Ready to start the integration? Go to Integration Overview — the ordered guide through the standard xorlab integration. Come back here when you want to connect a further system.
Mail Flow
Route or mirror email through xorlab in Microsoft 365, on-premises, or hybrid environments.
Connect a SIEM
Stream verdicts, threat intelligence, and the full audit trail to Splunk, Sentinel, QRadar, Elastic, and others.
Automate with a SOAR
Drive xorlab from your playbooks over REST, and trigger playbooks from xorlab events.
Identity & SSO
SAML 2.0 and LDAP against Entra ID, Active Directory, or any standards-compliant IdP.
Microsoft 365 & Graph
Case isolation, retrospective scanning, the built-in Report button, and contextual banners.
Threat Intelligence
Enrich analysis and investigation with VirusTotal and Spamhaus DQS.
Awareness Training
Let any phishing simulation service through to the inbox without weakening detection.
Operational Monitoring
On-premises only: ship platform health alerts to email, Slack, webhooks, or any Alertmanager receiver.
Interfaces at a glance
Mail flow (SMTP)
xorlab sits in your mail flow over plain SMTP, which is what makes it deployable in front of, behind, or alongside almost any mail infrastructure — Microsoft 365, Exchange, or any standards-compliant MTA or gateway. Two protection modes are supported, and both are available in all deployment variants (on-premises, hybrid, and SaaS):- Inline mode: all email is routed through xorlab, which can block, quarantine, and rewrite.
- Monitoring mode: xorlab receives a copy of every email and discards it after analysis. Nothing is blocked.
Microsoft 365
Connectors, inline or monitoring mode, and the optional Graph-based features. Includes the mail flow diagrams.
On-premises
Exchange, Cisco ESA, and other gateways, as a gateway or as an add-on. Includes the mail flow diagrams.
Inline vs. Monitoring
What each mode can and cannot do, and how to switch between them later.
Advanced SMTP
Multiple next hops, per-domain routing, TLS enforcement, and trusted MTAs.
SIEM and log management
Every relevant thing that happens in xorlab is a log event: the verdict for each message, each SMTP transaction, threat intelligence indicators extracted from malicious mail, and the complete analyst and admin audit trail. Events are emitted over Syslog in JSON or CEF, so any SIEM can consume them without a dedicated connector.Connect a SIEM
Which events to send, which format to choose, and where to look in the documentation of Splunk, Microsoft Sentinel, QRadar, Elastic, Graylog, and others.
SOAR and automation
Automation works in both directions. xorlab pushes events out over Syslog, and your playbooks call back into xorlab over a REST API. Use that, for example, to add a confirmed phishing sender to a Blacklist without anyone logging into the web interface.Automate with a SOAR
Event triggers, the List API as the action surface, worked playbook patterns, and the API key model.
List API
Read, add, and remove entries on any list, including custom lists. Scoped API keys, multi-tenant aware.
Email Scanning API
Submit a message over HTTP and get the analysis result back synchronously.
Identity and single sign-on
xorlab does not maintain its own user directory unless you want it to. Admins, analysts, and end users authenticate against your identity provider, and roles are mapped from the attributes it returns, including tenant-restricted roles in multi-tenant deployments.
Several methods can be active at the same time — for example SAML for the SOC and Auto-Login for end users. See Authentication Overview.
Microsoft 365 and Microsoft Graph
Beyond mail flow, xorlab integrates with Microsoft 365 through a single Entra ID app registration and Exchange Online mail flow rules.Threat intelligence
xorlab also exports threat intelligence: the
ti.* log events emit malicious sender addresses, sending IPs, attachment hashes, domains, and URLs observed in your own mail, ready to be consumed by your SIEM or fed into other controls. See Connect a SIEM.
Security awareness and phishing simulation
Any awareness training or phishing simulation service can be allowed through, regardless of vendor. Add its distinctive mark to the Simulation lists, ideally the sending IP range, and simulated attacks reach the inbox and are taggedverdict:simulation.
Phishing Simulation
Which identifiers to use, and why matching on the connecting IP is safer than matching on a header.
Operational monitoring and alerting
On-premises deployments onlyIf you run xorlab as SaaS, xorlab operates and monitors the platform for you. Subscribe to the status page for scheduled maintenance and incidents.
Enable Alerts
Configure receivers and route alerts by severity.
Operational alerting is for platform health. To get email security events into another system, use Syslog instead.
Don’t see your product?
That is usually not a problem. xorlab integrates through standard protocols rather than per-vendor connectors, so the question is which interface your product speaks:- It can receive Syslog, or an agent of yours can read a log file → see Connect a SIEM.
- It can make an HTTP request → see Automate with a SOAR.
- It is a mail gateway or mail server → see Mail flow (SMTP).
- It is an identity provider that supports SAML 2.0 or LDAP → see Authentication Overview.