Press <kbd>W</kbd>, or click on the three dots in the upper right and choose **Whitelist**.
3. Select **Low trusted sender addresses** and save.

### 3️⃣ Create a campaign

Campaign are used when the requirements for the *Low trusted sender* list are not fulfilled. It allows you to let through very specific emails by creating a search that matches only the desired emails. The full guide about campaigns can be found here: [Campaigns](/latest/campaigns).

<Warning>
  **Campaigns overwrite built-in detection**

  A campaign overwrites all built-in detections, therefore be careful with campaigns that set the action to **Deliver**. They should  be as narrow as possible to only match the desired emails.
</Warning>

**Requirements**:

1. None. Campaigns can always be used, but they require a bit more effort for creation and life-cycling.

**Action**:

1. Find aspects of the email that are present in all of the false positives. Examples are: subject keywords, display name, sender address, etc.
2. Create a search query that is as specific as possible and only matches the false positives. Examples: `from:sender@example.com AND subject:*Notification*`.
3. Create a campaign for that search query and set the action to **Deliver**.
   1. Tip: You can still exclude certain verdicts from the Deliver campaign, for example to exclude malware: `from:sender@example.com AND subject:*Notification* AND NOT #malware`.

## Special cases

### Malware false positives with #networkactivity

If an attachment makes suspicious DNS requests in the Sandbox, the email might be quarantined even though it is legitimate. In such cases, you can allow specific domains for DNS requests.

**Requirements**:

1. The malware false positive needs to have the tag `#networkactivity`.

**Action**:

1. For the affected email, open the **Attachments** tab and click on the attachment with the red Sandbox symbol.
2. In the new dialog, copy the domain marked as `SUSPICIOUS` in the **Network** tab.
3. Go to **Settings → Lists → Whitelists** and add the domain to the **Dynamic DNS request whitelist**, see [Whitelists](/latest/whitelists).