Integrate On-prem Abuse Mailbox

You will be able to view all reported emails in xorlab and send feedback to the reporters.

Prerequisites

Complete Before You Begin and Set Up Email Routing in xorlab

If you have a hybrid M365 setup and all your mailboxes are hosted in M365, follow Integrate M365 Reported Emails instead.

Prepare xorlab

Open shared/guarded_tenants.yml and add all email address patterns that are allowed to report emails.

guarded_tenants.yml

tenants:
  - name: example
    emailReporting:
      authorizedEmailReportRecipients:
        - .*@xorlab\.com
        - .*@xorlab\.net

Choose if you want to enable or disable automatic feedback. If enabled, every reporter will get an immediate feedback email.

Automatic feedback

guarded_tenants.yml

tenants:
  - name: example
    ruleProfiles:
      # REMOVE this line
      - no_auto_feedback.properties

Disabled feedback

guarded_tenants.yml

tenants:
  - name: example
    ruleProfiles:
      # ADD this line
      - no_auto_feedback.properties

Optional: Change the sender address used for feedback emails: Change Sender Address.
Click Publish. The new configuration becomes active within about one minute.

Forward reported emails to xorlab

Reported emails need to be forwarded as EML attachment to a dedicated email address on xorlab: suspicious@<templateDomain>. The templateDomain property can be found in activeguard/core/active_guard.yml. The actual implementation of the forwarding depends on your setup. Choose the one that fits your environment.

Manual reporting mailbox
Third party button
No reporting mailbox

You have a dedicated mailbox where users in your organization can report emails to. They need to manually forward the reported email as attachment to that mailbox.

Forwarding: In your Exchange, create a mail flow rule that forwards all email from that mailbox to xorlab at suspicious@<templateDomain>. If you need the emails still in that mailbox, you can send xorlab just a BCC copy of the emails instead.

You have a third party button in place that your users use for reporting emails.

Forwarding: Most buttons allow you to add an additional recipient to the reported emails. Add suspicious@<templateDomain>. If that is not possible, create a mail flow rule on Exchange as described under “Manual reporting mailbox”.

How to change the reporting address

The default address under which xorlab will listen for reported emails is suspicious@<templateDomain>, with templateDomain referring to the parameter that’s set in active_guard.yml. If you like to customize the sender address, add the following block (if it does not already exist) to the active_guard.yml file:

active_guard.yml

scanSources:
  smtp:
    port: 10025
    handler:
      smtpReport:
        # Default. <templateDomain> corresponds to the parameter templateDomain in active_guard.yml
        emailAddress: suspicious@<templateDomain>

Afterward, click Publish. The scanSources handler settings become active within about one minute.

How to automate reported email handling

For further information about automation, have a look at Abuse Mailbox.

Multi-Tenancy

Repeat this integration for each tenant. In addition, xorlab needs to know which tenant a reported email belongs to, which is decided by a header on the carrier email and not by the reporting address:

Assign Reported Emails to Tenants

Add the x-ag-tenant header so that reported emails end up in the right tenant.

Next steps

The on-premises integration is complete:

What to Configure Next

​Prepare xorlab

Automatic feedback

Disabled feedback

​Forward reported emails to xorlab

​How to change the reporting address

​How to automate reported email handling

​Multi-Tenancy

Assign Reported Emails to Tenants

​Next steps

Prepare xorlab

Forward reported emails to xorlab

How to change the reporting address

How to automate reported email handling

Multi-Tenancy

Next steps