> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Reporting a Misclassification
> Report a false positive or false negative to xorlab so that the detection can be corrected.
Suppose a message was mistakenly quarantined but is benign (false positive) or was delivered although it shouldn’t have been (false negative).
You can report a misclassification in various locations:
We show here how to report the misclassification of an arbitrary email:
1. Open the email in the detail view
2. Click the three dots in the upper right and choose **Report Misclassification**:
3. In the new dialog, choose the **Expected verdict** and select the severity of the issue with the slider (see the [guide below](#severity-levels) to pick the right level)
4. Optional: Add a comment clarifying the reason for this misclassification report.
**Report locations**
Besides the above shown way, you can also report a misclassification whenever you:
* Release an email from the quarantine
* Isolate an email
* Resolve a reported email
The corresponding dialogs offer a **Report misclassification** checkbox.
## Severity levels
Please follow these guides to find the severity level that fits your case best:
### Reporting a misclassified malicious email
| Level | Description |
| :----------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Low** | Unwanted mail with no security impact (e.g., newsletters & marketing, graymail). |
| **Moderate** | Pure spam with no/little security impact (e.g., shady promotions, obvious spam, high-volume spam). |
| **Major** | Harmful spam or threat with potential security impact (e.g., adult/drug spam, phishing, extortion, fraud, impersonation). |
| **Critical** | High-severity threat with clear harm potential that requires immediate attention (e.g., malware or a high-quantity phishing wave). Please include a comment with critical issues to help us assess them quickly. |
### Reporting a misclassified benign email
| Level | Description |
| :----------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Low** | Wanted informational mail (e.g., newsletters & marketing). |
| **Moderate** | Wanted non-business-relevant or personal email (e.g., notifications from services, emails for private purposes). |
| **Major** | Business-relevant or critical emails (e.g., business communication, password-reset emails, invoices, travel tickets). |
| **Critical** | Business-critical email that required immediate attention (e.g., a quarantined email that required an immediate response, causing potential for business damage). Please include a comment with critical issues to help us assess them quickly. |
## Report a misclassified topic
To report a misclassified topic, please see [Report misclassified topics](/latest/topic-detection#report-misclassified-topics).
## Configuration
The Admin guide to configure the behavior of the reporting can be found here: [Configure Misclassification Reporting](/latest/configure-misclassification-reporting).