Customize QR Code Analysis

xorlab analyzes QR codes by default and extracts their URLs where available. By default, it applies QR code analysis on:

Images attached to the email
Rendered previews of the email body (only done for some emails)
Rendered previews of attachments (only done for some emails)

Change rendering policy

xorlab has a separate rendering policy for email body previews as well as for attachment previews.

Which emails and attachments are rendered by default, and the delivered values of the parameters below, are documented in Detection Defaults → QR code analysis. Access to that page is restricted.

You can change this behavior in Expert Editor in the local.properties file located at activeguard/core/rule_sets/90_local/params/ by setting the following parameters to ACTIVE or DISABLED:

Increased resourcesEnabling FILE or MAIL rendering can significantly increase the resource usage on the MTA.

EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_analysis_pipelines_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_incoming_emails_qr_code_keywords_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_incoming_emails_sender_unknown_never_delivered_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_incoming_emails_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_incoming_emails_untrusted_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_external_emails_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_reported_emails_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_internal_emails_state
EXECUTE_MAIL_RENDER_PREVIEW_INSTRUCTION_for_outgoing_emails_state
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_incoming_emails_state
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_incoming_emails_untrusted_state
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_external_emails_state
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_reported_emails_state
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_internal_emails_state
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_outgoing_emails_state
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_analysis_pipelines_state

QR code analysis for internal/outgoing emailsWhen enabling one of these FILE_RENDER rules:

EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_internal_emails_state=ACTIVE
EXECUTE_FILE_RENDER_PREVIEW_INSTRUCTION_for_outgoing_emails_state=ACTIVE

you must also enable the two FILE_QR_EXTRACTION rules, otherwise they have no impact:

EXECUTE_FILE_QR_EXTRACTION_INSTRUCTION_for_internal_emails_state=ACTIVE
EXECUTE_FILE_QR_EXTRACTION_INSTRUCTION_for_outgoing_emails_state=ACTIVE

After changing the rule properties, click Publish. The rule-set configuration becomes active within about one minute.

Enabling/disabling QR code URL extraction

Open Expert Editor and go to the file located at activeguard/core/active_guard.yml.
The following configuration represents the default settings, which are automatically applied in the absence of explicit qrCodeService configurations in the active_guard.yml file.
active_guard.yml
# QR code service: enabled by default. This service is responsible for extracting QR codes from files. qrCodeService: # Enable or disable service enabled: true
To disable the QR Code URL Extraction feature, simply change enabled: true to enabled: false.
Click Publish, then restart all MTAs. The qrCodeService setting is in active_guard.yml and requires an MTA restart; see How to Activate the Configuration.

Customizing extraction from PDF attachments

For a more tailored approach to handling PDF attachments, you can adjust how the system renders PDF pages for QR code extraction:

In Expert Editor, open the activeguard/core/active_guard.yml file.

Locate or add the pdfFileRenderService section to adjust the rendering settings for PDF attachments as needed:

active_guard.yml

# PDF File Render Service config
pdfFileRenderService:
  # Sets how many pages to render, starting with the first page. For example, a value of 1 would render only the first page. A value of 3 would render the
  # first 3 pages. Must be greater than or equal to 1.
  numberOfPages: <pages>
  # Sets the x resolution of the rendered images. Must be greater than or equal to 600 and less than or equal to 3840. Be careful with this setting,
  # as this can significantly increase memory usage during PDF rendering.
  xResolution: <x_resolution>
  # Sets the y resolution of the rendered images. Must be greater than or equal to 600 and less than or equal to 3840. Be careful with this setting,
  # as this can significantly increase memory usage during PDF rendering.
  yResolution: <y_resolution>

Click Publish, then restart all MTAs. The pdfFileRenderService setting is in active_guard.yml and requires an MTA restart; see How to Activate the Configuration.

The delivered PDF rendering values are documented in Detection Defaults → QR code analysis. Access to that page is restricted.

By following these steps, you can activate and configure the QR Code URL Extraction feature according to your organization’s specific needs. Adjusting the PDF rendering settings allows for flexibility in balancing performance with the thoroughness of QR code scanning within your documents.

​Change rendering policy

​Enabling/disabling QR code URL extraction

​Customizing extraction from PDF attachments

Change rendering policy

Enabling/disabling QR code URL extraction

Customizing extraction from PDF attachments