Integrate M365 Abuse Mailbox

​

Prepare xorlab

1. Open shared/guarded_tenants.yml and add all email address patterns that are allowed to report emails.
   guarded_tenants.yml

   tenants:
     - name: example
       emailReporting:
         authorizedEmailReportRecipients:
           - .*@xorlab\.com
           - .*@xorlab\.net
   

2. Choose if you want to enable or disable automatic feedback. If enabled, every reporter will get an immediate feedback email.
   Automatic feedback

   guarded_tenants.yml

   tenants:
     - name: example
       ruleProfiles:
         # REMOVE this line
         - no_auto_feedback.properties
   

   Disabled feedback

   guarded_tenants.yml

   tenants:
     - name: example
       ruleProfiles:
         # ADD this line
         - no_auto_feedback.properties
   

3. Optional: Change the sender address used for feedback emails: Change Sender Address.
4. Click Publish. The new configuration becomes active within about one minute.

​

Forward M365 reported emails to xorlab

1. You need a dedicated mailbox in M365 that receives reported emails. If you don’t have one, create one like reporting@example.com.
2. In the M365 Defender portal go to Settings → Email & collaboration → User reported settings. Or directly via User submissions.
3. Activate Monitor reported messages in Outlook.
4. Scroll down to Reported message destinations and add the mailbox from step #1 to the mailbox field. Choose either My reporting mailbox only or Microsoft and my reporting mailbox in the dropdown.
5. Click Save.
6. Go to Exchange Mail Flow and create a new rule with the name xorlabReportingIntegration:
   • Apply this rule if → The recipient → is this person and select your mailbox from step #1.
   • Do the following → Redirect the message to → enter the xorlab reporting address suspicious@mx.xyz.activeguard.cloud, where xyz is your customer ID.
   
7. Click Next until Finish, then Done.
8. Enable the new rule.

​

Test the integration

1. Report an email via the M365 built-in button. It is available in the web interface as well as in Outlook.
2. In xorlab, go to Abuse Mailbox → All Cases and there you should see the reported email. It can take up to 30 seconds to appear.
3. If you enabled automatic feedback in the beginning, you should receive a feedback email within 30 seconds.

​

How to change the reporting address

scanSources:
  smtp:
    port: 10025
    handler:
      smtpReport:
        # Default. <templateDomain> corresponds to the parameter templateDomain in active_guard.yml
        emailAddress: suspicious@<templateDomain>

​

How to automate reported email handling

​

How “Not Junk” reports are handled

• #reportedasnotjunk for messages reported as Not Junk
• #reportedasjunk for messages reported as Junk
• #reportedasphishing for messages reported as Phishing

• Not Junk: the case is automatically resolved as benign by REPORTED_NOT_JUNK_decision, no acknowledgment email is sent, and the #reportedasnotjunk tag is added.
• Junk/Phishing: the corresponding tag is added, acknowledgment is sent (if enabled), and the case is handled by normal reported-email analysis.

# Disable auto-resolve for M365 "Not Junk" reports
REPORTED_NOT_JUNK_decision_state=PASSIVE

​

Multi-Tenancy

​

Next steps

• What to Configure Next