Search - xorlab

Search in xorlab helps you find any message in seconds using intuitive filters, tags, time ranges, and wildcards, and keeps track of your recent queries.

▶ Watch the Video Tutorial: How to Use Search in xorlab

Key features

Autocomplete Suggestions: As you type, the search bar provides real-time suggestions, reducing the need to memorize search syntax.
Filter Options: You can easily filter your results by sender, recipient, subject, or other key attributes by selecting options from a dropdown menu.
Time Range Selection: The search bar includes a built-in time range selector to refine your searches by date without manually entering date strings.
Wildcard Characters: Wildcards are automatically supported with ? matching a single character and * matching zero or more characters.
Tag-based Search: Easily search and aggregate emails using case-insensitive tags (e.g., #phishing, #highrisk) to filter or group emails. For the complete list, please see Tags.
Recent Searches: Access the four last searches by clicking the search bar, allowing easy recall of previous queries for ongoing investigations or repetitive tasks.
Campaign Creation: If a search query is Campaign compatible, you can click the icon in the search bar to directly turn the query into an adaptive policy.
Save Searches: There’s also an icon in the search bar that enables you to save the search query for later use.

Search query basics

You can build powerful search queries using a combination of filters, verdicts and tags, and simple logic like and, or, and not.

How the logic works

Search queries are made up of statements — simple conditions like filters (status:open) or tags (#quarantine) — connected using logical operators:

and: both conditions must match
or: at least one condition must match
not: exclude anything that matches the expression

For example:

#domainonlyinbound #inc #untrusted not(#crm or #marketing or #newsletter) The strongest operator is not followed by and and then by or. Multiple statements without any operator are always treated as and.

Email attributes

Every email has base attributes automatically set by xorlab, such as the sender, recipient, and timestamp. You can search using these attributes with the syntax attribute:value.

Senders and recipients

Query syntax
Arguments
Examples

Query	Description
`sender:<Match>`	Returns emails where the header `from:` or the SMTP `from` address matches `<Match>`
`recipient:<Match>`	Returns emails where the header `to:` or `cc:` or the SMTP `to` address match `<Match>`
`from:<Match>`	Returns emails where the header `from:` (a.k.a. `mail-from` or `5322.From`) matches `<Match>`
`to:<Match>`	Returns emails where the header `to:` matches `<Match>`
`cc:<Match>`	Returns emails where the header `cc:` matches `<Match>`
`involves:<Match>`	Returns emails where either `from`, `to`, `cc`, `envfrom`, or `envrecipient` match `<Match>`
`reporter:<Match>`	Returns incidents reported by `<Match>`
`envfrom:<Match>`	Returns emails where the SMTP `from` address (a.k.a. `envelope-from` or `5321.From`) matches `<Match>`
`envrecipient:<Match>`	Returns emails where the SMTP `to` address (a.k.a. `envelope-to` or `5321.To`) matches `<Match>`

Argument	Description
`<Match>`	Accepts fully qualified email addresses and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`

Query	Result
`from:albert@timespace.com`	Returns all emails where the header `from:` field contains `albert@timespace.com`
`to:*.net`	Returns all emails that contain a .net domain in the header `to:` field
`from:[marie@radio.org,isaac@gravity.net]`	Returns all emails with `mail-from = from:marie@radio.org` OR `mail-from = from:isaac@gravity.net`
`cc:[marie,isaac]`	Returns all emails whose header `cc:` field starts with the token `marie` or ends with the token `isaac`

Query syntax
Arguments
Examples

Query	Description
`<Address>.displayname:<Match>`	Returns all emails for the specified address type that have the given display name

Argument	Description
`<Address>`	Accepts `sender`, `recipient`, `from`, `to`, `cc`, `involves`
`<Match>`	Accepts strings and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. If the display name to be matched contains spaces, then you must enclose it in double quotes. Use `\` to escape quotes

Query	Result
`from.displayname:"Albert E."`	Returns all emails where a sender display name contains `Albert E.`
`from.displayname:"R* Fey*"`	Returns all emails where the sender display name starts with the character `R` and ends with the string `Fey` separated by a space
`to.displayname:[Albert, Richard]`	Returns all emails where the recipient display name is either `Albert` or `Richard`
`cc:[marie,isaac]`	Returns all emails where a cc address starts with `marie` or ends with `isaac`

Multi-tenant

Query syntax
Arguments
Examples

Query	Description
`tenant:<name>`	Returns emails where the assigned tenant matches the `<name>` defined in guarded_tenants.yml
`tenant.uid:<uid>`	Returns emails where the tenant’s unique `uid` identifier matches `<uid>`

Argument	Description
`<uid>`	Accepts the value of the `uid` attribute defined in `/shared/guarded_tenants.yml`
`<name>`	Accepts the value of the `<name>` attribute defined in `/shared/guarded_tenants.yml`
These search attributes do not support use of wildcard characters `?` and `*`.

Query	Result
`tenant:timespace.com`	Returns all emails of the tenant `timespace.com`
`tenant.uid:db3953f5-2aba-42b1-b038-115d55c56f422`	Returns emails of the tenant whose `uid` matches `db3953f5-2aba-42b1-b038-115d55c56f422`
`tenant:[radio.org,gravity.net]`	Returns all emails of the tenant `timespace.com` OR the tenant `gravity.net`

Direction

Query syntax
Arguments
Examples

Query	Description
`direction:<Direction>`	Returns emails that were sent, received, exchanged internally, or processed on behalf of a third party

Argument	Description
`<Direction>`	Accepts `incoming`, `outgoing`, `internal`, `external`. Multiple direction matches can be combined with `[<Direction>, ...]` which translates to `<Direction> OR ...`

Query	Result
`direction:incoming`	Returns emails sent from external parties to recipients inside the protected organization
`direction:outgoing`	Returns emails sent from the members of the protected organization to external parties
`direction:internal`	Returns emails sent from external parties to recipients inside the protected organization
`direction:external`	Returns emails sent from external parties to external parties (as it typically happens if an MTA forwards external emails)

Date and time

Query syntax
Arguments
Examples

Query	Description
`received:since:<Keyword> \|<DateString> \|<RelativeDateString>`	Returns emails that were received since the specified date and time
`received:before:<Keyword> \|<DateString> \|<RelativeDateString>`	Returns emails that were received before the specified date and time
`received:[<DateString> TO <DateString>]`	Returns emails that were received in the specified date and time interval (inclusive)

Argument	Description
`Keyword`	Accepts `today`, `noon`, `midnight`, `yesterday`
`DateString`	Accepts a date time string in the following formats: - `dd.mm[.yyyy][,hh:mm]` where `yyyy` and `hh:mm` are optional - `[yyyy-]mm-dd[,hh:mm]` where `yyyy` and `hh:mm` are optional - `[yyyy-]mmm-dd[,hh:mm]` where `mmm = {jan, feb, mar, apr, jun, jul, aug, sep, oct, nov, dec}` and `yyyy` and `hh:mm` are optional
`RelativeDateString`	Accepts a string in the following format `<Number><d \| w \| m>` that indicates the current date minus `<Number>` number of `<d>` days, of `<w>` weeks, or of `<m>` months

Query	Result
`received:since:noon` or `received:since:today,noon`	Returns all emails received since today 12:00
`received:since:today,midnight`	Returns all emails received since today 00:00
`received:since:sep-20,12:30`	Returns all emails received since 12:30, September 20 of the current year
`received:since:2020-09-20` or `received:since:20.09.2020`	Returns all emails received since September 20, 2020
`received:since:3d`	Returns all emails received within the past three days (current time—72h)

Query	Description
`#<String>`	Returns all emails that were tagged with `<String>`

Argument	Description
`String`	Accept any string. String values are parsed as described in the Tags reference. Multiple tags are combined with logical `AND`

Query	Result
`#inc`	Returns all incoming emails
`#inc AND #trusted AND #word`	Returns all incoming emails from trusted senders that have a Word file attached
`#out AND #encryptedarchive`	Returns all outgoing emails that have an encrypted archive attached
`#inc AND #highrisk AND #newsender AND #exposedhvt AND #file`	Returns all incoming emails from senders never-before-seen to a high-value target that have a high-risk score and at least one file attached
`#untrusted AND #newdomain AND #exposedhvt`	Returns all emails from untrusted senders to high-value targets that contain at least one link with a domain never-before-seen
`#inc AND #highrisk AND #untrusted AND #newsender AND #cloudstorage`	Returns all incoming emails with a high-risk score from untrusted and unknown senders that contain at least one link to a cloud storage platform
`#inc AND #highrisk AND #newsender AND #shortenednolocalreputation`	Returns all incoming emails with a high-risk score from senders never-before-seen that contain a shortened link which points to a URL that has no local reputation (meaning it is not relevant to the organization)
`#inc AND #trusted AND #dangerousvbascript`	Returns all incoming emails from trusted senders that contain at least one Office file with a VBA script that makes use of potentially dangerous functions
`#inc AND #trusted AND #cracked AND #executable`	Returns all incoming emails from trusted senders with a cracked, encrypted attachment and an executable file attached
`#inc AND #runtime`	Returns all incoming emails with an attachment that triggered a suspicious runtime event (as observed in the Sandbox)
`#pdf AND #cfiviolation`	Returns all emails with a PDF document attached that triggered a CFI violation in the Sandbox (most likely an exploit)

Scores

xorlab Security Platform generates several scores for each processed email. Each score is a function of the organization’s email history and the email being processed.

Query syntax
Arguments
Examples

Query	Description
`<Score>:<Relation>:<Number>`	Returns all emails with the specified score in a given range
`<Score>:[<Number> TO <Number>]`	Returns all emails with a `<Score>` in the specified interval (inclusive)

Argument	Description
`Score`	Accepts `trust`, `reputation`, `risk`, `threat`, `spam`, and `rsd`: - `trust` denotes the overall trust score — the relationship value — and assumes a value between 0 and 100 - `reputation` denotes the reputation of the sending domain and assumes a value between 0 and 100 - `risk` quantifies the attack surface of an email and assumes a value between 0 and infinity - `threat` is a function of `risk`, `trust`, `reputation` and classification, and quantifies the threat that an email poses to the organization; the score assumes a value between 0 and 100 - `spam` quantifies the likelihood of an email being spam; the score assumes a value between negative and positive infinity - `rsd` is the rspamd score of the email; the score assumes a value between negative and positive infinity
`Relation`	Accepts `eq` (equal), `gt` (greater than), `gte` (greater than or equal), `lt` (less than) and `lte` (less than or equal)
`Number`	Accepts integers (for scores `trust`, `reputation`, `risk`, `threat`) and floating point values (for `spam`)

Query	Result
`reputation:gt:50`	Returns all emails where the reputation score is greater than 50. The reputation is a score associated with authenticated senders based on the global and local reputation of the domain
`spam:lt:0`	Returns all emails with a negative spam score

Query syntax
Arguments

Query	Description
`<Score>:<Level>`	Returns all emails with a `<Score>` at least `<Level>`

Argument	Description
`Score`	Accepts `trust`, `reputation`, `risk`, and `threat` (see previous table)
`Level`	Accepts `low`, `medium`, `high` and additionally `noauth` and `trusted` if `Score = reputation`: - `noauth` indicates that the sender of an email could not be authenticated - `trusted` indicates that the email sender could be authenticated and that sender `trust` is greater than 0 - `low` captures values between 0 and 50 if `Score = risk` and values between 0 and 34 otherwise - `medium` captures values between 51 and 75 if `Score = risk` and values between 35 and 67 otherwise - `high` captures values greater 75 if `Score = risk` and values between 68 and 100 otherwise

Verdicts

Query syntax
Arguments
Examples

Query	Description
`verdict:<Class> \|<Malicious Verdict> \|<Benign Verdict>`	Returns all emails from a given verdict class or with a specific verdict. For more information about verdicts, please see Verdicts

Argument	Description
`Class`	Accepts `benign`, `malicious`, and `undecided`. Note that `benign` does not include `simulation`
`Malicious Verdict`	Accepts `bec`, `blacklist`, `extortion`, `filter`, `impersonation`, `malware`, `malware_static`, `malware_dynamic`, `phishing`, `policy`, and `vipfraud`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[<Verdict>, ...]`
`Benign Verdict`	Accepts `bulk`, `business`, `cloudstorage`, `crm`, `external`, `forwarded`, `freemail`, `internal`, `marketing`, `newsletter`, `partner`, `personal`, `poll`, `popular`, `reputable`, `simulation`, `socialnetwork`, `survey`, and `trusted`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[<Verdict>, ...]`

Query	Result
`verdict:malware`	Returns all emails containing malware, detected either statically or in the Sandbox
`verdict:malware_dynamic`	Returns only emails whose malware was detected in the Sandbox. Use `verdict:malware_static` for statically detected malware
`verdict:policy`	Returns all emails with a Policy or Blacklist verdict. Use `verdict:filter` to match only Policy
`verdict:simulation`	Returns all emails that are part of some simulated awareness campaign
`verdict:bulk`	Returns all emails that are part of a bulk campaign

Verdict confidences

To search for emails with a certain verdict confidence, you need to make use of the rule: search feature described further in this article. The verdicts that are not listed in the following table do not have different confidences.

Verdict	Description
Phishing	High: `rule:PHISHING_high_confidence_decision` Med: `rule:PHISHING_medium_confidence_decision` Low: `rule:PHISHING_low_confidence_decision`
Spam	High: `rule:SPAM_high_confidence_decision` Med: `rule:SPAM_medium_confidence_decision` Low: `rule:SPAM_low_confidence_decision`
VIP Fraud	High: `rule:VIP_FRAUD_high_confidence_decision` Med: `rule:VIP_FRAUD_medium_confidence_decision`
Impersonation	High: `rule:IMPERSONATION_high_confidence_decision` Med: `rule:IMPERSONATION_medium_confidence_decision`
Policy (Filter)	High: `rule:FILTER_high_confidence_decision` Med: `rule:FILTER_medium_confidence_decision`

Processing status

Query syntax
Arguments
Examples

Query	Description
`status:<ProcessingStatus>`	Returns emails that are in the specified processing status. The value of `<ProcessingStatus>` depends on the type of email, whether it was quarantined or whether somebody reported it as suspicious

Argument	Description
`ProcessingStatus`	- Accepts `delivered`, `quarantined`, `released`, `dropped`, `bounced`, `pending`, `smtperror` for emails from the normal mail flow - Accepts `open`, `resolved`, and `pending` for emails reported as suspicious - Accepts `completed` and `pending` for reported and uploaded suspicious files - Emails with `status:pending` can be in the state of `processing:ongoing` or `processing:error` - Multiple matches can be combined with `[<ProcessingStatus>, ...]` which translates to `<ProcessingStatus > OR ...`

Query	Result
`status:delivered`	Returns all emails from normal mail flow that were delivered either to the recipient’s mailbox (incoming emails) or to the Internet (outgoing emails)
`status:quarantined`	Returns all emails from normal mail flow that were quarantined. Emails in this state can be filtered with `quarantine:<QuarantineLabel>`
`status:released`	Returns all emails that were released from quarantine
`status:dropped`	Returns all emails from normal mail flow that were dropped (i.e., deleted and not delivered)
`status:pending`	Returns all emails that are currently being processed or caused an error while processing. Emails in this status can be filtered with `processing:ongoing` or `processing:error`
`status:smtperror`	Returns all emails that have failed in delivery
`status:open`	Returns all reported emails that require further analysis
`status:resolved`	Returns all reported emails that were resolved, either automatically by the platform or manually by an analyst

Email content

Topics

The topic keyword allows searching for topics found in any part (body, subject and attachment) of the email.

Query syntax
Arguments
Examples

Query	Description
`topic:<Match>`	Returns all emails with a given topic

Argument	Description
`Match`	Accepts strings (case-insensitive). Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. See topic detection for possible values

Query	Result
`topic:sexualcontent`	Returns all emails with the topic `sexualcontent`
`topic:[sexualcontent,invoice]`	Returns all emails with one of the topics `sexualcontent` or `invoice`

Body

The body keyword allows searching topics in the email’s plaintext or HTML body parts.

Query syntax
Arguments
Examples

Query	Description
`body.topic:<Match>`	Returns all emails with a given topic in the email body (HTML or plaintext part)

Argument	Description
`Match`	Accepts strings (case-insensitive). Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. See topic detection for possible values

Query	Result
`body.topic:sexualcontent`	Returns all emails with the topic `sexualcontent` in the email body
`body.topic:[sexualcontent,invoice]`	Returns all emails with one of the topics `sexualcontent` or `invoice` in the email body

Subject

Query syntax
Arguments
Examples

Query	Description
`subject:<Match>`	Returns all emails with a given subject

Argument	Description
`Match`	Accepts strings (case-insensitive) and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. If the subject to be matched contains spaces, then you must enclose the subject string in double quotes. Use `\` to escape quotes

Query	Result
`subject:"How the world works"`	Returns all emails with a subject equal to `How the world works`
`subject:"This is \"a laser\""`	Returns all emails with a subject equal to `This is "a laser"`
`subject:[The,world*]`	Returns all emails with a subject that begins with `The` or contains `world`, e.g., `The world works like this`

Query syntax
Arguments
Examples

Query	Description
`subject.topic:<Match>`	Returns all emails with a given topic in the subject

Argument	Description
`Match`	Accepts strings (case-insensitive). Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. See topic detection for possible values

Query	Result
`subject.topic:sexualcontent`	Returns all emails with the topic `sexualcontent` in the subject
`subject.topic:[sexualcontent,invoice]`	Returns all emails with one of the topics `sexualcontent` or `invoice` in the subject

Embedded links

xorlab Security Platform extracts links from the email body and attached documents.

Query syntax
Arguments
Examples

Query	Description
`link:<Match>`	Returns all emails that contain the matching link

Argument	Description
`Match`	Accepts strings and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. If the link to be matched contains the reserved characters (i.e., `:`, `#`, `(`, `)`, `[`, `]` ), then you must enclose the link in double quotes. Use `\` to escape quotes

Query	Result
`link:"http://www.xorlab.com"`	Returns all emails that contain at least one link to xorlab.com
`link:"http://www.xorlab.*"`	Returns all emails that contain at least one link that starts with http://www.xorlab

Query syntax
Arguments
Examples

Query	Description
`link.displaytext:<Match>`	Returns all emails that contain a link matching the given display text

	Description
`Match`	Accepts strings and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. If the display text of a link to be matched contains spaces, then you must enclose the display text string in double quotes. Use `\` to escape quotes

Query	Result
`link.displaytext:"Click me!"`	Returns all emails that contain at least one link with the display text `Click me!`
`link.displaytext:"Click *!"`	Returns all emails that contain at least one link with the display text that starts with `Click` and that ends with `!`
`link.displaytext:["Click me!", "Click here!"]`	Returns all emails that contain at least one link with the display text `Click me!` or `Click here!`

Query syntax
Arguments
Examples

Query	Description
`link.location:<Location>`	Returns all emails that contain a link in the given location (e.g., message body or a message attachment)

Argument	Description
`Location`	Accepts `body` and `attachment`

Query	Result
`link.location:body`	Returns all emails that contain at least one link within their body

Embedded domains

xorlab Security Platform extracts domains from the links it finds in the email body and attachments. This includes domains that surface in network activity during dynamic file analysis.

Query syntax
Arguments
Examples

Query	Description
`domain:<Match>`	Returns all emails that contain a given domain

Argument	Description
`Match`	Accepts strings and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`

Query	Result
`domain:xorlab.com`	Returns all emails that contain at least one link to the xorlab.com domain
`domain:[xorlab.com,xorlab.ch]`	Returns all emails that contain at least one link to the subdomains of xorlab.com and xorlab.ch

Query syntax
Arguments
Examples

Query	Description
`domain.date:since:<Keyword> \| <DateString> \| <RelativeDateString>`	Returns emails that contain a domain registered since the specified date and time
`domain.date:before:<Keyword> \| <DateString> \| <RelativeDateString>`	Returns emails that contain a domain registered before the specified date and time
`domain.date:[<DateString> TO <DateString>]`	Returns emails that contain a domain registered in the specified date and time interval (inclusive)
`domain.ip:<IpValue>`	Returns emails that contain a domain with the specified IP

Argument	Description
`IpValue`	Accepts a valid IP version 4. Multiple IP matches can be combined with `[<IpValue>, ...]` which translates to `<IpValue> OR ...`

Query	Result
`domain:ip:172.217.10.78`	Returns all emails that contain at least one domain with the IP matching `172.217.10.78`

Query syntax
Arguments
Examples

Query	Description
`domain.(local \| global):<Relation>:<Number>`	Returns emails that contains a domain with the local or global reputation system score within a given range

Argument	Description
`Relation`	Accepts `eq` (equal), `gt` (greater than), `gte` (greater than or equal), `lt` (less than) and `lte` (less than or equal)
`Number`	Accepts integers (for scores `trust`, `reputation`, `risk`, `threat`) and floating point values (for `spam`)

Query	Result
`domain.global:gt:5`	Returns all emails that contain a domain with a global reputation greater than 5
`domain.local:lt:5`	Returns all emails that contain a domain with a local reputation lower than 5

Email attachments

xorlab Security Platform supports file name and file hash filters as well as specific file analysis verdicts.

Query syntax
Arguments
Examples

Query	Description
`file.name:<Match>`	Returns all emails that contain a file matching the given term

Argument	Description
`Match`	Accepts strings and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. If the link display text to be matched contains spaces, then you must enclose the link display text string in double quotes. Use `\` to escape quotes

Query	Result
`file.name:"Please open.exe"`	Returns all emails with an attachment named `Please open.exe`
`file.name:*.exe`	Returns all emails with an attachment that ends with `.exe`
`file.name:[exe, hta, *bat]`	Returns all emails with attachments name ending with the tokens `exe`, `hta` or `bat`

Query syntax
Arguments
Examples

Query	Description
`file.hash:<SHA256>`	Returns all emails that contain a file matching the given SHA256 hash value

Argument	Description
`SHA256`	Accepts hash values computed with the SHA256 algorithm. Multiple hash value matches can be combined with `[<SHA256>, ...]` which translates to `<SHA256> OR ...`

Query	Result
`file.hash:275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f`	Returns all emails with an attachment whose SHA256 hash value equals 5a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

Query syntax
Arguments
Examples

Query	Description
`file.type:<Match>`	Returns all emails that contain a file matching the xorlab Security Platform extracted file type

Argument	Description
`Match`	Accepts strings and wildcards (using `matches:`). Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`.

Query	Result
`file.type:document`	Returns all emails with attachments of the `document` type
`file.type:[exe, document]`	Returns all emails with attachments of the `exe` or `document` type

Query syntax
Arguments
Examples

Query	Description
`file.topic:<Match>`	Returns all emails with a given topic in an attachment

Argument	Description
`Match`	Accepts strings (case-insensitive). Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`. See topic detection for possible values

Query	Result
`file.topic:sexualcontent`	Returns all emails with the topic `sexualcontent` in an attachment
`file.topic:[sexualcontent,invoice]`	Returns all emails with one of the topics `sexualcontent` or `invoice` in an attachment

Query syntax
Arguments
Examples

Query	Description
`verdict: <Verdict>`	Returns all emails that contain a file with a given verdict class or with a specific verdict

Argument	Description
`Verdict`	Accepts `activex`, `archive`, `data`, `dde`, `document`, `embobject`, `encrypted`, `executable`, `extobject`, `flash`, `image`, `iso`, `legacy`, `script`, `shortcut`, and `vbascript`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[<Verdict>, ...]`

Query	Result
`verdict:activex`	Returns all emails containing an attachment with ActiveX content

Email headers

xorlab Security Platform supports searching across the message header name and values.

Query syntax
Arguments
Examples

Query	Description
`header.<Part>:<Match>`	Returns all emails that contain a header matching the given name or value

Argument	Description
`Part`	Accepts `name` or `value`
`Match`	Accepts strings and wildcards. Multiple matches can be combined with `[<Match>, ...]` which translates to `<Match> OR ...`

Query	Result
`header.name:"x-spam-score"`	Returns all emails that contain a header with the `x-spam-score` name
`header.name:"*malicious"`	Returns all emails that contain a header name that ends with `malicious`
`header:{name:"x-spam-result" AND value:"MIME_HTML_ONLY"}`	Returns all emails with `MIME_HTML_ONLY` in the `x-spam-result` header

Predefined filters

Filter	Description
`messages`	Returns all processed emails from regular mail traffic
`reported`	Returns all emails that were reported as suspicious
`quarantine:<QuarantineLabel>`	Returns all emails from a given quarantine, where `<QuarantineLabel>` accepts `malware`, `phishing`, `extortion`, `impersonation`, `fraud` (deprecated), `filter`, and `spam` Examples: - `quarantine:malware` returns all emails that contained malware - `quarantine:impersonation quarantine:phishing` returns all emails that impersonated somebody to deliver a phishing link
`files`	Returns all uploaded files

Queries using rules

Query syntax
Arguments
Examples

Query	Description
`rule:<Rule>`	Returns all emails for which the specified rule has been executed during the processing of the email
`passiverule:<Rule>`	Returns all emails for which the specified rule has been executed, but was configured as passive, so it did not influence the decision or tags

Argument	Description
`Rule`	Accepts any rule name. A rule name must contain only lower and upper-case letters and no other character except underscore

Query	Result
`rule:TAG_link_no_reputation`	Returns all emails for which the rule `TAG_link_no_reputation` was applied. The rule adds the `#noreputation` hashtag to an email, as the name of the rule suggests

​Key features

​Search query basics

​How the logic works

​For example:

​Email attributes

​Senders and recipients

​Multi-tenant

​Direction

​Date and time

​Tags

​Scores

​Verdicts

​Verdict confidences

​Processing status

​Email content

​Topics

​Body

​Subject

​Embedded links

​Embedded domains

​Email attachments

​Email headers

​Predefined filters

​Queries using rules