> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# What xorlab Connects To

> Which systems xorlab integrates with and over which interface: SMTP mail flow, Syslog to SIEM, REST APIs for SOAR and automation, SAML and LDAP identity, Microsoft Graph, and threat intelligence.

xorlab is built on open, standardized interfaces. You install no proprietary agent and you wait for no vendor-specific connector: if your platform speaks **SMTP**, **Syslog**, **HTTPS/REST**, **SAML**, or **LDAP**, it can be integrated with xorlab today.

Use this page to check whether a system in your stack is covered, and to find the guide that covers it. Each section links into the step-by-step instructions under [Admin Configuration](/latest/setup-integration-overview).

<Note>
  Ready to start the integration? Go to [Integration Overview](/latest/setup-integration-overview) — the ordered guide through the standard xorlab integration. Come back here when you want to connect a further system.
</Note>

<CardGroup cols={2}>
  <Card title="Mail Flow" icon="envelope" href="#mail-flow-smtp">
    Route or mirror email through xorlab in Microsoft 365, on-premises, or hybrid environments.
  </Card>

  <Card title="Connect a SIEM" icon="scroll" href="#siem-and-log-management">
    Stream verdicts, threat intelligence, and the full audit trail to Splunk, Sentinel, QRadar, Elastic, and others.
  </Card>

  <Card title="Automate with a SOAR" icon="hexagon-nodes" href="#soar-and-automation">
    Drive xorlab from your playbooks over REST, and trigger playbooks from xorlab events.
  </Card>

  <Card title="Identity & SSO" icon="user-check" href="#identity-and-single-sign-on">
    SAML 2.0 and LDAP against Entra ID, Active Directory, or any standards-compliant IdP.
  </Card>

  <Card title="Microsoft 365 & Graph" icon="microsoft" href="#microsoft-365-and-microsoft-graph">
    Case isolation, retrospective scanning, the built-in Report button, and contextual banners.
  </Card>

  <Card title="Threat Intelligence" icon="virus" href="#threat-intelligence">
    Enrich analysis and investigation with VirusTotal and Spamhaus DQS.
  </Card>

  <Card title="Awareness Training" icon="person-running" href="#security-awareness-and-phishing-simulation">
    Let any phishing simulation service through to the inbox without weakening detection.
  </Card>

  <Card title="Operational Monitoring" icon="sensor-alert" href="#operational-monitoring-and-alerting">
    On-premises only: ship platform health alerts to email, Slack, webhooks, or any Alertmanager receiver.
  </Card>
</CardGroup>

## Interfaces at a glance

| Interface                                     | Direction               | Used for                                                                                                                              |
| :-------------------------------------------- | :---------------------- | :------------------------------------------------------------------------------------------------------------------------------------ |
| SMTP (with TLS)                               | Inbound and outbound    | Mail flow, notifications, reported email, log delivery by email                                                                       |
| Syslog (UDP, TCP, TLS — RFC 3164 or RFC 5424) | xorlab → your system    | SIEM, log management, SOAR event triggers                                                                                             |
| HTTPS / REST                                  | Your system → xorlab    | [List API](/latest/api-rule-list-management) for automated list management, [Email Scanning API](/latest/abby) for on-demand analysis |
| Log files (on-premises only)                  | xorlab → your collector | Log shippers and agents that tail files                                                                                               |
| SAML 2.0                                      | xorlab → your IdP       | Single sign-on for admins, analysts, and end users                                                                                    |
| LDAP                                          | xorlab → your directory | Login against Active Directory                                                                                                        |
| Microsoft Graph                               | xorlab → M365           | Case isolation, retrospective scanning, move to quarantine                                                                            |
| DNS                                           | xorlab → resolver       | Sender authentication and DNS-based blocklists such as Spamhaus DQS                                                                   |

## Mail flow (SMTP)

xorlab sits in your mail flow over plain SMTP, which is what makes it deployable in front of, behind, or alongside almost any mail infrastructure — Microsoft 365, Exchange, or any standards-compliant MTA or gateway.

Two protection modes are supported, and both are available in all deployment variants (on-premises, hybrid, and SaaS):

* **Inline mode**: all email is routed through xorlab, which can block, quarantine, and rewrite.
* **Monitoring mode**: xorlab receives a copy of every email and discards it after analysis. Nothing is blocked.

Each path guide below ends with architecture diagrams of every supported topology for that path, so you can match your environment before you start.

<CardGroup cols={2}>
  <Card title="Microsoft 365" icon="microsoft" href="/latest/m365-integration-overview">
    Connectors, inline or monitoring mode, and the optional Graph-based features. Includes the [mail flow diagrams](/latest/m365-integration-overview#inline-mode-diagrams).
  </Card>

  <Card title="On-premises" icon="server" href="/latest/on-prem-integration-overview">
    Exchange, Cisco ESA, and other gateways, as a gateway or as an add-on. Includes the [mail flow diagrams](/latest/on-prem-integration-overview#inline-mode-diagrams).
  </Card>

  <Card title="Inline vs. Monitoring" icon="network-wired" href="/latest/inline-and-monitoring-mode">
    What each mode can and cannot do, and how to switch between them later.
  </Card>

  <Card title="Advanced SMTP" icon="share-nodes" href="/latest/smtp-configuration">
    Multiple next hops, per-domain routing, TLS enforcement, and trusted MTAs.
  </Card>
</CardGroup>

The documented on-premises guides cover Exchange and Cisco ESA, but the interface is plain SMTP: any other MTA or secure email gateway can take their place. If yours is not covered by a guide, contact [support@xorlab.com](mailto:support@xorlab.com) and we will walk you through it.

## SIEM and log management

Every relevant thing that happens in xorlab is a log event: the verdict for each message, each SMTP transaction, threat intelligence indicators extracted from malicious mail, and the complete analyst and admin audit trail. Events are emitted over Syslog in JSON or CEF, so any SIEM can consume them without a dedicated connector.

<Card title="Connect a SIEM" icon="scroll" horizontal href="/latest/integrations-siem">
  Which events to send, which format to choose, and where to look in the documentation of Splunk, Microsoft Sentinel, QRadar, Elastic, Graylog, and others.
</Card>

## SOAR and automation

Automation works in both directions. xorlab pushes events out over Syslog, and your playbooks call back into xorlab over a REST API. Use that, for example, to add a confirmed phishing sender to a Blacklist without anyone logging into the web interface.

<Card title="Automate with a SOAR" icon="hexagon-nodes" horizontal href="/latest/integrations-soar">
  Event triggers, the List API as the action surface, worked playbook patterns, and the API key model.
</Card>

<CardGroup cols={2}>
  <Card title="List API" icon="list-check" href="/latest/api-rule-list-management">
    Read, add, and remove entries on any list, including custom lists. Scoped API keys, multi-tenant aware.
  </Card>

  <Card title="Email Scanning API" icon="code" href="/latest/abby">
    Submit a message over HTTP and get the analysis result back synchronously.
  </Card>
</CardGroup>

## Identity and single sign-on

xorlab does not maintain its own user directory unless you want it to. Admins, analysts, and end users authenticate against your identity provider, and roles are mapped from the attributes it returns, including tenant-restricted roles in multi-tenant deployments.

| Integration                                                  | Notes                                                                                                                                                                                                                                                                                                            |
| :----------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [SAML 2.0](/latest/authentication-saml)                      | Recommended for admins and analysts. Works with any standards-compliant IdP; see [Entra ID](/latest/m365-saml-entra-authentication) for a worked Microsoft 365 example. Supports [request signing](/latest/authentication-saml-request-signing) and [certificate handling](/latest/authentication-certificates). |
| [LDAP](/latest/authentication-ldap)                          | Login against Active Directory or another LDAP directory.                                                                                                                                                                                                                                                        |
| [Auto-Login](/latest/authentication-auto-login-link)         | Passwordless access for end users to the Self-Service Quarantine from the quarantine notification.                                                                                                                                                                                                               |
| [Password file](/latest/authentication-with-a-password-file) | Local credentials with optional TOTP, for break-glass access or environments without an IdP.                                                                                                                                                                                                                     |

Several methods can be active at the same time — for example SAML for the SOC and Auto-Login for end users. See [Authentication Overview](/latest/authentication-overview).

## Microsoft 365 and Microsoft Graph

Beyond mail flow, xorlab integrates with Microsoft 365 through a single [Entra ID app registration](/latest/m365-entra-id-app) and Exchange Online mail flow rules.

| Integration                                                               | What it does                                                                                                                         |
| :------------------------------------------------------------------------ | :----------------------------------------------------------------------------------------------------------------------------------- |
| [Case Isolation](/latest/m365-case-isolation)                             | Analysts remove a confirmed malicious email from recipients' mailboxes through Microsoft Graph.                                      |
| [Retrospective Email Scanning](/latest/m365-retrospective-email-scanning) | Import and analyze mail that was already delivered, before the tenant goes inline.                                                   |
| [Move to Quarantine](/latest/m365-move-quarantine)                        | Move the M365 quarantine to xorlab for a centralized experience.                                                                     |
| [Abuse Mailbox via the Report button](/latest/m365-reporting-integration) | The built-in Microsoft 365 reporting button feeds reported email into xorlab, with automated feedback to the reporter.               |
| [Contextual Banners](/latest/detection-contextual-banners)                | Exchange Online (and on-premises Exchange) mail flow rules insert risk-specific banners. Ready-made PowerShell scripts are provided. |
| [Shared mailboxes](/latest/ssq-shared-mailboxes)                          | Resolve shared mailbox membership so delegates can use the Self-Service Quarantine.                                                  |

## Threat intelligence

| Integration                                    | Role in the platform                                                                                                                                   |
| :--------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------- |
| [VirusTotal](/latest/detection-virustotal)     | On-demand enrichment in the message detail view. Informational only — it does not influence the verdict. Bring your own API key.                       |
| [Spamhaus DQS](/latest/detection-spamhaus-dqs) | DNS-based blocklist and Hash Blocklist checks through the SpamAssassin plugin. Bring your own key.                                                     |
| xorlab xCloud and xorlab ML                    | Built in, no configuration required. See [Data Sent to External Services](/latest/data-to-external-services) for exactly what leaves your environment. |

xorlab also **exports** threat intelligence: the `ti.*` [log events](/latest/logging-events#threat-analysis-events) emit malicious sender addresses, sending IPs, attachment hashes, domains, and URLs observed in your own mail, ready to be consumed by your SIEM or fed into other controls. See [Connect a SIEM](/latest/integrations-siem#export-threat-intelligence).

## Security awareness and phishing simulation

Any awareness training or phishing simulation service can be allowed through, regardless of vendor. Add its distinctive mark to the Simulation lists, ideally the sending IP range, and simulated attacks reach the inbox and are tagged `verdict:simulation`.

<Card title="Phishing Simulation" icon="person-running" horizontal href="/latest/phishing-simulation-tools">
  Which identifiers to use, and why matching on the connecting IP is safer than matching on a header.
</Card>

## Operational monitoring and alerting

<Info>
  **On-premises deployments only**

  If you run xorlab as SaaS, xorlab operates and monitors the platform for you. Subscribe to the [status page](/latest/important-resources#status-page) for scheduled maintenance and incidents.
</Info>

If you run xorlab on-premises, platform health monitoring is built on Prometheus and Alertmanager, so alerts about the platform itself can go anywhere Alertmanager can send them: email, Slack, a generic webhook, and every other receiver Alertmanager supports.

<Card title="Enable Alerts" icon="sensor-alert" horizontal href="/latest/monitoring-alerts">
  Configure receivers and route alerts by severity.
</Card>

<Note>
  Operational alerting is for platform health. To get email security events into another system, use [Syslog](/latest/integrations-siem) instead.
</Note>

## Don’t see your product?

That is usually not a problem. xorlab integrates through standard protocols rather than per-vendor connectors, so the question is which interface your product speaks:

* It can receive Syslog, or an agent of yours can read a log file → see [Connect a SIEM](/latest/integrations-siem).
* It can make an HTTP request → see [Automate with a SOAR](/latest/integrations-soar).
* It is a mail gateway or mail server → see [Mail flow (SMTP)](#mail-flow-smtp).
* It is an identity provider that supports SAML 2.0 or LDAP → see [Authentication Overview](/latest/authentication-overview).

If you are unsure, contact [support@xorlab.com](mailto:support@xorlab.com).