> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Examples

> Copy-ready logback snippets for the most common SIEM and alerting integrations.

## Log detailed email results

Records the complete result of the email analysis in JSON format to a remote Syslog server.

For a step-by-step Syslog guide, see [Enable Logging via Syslog](/latest/logging-via-syslog).

* Event: `trace.msg_analysis.complete`
* Container: `MTA core`
* File Path: `activeguard/core/logback-audit.xml`
* Appender: `SyslogAppender`
* Formatting: `%coreJsonMsg%n`

**File Path: activeguard/core/logback-audit.xml**

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>

<included>
 
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>
 
  <!-- Log once for each message when the processing has finished -->
  <logger name="trace.msg_analysis.complete">
     <appender-ref ref="syslogAppender"/>
  </logger>
 
</included>
```

## Log audit events

Send audit events in JSON format to a remote Syslog server each time a user does an action in the XCC web interface.

For a step-by-step Syslog guide, see [Enable Logging via Syslog](/latest/logging-via-syslog).

* Event: `audit` (includes sub-categories)
* Container: `XCC backend`
* File path: `xcc/backend/logback-audit.xml`
* Appender: `SyslogAppender`
* Formatting: `%jsonMsg%n`

**File Path: xcc/backend/logback-audit.xml**

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log all user audit events -->
  <logger name="audit">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>
```

<Tip>
  In order to also log **successful and failed logins**, configure `auth/auth/logback-audit.xml` as well with the same parameters as above.
</Tip>

## Log SMTP email traces

Send a JSON message when an email has been accepted through SMTP and another when a delivery attempt has been made.

For a step-by-step Syslog guide, see [Enable Logging via Syslog](/latest/logging-via-syslog).

* Events: `trace.mta.received`, `trace.mta.send`
* Container: `Mta`
* File path: `activeguard/mta/audit/logback-audit.xml`
* Appender: `syslogAppender`
* Format: `%jsonMsg%n`

**File Path: activeguard/mta/audit/logback-audit.xml**

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>192.168.1.100</syslogHost>
    <port>514</port>
    <hostName>xorlabhostname</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log received and send SMTP events. Alternatively, you can name a single logger 'trace.mta'. -->
  <logger name="trace.mta.received">
    <appender-ref ref="syslogAppender"/>
  </logger>
  <logger name="trace.mta.send">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>
```

<Tip>
  **How to log all SMTP logs**

  If you want to log the complete SMTP log and not only the send and receive events, then replace the name of the first logger with `trace.mta` and remove the second logger completely.
</Tip>

If you want to correlate the SMTP queue ID from the two events above with the GGRID, you can additionally activate the following log event.

* Event: `trace.msg_delivered`
* Container: `Core`
* File path: `activeguard/core/logback-audit.xml`
* Appender: `syslogAppender`
* Format: `%jsonMsg%n`

**File Path: activeguard/core/logback-audit.xml**

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>192.168.1.100</syslogHost>
    <port>514</port>
    <hostName>xorlabhostname</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log the queue ID, which can be used to correlate with the trace.mta.send event -->
  <logger name="trace.msg_delivered">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

```

## Log detailed email results per verdict

The following configuration ensures that a JSON message is sent each time a verdict is made on an email. This setup is particularly useful in scenarios where:

* An email initially appears legitimate and is delivered to the user, but
* A delayed or offline Sandbox scan later updates the verdict from benign to malicious.

In such cases, the configuration below would generate two separate JSON messages for the same email—one for each verdict, reflecting the change in status.

* Event: `trace.msg_verdict`
* Container: `Core`
* File path: `activeguard/core/logback-audit.xml`
* Appender: `syslogAppender`
* Format: `%coreJsonMsg%n`

**File Path: activeguard/core/logback-audit.xml**

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log the trace.msg_verdict event -->
  <logger name="trace.msg_verdict">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>
```

## Log threat intelligence

The following configuration will write one JSON message for every domain threat intelligence event into a local file and also logs the event over syslog:

* Event: `ti.domain`
* Container: `Backend`
* File path: `xcc/backend/logback-audit.xml`
* Appenders: `syslogAppender`, `RollingFileAppender`
* Format: `%jsonMsg%n`

<Tip>
  **xorlab on-prem only**

  Writing to local files is only supported for xorlab on-premises.
</Tip>

**File Path: `xcc/backend/logback-audit.xml`**

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<included>
  <!-- Write logs into a local file with a rollover policy -->
   <appender name="threatIntelFileAppender" class="ch.qos.logback.core.rolling.RollingFileAppender">
     <file>${log_dir}/domain_ti_json.log</file>
     <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
       <!-- roll over daily -->
       <fileNamePattern>${log_dir}/domain_ti_json_%d{yyyy-MM-dd}.%i.log.zip</fileNamePattern>
       <maxFileSize>100MB</maxFileSize>
       <!-- total (compressed) size of all parts  -->
       <totalSizeCap>500MB</totalSizeCap>
       <!-- Number of roll overs to keep -->
       <maxHistory>60</maxHistory>
     </rollingPolicy>
     <encoder>
       <pattern>%jsonMsg%n</pattern>
     </encoder>
   </appender>
  
  <appender name="threatIntelSyslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log all ti.domain events -->
  <logger additivity="false" level="debug" name="ti.domain">
    <appender-ref ref="threatIntelFileAppender"/>
    <appender-ref ref="threatIntelSyslogAppender"/>
  </logger> 
</included>
```