Skip to main content
This applies to on-premises Microsoft Exchange 2016 or 2019. xorlab will receive a copy of every incoming and outgoing email.
Prerequisites

​
Creating the mail flow rules

​
Incoming emails

First, we need to create a mail-flow rule that sends a copy of all incoming emails to xorlab Security Platform.
  1. In the Exchange Control Panel, under Mail Flow → Rules, create a new rule.
  2. After you enter the name for the rule, click the drop-down list under Apply this rule if… to expand it and choose The sender is located… and then is external/internal: Selecting the sender for the rule
  3. In the select sender location input box that appears (if it doesn’t, click Select one… next to the list), select Outside the organization and click OK: Sender from outside of the organization
  4. Click the drop-down list under Do the following… to expand it and choose BCC the message to…
  5. A new browser tab/window opens where you can enter the xorlab Security Platform monitoring mailbox address, e.g., monitor@mx.xyz.activeguard.cloud. Your new rule should look like the one depicted below: Exchange rule for incoming emails
  6. Click Save.

​
Outgoing emails

Now we need to create another mail-flow rule that sends a copy of all outgoing emails to xorlab Security Platform. Repeat the same steps as for incoming mails but, in step #2, select The recipient is located… in the first list. Now the rule should look like this: Exchange rule for outgoing emails After creating those two rules, a copy of all incoming and outgoing emails will be sent to xorlab.

​
Internal emails

In order to also send a copy of internal emails to xorlab Security Platform, the two mail-flow rules from above can be replaced with one single mail-flow rule that is applied to all messages (select this item from the list in step #2) as shown below. This step can be ignored if internal emails should not be forwarded to xorlab: Exchange rule for internal emails

​
Considerations

As mentioned above, in monitoring mode, xorlab Security Platform will not change the mail traffic in any way. However, if all xorlab MTAs are down or do not accept emails, it can lead to a growing email queue on the Exchange Server. If this happens, you should temporarily disable the BCC mail flow rules.

​
Next steps