> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Search
> Locate messages with autocomplete-assisted queries, then reuse a query as a saved view or promote it to a campaign.
Search in xorlab helps you find any message in seconds using intuitive filters, tags, time ranges, and wildcards, and keeps track of your recent queries.
## Key features
* **Autocomplete Suggestions:** As you type, the search bar provides real-time suggestions, reducing the need to memorize search syntax.
* **Filter Options:** You can easily filter your results by sender, recipient, subject, or other key attributes by selecting options from a dropdown menu.
* **Time Range Selection:** The search bar includes a built-in time range selector to refine your searches by date without manually entering date strings.
* **Wildcard Characters:** Wildcards are automatically supported with `?` matching a single character and `*` matching zero or more characters.
* **Tag-based Search:** Easily search and aggregate emails using case-insensitive tags (e.g., #phishing, #highrisk) to filter or group emails. For the complete list, please see [*Tags*](/latest/tags).
* **Recent Searches:** Access the four last searches by clicking the search bar, allowing easy recall of previous queries for ongoing investigations or repetitive tasks.
* **Campaign Creation:** If a search query is [Campaign](/latest/campaigns) compatible, you can click the icon in the search bar to directly turn the query into an adaptive policy.
* **Save Searches:** There's also an icon in the search bar that enables you to save the search query for later use.
## All search attributes
Every attribute the search understands is listed below, with the section that documents
its accepted values. Anything not in this table is not a valid search attribute: a query
that uses one returns no results rather than an error, so it is worth checking the name
here before assuming a search found nothing.
| Attribute | What it matches | Details |
| :- | :- | :- |
| `sender:` `recipient:` | The header or the SMTP address, whichever matches | [Senders and recipients](#senders-and-recipients) |
| `from:` `to:` `cc:` | The corresponding header only | [Senders and recipients](#senders-and-recipients) |
| `envfrom:` `envrecipient:` | The SMTP envelope address only | [Senders and recipients](#senders-and-recipients) |
| `involves:` | Any of `from`, `to`, `cc`, `envfrom`, `envrecipient` | [Senders and recipients](#senders-and-recipients) |
| `reporter:` | Who reported an incident | [Senders and recipients](#senders-and-recipients) |
| `.displayname:` | The display name, where `` is `sender`, `recipient`, `from`, `to`, `cc`, or `involves` | [Senders and recipients](#senders-and-recipients) |
| `tenant:` `tenant.uid:` | The assigned tenant. No wildcards | [Multi-tenant](#multi-tenant) |
| `direction:` | Incoming, outgoing, internal, or external | [Direction](#direction) |
| `received:` | When the email was received, as a point or a range | [Date and time](#date-and-time) |
| `#` | A tag the platform assigned | [Tags](#tags) |
| `trust:` `reputation:` `risk:` `threat:` | A score, as a comparison, an interval, or a level | [Scores](#scores) |
| `spam:` `rsd:` | A score, as a comparison or an interval. These two have no level form | [Scores](#scores) |
| `verdict:` | A verdict class, an email verdict, or a file analysis verdict | [Verdicts](#verdicts), [Email attachments](#email-attachments) |
| `status:` | The state of an email, a reported email, or an uploaded file | [Processing status](#processing-status) |
| `topic:` | A detected topic anywhere in the email | [Topics](#topics) |
| `subject.topic:` `body.topic:` `file.topic:` | A detected topic in one part of the email | [Subject](#subject), [Body](#body), [Email attachments](#email-attachments) |
| `subject:` | The subject line | [Subject](#subject) |
| `link:` `link.displaytext:` `link.location:` | An extracted link, its display text, or where it was found | [Embedded links](#embedded-links) |
| `domain:` `domain.ip:` `domain.date:` | An extracted domain, its IP, or its registration date | [Embedded domains](#embedded-domains) |
| `domain.local:` `domain.global:` | The local or global reputation of a domain | [Embedded domains](#embedded-domains) |
| `file.name:` `file.hash:` `file.type:` | An attachment by name, SHA256 hash, or extracted type | [Email attachments](#email-attachments) |
| `header.name:` `header.value:` `header:{…}` | A message header, by name, by value, or by both at once | [Email headers](#email-headers) |
| `messages` `reported` `files` `quarantine:` | A predefined set of emails or files | [Predefined filters](#predefined-filters) |
| `rule:` `passiverule:` | A rule that ran during processing, or one that ran passively without affecting the outcome | [Queries using rules](#queries-using-rules) |
Verdict confidence has no attribute of its own and is matched through `rule:`, see
[Verdict confidences](#verdict-confidences).
## Search query basics
You can build powerful search queries using a combination of **filters**, **verdicts** and **tags**, and simple **logic** like `and`, `or`, and `not`.
### How the logic works
Search queries are made up of **statements** — simple conditions like filters (`status:open`) or tags (`#quarantine`) — connected using logical operators:
* `and`: both conditions must match
* `or`: at least one condition must match
* `not`: exclude anything that matches the expression
#### For example:
`#domainonlyinbound #inc #untrusted not(#crm or #marketing or #newsletter)`
The strongest operator is `not` followed by `and` and then by `or`. Multiple statements without any operator are always treated as `and`. Group statements with parentheses whenever you mix operators: `#inc and #phishing or #spam` also returns outgoing spam, while `#inc and (#phishing or #spam)` does not.
### Special characters
| Syntax | Meaning | Example |
| :- | :- | :- |
| `( )` | Groups statements | `#inc and (#phishing or #spam)` |
| `[a, b]` | Matches any of the listed values, like `or` | `status:[delivered,quarantined]` |
| `[a TO b]` | Matches an inclusive range, for [scores](#scores) and dates | `threat:[50 TO 100]` |
| `{ }` | Applies every condition inside to the same object, such as one header | `header:{name:"x-spam-result" AND value:"*MIME_HTML_ONLY*"}` |
| `*` `?` | Matches any number of characters, or exactly one | `subject:"*invoice*"` |
| `" "` | Treats the value as one string. Required when it contains a space or one of `:` `#` `(` `)` `[` `]`; escape a quote inside it with `\"` | `subject:"Password Reset"` |
## Email attributes
Every email has base attributes automatically set by xorlab, such as the sender, recipient, and timestamp. You can search using these attributes with the syntax `attribute:value`.
### Senders and recipients
| Query | Description |
| - | - |
| `sender:` | Returns emails where the header `from:` or the SMTP `from` address matches `` |
| `recipient:` | Returns emails where the header `to:` or `cc:` or the SMTP `to` address match `` |
| `from:` | Returns emails where the header `from:` (a.k.a. `mail-from` or `5322.From`) matches `` |
| `to:` | Returns emails where the header `to:` matches `` |
| `cc:` | Returns emails where the header `cc:` matches `` |
| `involves:` | Returns emails where either `from`, `to`, `cc`, `envfrom`, or `envrecipient` match `` |
| `reporter:` | Returns incidents reported by `` |
| `envfrom:` | Returns emails where the SMTP `from` address (a.k.a. `envelope-from` or `5321.From`) matches `` |
| `envrecipient:` | Returns emails where the SMTP `to` address (a.k.a. `envelope-to` or `5321.To`) matches `` |
| Argument | Description |
| :- | - |
| ` ` | Accepts fully qualified email addresses and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| - | - |
| `from:albert@timespace.com` | Returns all emails where the header `from:` field contains `albert@timespace.com` |
| `to:*.net` | Returns all emails that contain a .net domain in the header `to:` field |
| `from:[marie@radio.org,isaac@gravity.net]` | Returns all emails with `mail-from = from:marie@radio.org` OR `mail-from = from:isaac@gravity.net` |
| `cc:[marie*,*isaac]` | Returns all emails whose header `cc:` field starts with the token `marie` or ends with the token `isaac` |
| Query | Description |
| - | - |
| `.displayname:` | Returns all emails for the specified address type that have the given display name |
| Argument | Description |
| :- | - |
| `` | Accepts `sender`, `recipient`, `from`, `to`, `cc`, `involves` |
| `` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the display name to be matched contains spaces, then you must enclose it in double quotes. Use `\` to escape quotes |
| Query | Result |
| - | - |
| `from.displayname:"Albert E."` | Returns all emails where a sender display name contains `Albert E.` |
| `from.displayname:"R* Fey*"` | Returns all emails where the sender display name starts with the character `R` and ends with the string `Fey` separated by a space |
| `to.displayname:[Albert, Richard]` | Returns all emails where the recipient display name is either `Albert` or `Richard` |
| `cc:[marie*,*isaac]` | Returns all emails where a cc address starts with `marie` or ends with `isaac` |
### Multi-tenant
| Query | Description |
| - | - |
| `tenant:` | Returns emails where the assigned tenant matches the `` defined in guarded\_tenants.yml |
| `tenant.uid:` | Returns emails where the tenant's unique `uid` identifier matches `` |
| Argument | Description |
| :- | - |
| `` | Accepts the value of the `uid` attribute defined in `/shared/guarded_tenants.yml` |
| `` | Accepts the value of the `` attribute defined in `/shared/guarded_tenants.yml` |
| These search attributes do not support use of wildcard characters `?` and `*`. | |
| Query | Result |
| - | - |
| `tenant:timespace.com` | Returns all emails of the tenant `timespace.com` |
| `tenant.uid:db3953f5-2aba-42b1-b038-115d55c56f422` | Returns emails of the tenant whose `uid` matches `db3953f5-2aba-42b1-b038-115d55c56f422` |
| `tenant:[radio.org,gravity.net]` | Returns all emails of the tenant `radio.org` OR the tenant `gravity.net` |
### Direction
| Query | Description |
| - | - |
| `direction:` | Returns emails that were sent, received, exchanged internally, or processed on behalf of a third party |
| Argument | Description |
| :- | - |
| `` | Accepts `incoming`, `outgoing`, `internal`, `external`. Multiple direction matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| - | - |
| `direction:incoming` | Returns emails sent from external parties to recipients inside the protected organization |
| `direction:outgoing` | Returns emails sent from the members of the protected organization to external parties |
| `direction:internal` | Returns emails sent between members of the protected organization |
| `direction:external` | Returns emails sent from external parties to external parties (as it typically happens if an MTA forwards external emails) |
### Date and time
| Query | Description |
| - | - |
| `received:since: \| \|` | Returns emails that were received since the specified date and time |
| `received:before: \| \|` | Returns emails that were received before the specified date and time |
| `received:[ TO ]` | Returns emails that were received in the specified date and time interval (inclusive) |
| Argument | Description |
| :- | - |
| `Keyword` | Accepts `today`, `noon`, `midnight`, `yesterday` |
| `DateString` | Accepts a date time string in the following formats: - `dd.mm[.yyyy][,hh:mm]` where `yyyy` and `hh:mm` are optional - `[yyyy-]mm-dd[,hh:mm]` where `yyyy` and `hh:mm` are optional - `[yyyy-]mmm-dd[,hh:mm]` where `mmm = {jan, feb, mar, apr, jun, jul, aug, sep, oct, nov, dec}` and `yyyy` and `hh:mm` are optional |
| `RelativeDateString` | Accepts a string in the following format `` that indicates the current date minus `` number of `` days, of `` weeks, or of `` months |
| Query | Result |
| - | - |
| `received:since:noon` or `received:since:today,noon` | Returns all emails received since today 12:00 |
| `received:since:today,midnight` | Returns all emails received since today 00:00 |
| `received:since:sep-20,12:30` | Returns all emails received since 12:30, September 20 of the current year |
| `received:since:2020-09-20` or `received:since:20.09.2020` | Returns all emails received since September 20, 2020 |
| `received:since:3d` | Returns all emails received within the past three days (current time—72h) |
### Tags
xorlab Security Platform enriches processed emails with tags to simplify correlation and retrieval.
| Query | Description |
| - | - |
| `#` | Returns all emails that were tagged with `` |
| Argument | Description |
| :- | - |
| `String` | Accept any string. String values are parsed as described in the [*Tags*](/latest/tags) reference. Multiple tags are combined with logical `AND` |
| Query | Result |
| - | - |
| `#inc` | Returns all incoming emails |
| `#inc AND #trusted AND #word` | Returns all incoming emails from trusted senders that have a Word file attached |
| `#out AND #encryptedarchive` | Returns all outgoing emails that have an encrypted archive attached |
| `#inc AND #highrisk AND #newsender AND #exposedhvt AND #file` | Returns all incoming emails from senders never-before-seen to a high-value target that have a high-risk score and at least one file attached |
| `#untrusted AND #newdomain AND #exposedhvt` | Returns all emails from untrusted senders to high-value targets that contain at least one link with a domain never-before-seen |
| `#inc AND #highrisk AND #untrusted AND #newsender AND #cloudstorage` | Returns all incoming emails with a high-risk score from untrusted and unknown senders that contain at least one link to a cloud storage platform |
| `#inc AND #highrisk AND #newsender AND #shortenednolocalreputation` | Returns all incoming emails with a high-risk score from senders never-before-seen that contain a shortened link which points to a URL that has no local reputation (meaning it is not relevant to the organization) |
| `#inc AND #trusted AND #dangerousvbascript` | Returns all incoming emails from trusted senders that contain at least one Office file with a VBA script that makes use of potentially dangerous functions |
| `#inc AND #trusted AND #cracked AND #executable` | Returns all incoming emails from trusted senders with a cracked, encrypted attachment and an executable file attached |
| `#inc AND #runtime` | Returns all incoming emails with an attachment that triggered a suspicious runtime event (as observed in the Sandbox) |
| `#pdf AND #cfiviolation` | Returns all emails with a PDF document attached that triggered a CFI violation in the Sandbox (most likely an exploit) |
### Scores
xorlab Security Platform generates several scores for each processed email. Each score is a function of the organization’s email history and the email being processed.
| Query | Description |
| - | - |
| `::` | Returns all emails with the specified score in a given range |
| `:[ TO ]` | Returns all emails with a `` in the specified interval (inclusive) |
| Argument | Description |
| :- | - |
| `Score` | Accepts `trust`, `reputation`, `risk`, `threat`, `spam`, and `rsd`: - `trust` denotes the overall trust score — the [relationship](/latest/concepts-relationship) value — and assumes a value between 0 and 100 - `reputation` denotes the reputation of the sending domain and assumes a value between 0 and 100 - `risk` quantifies the attack surface of an email and assumes a value between 0 and infinity - `threat` is a function of `risk`, `trust`, `reputation` and classification, and quantifies the threat that an email poses to the organization; the score assumes a value between 0 and 100 - `spam` quantifies the likelihood of an email being spam; the score assumes a value between negative and positive infinity - `rsd` is the rspamd score of the email; the score assumes a value between negative and positive infinity |
| `Relation` | Accepts `eq` (equal), `gt` (greater than), `gte` (greater than or equal), `lt` (less than) and `lte` (less than or equal) |
| `Number` | Accepts integers (for scores `trust`, `reputation`, `risk`, `threat`) and floating point values (for `spam`) |
| Query | Result |
| - | - |
| `reputation:gt:50` | Returns all emails where the reputation score is greater than 50. The reputation is a score associated with authenticated senders based on the global and local reputation of the domain |
| `spam:lt:0` | Returns all emails with a negative spam score |
| Query | Description |
| - | - |
| `:` | Returns all emails with a `` at least `` |
| Argument | Description |
| :- | - |
| `Score` | Accepts `trust`, `reputation`, `risk`, and `threat` (see previous table) |
| `Level` | Accepts `low`, `medium`, `high` and additionally `noauth` and `trusted` if `Score = reputation`: - `noauth` indicates that the sender of an email could not be authenticated - `trusted` indicates that the email sender could be authenticated and that sender `trust` is greater than 0 - `low` captures values between 0 and 50 if `Score = risk` and values between 0 and 34 otherwise - `medium` captures values between 51 and 75 if `Score = risk` and values between 35 and 67 otherwise - `high` captures values greater 75 if `Score = risk` and values between 68 and 100 otherwise |
### Verdicts
| Query | Description |
| - | - |
| `verdict: \| \|` | Returns all emails from a given verdict class or with a specific verdict. For more information about verdicts, please see [*Verdicts*](/latest/verdicts) |
| Argument | Description |
| :- | - |
| `Class` | Accepts `benign`, `malicious`, and `undecided`. Note that `benign` does not include `simulation` |
| `Malicious Verdict` | Accepts `bec`, `blacklist`, `extortion`, `filter`, `impersonation`, `malware`, `malware_static`, `malware_dynamic`, `phishing`, `policy`, and `vipfraud`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[, ...]` |
| `Benign Verdict` | Accepts `bulk`, `business`, `cloudstorage`, `crm`, `external`, `forwarded`, `freemail`, `internal`, `marketing`, `newsletter`, `partner`, `personal`, `poll`, `popular`, `reputable`, `simulation`, `socialnetwork`, `survey`, and `trusted`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[, ...]` |
| Query | Result |
| - | - |
| `verdict:malware` | Returns all emails containing malware, detected either statically or in the Sandbox |
| `verdict:malware_dynamic` | Returns only emails whose malware was detected in the [Sandbox](/latest/xorlab-sandbox). Use `verdict:malware_static` for statically detected malware |
| `verdict:policy` | Returns all emails with a Policy **or** Blacklist verdict. Use `verdict:filter` to match only Policy |
| `verdict:simulation` | Returns all emails that are part of some simulated awareness campaign |
| `verdict:bulk` | Returns all emails that are part of a bulk campaign |
### Verdict confidences
To search for emails with a certain verdict confidence, you need to make use of the `rule:` search feature described [further in this article](#predefined-filters). The verdicts that are not listed in the following table do not have different confidences.
| Verdict | Description |
| :- | :- |
| Phishing | **High:** `rule:PHISHING_high_confidence_decision` **Med:** `rule:PHISHING_medium_confidence_decision` **Low:** `rule:PHISHING_low_confidence_decision` |
| Spam | **High:** `rule:SPAM_high_confidence_decision` **Med:** `rule:SPAM_medium_confidence_decision` **Low:** `rule:SPAM_low_confidence_decision` |
| VIP Fraud | **High:** `rule:VIP_FRAUD_high_confidence_decision` **Med:** `rule:VIP_FRAUD_medium_confidence_decision` |
| Impersonation | **High:** `rule:IMPERSONATION_high_confidence_decision` **Med:** `rule:IMPERSONATION_medium_confidence_decision` |
| Policy (Filter) | **High:** `rule:FILTER_high_confidence_decision` **Med:** `rule:FILTER_medium_confidence_decision` |
### Processing status
| Query | Description |
| - | - |
| `status:` | Returns emails that are in the specified processing status. The value of `` depends on the type of email, whether it was quarantined or whether somebody reported it as suspicious |
| Argument | Description |
| :- | :- |
| `ProcessingStatus` | - Accepts `delivered`, `quarantined`,` released`, `dropped`, `bounced`, `pending`, `smtperror` for emails from the normal mail flow - Accepts `open`, `resolved`, and `pending` for emails reported as suspicious - Accepts `completed` and `pending` for reported and uploaded suspicious files - Emails with `status:pending` can be in the state of `processing:ongoing` or `processing:error` - Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| - | - |
| `status:delivered` | Returns all emails from normal mail flow that were delivered either to the recipient’s mailbox (incoming emails) or to the Internet (outgoing emails) |
| `status:quarantined` | Returns all emails from normal mail flow that were quarantined. Emails in this state can be [filtered](#predefined-filters) with `quarantine:` |
| `status:released` | Returns all emails that were released from quarantine |
| `status:dropped` | Returns all emails from normal mail flow that were dropped (i.e., deleted and not delivered) |
| `status:pending` | Returns all emails that are currently being processed or caused an error while processing. Emails in this status can be filtered with `processing:ongoing` or `processing:error` |
| `status:smtperror` | Returns all emails that have failed in delivery |
| `status:open` | Returns all reported emails that require further analysis |
| `status:resolved` | Returns all reported emails that were resolved, either automatically by the platform or manually by an analyst |
## Email content
### Topics
The `topic` keyword allows searching for topics found in any part (body, subject and attachment) of the email.
| Query | Description |
| - | - |
| `topic:` | Returns all emails with a given topic |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings (case-insensitive). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. See [topic detection](/latest/topic-detection) for possible values |
| Query | Result |
| - | - |
| `topic:sexualcontent` | Returns all emails with the topic `sexualcontent` |
| `topic:[sexualcontent,invoice]` | Returns all emails with one of the topics `sexualcontent` or `invoice` |
### Body
The `body` keyword allows searching topics in the email's plaintext or HTML body parts.
| Query | Description |
| - | - |
| `body.topic:` | Returns all emails with a given topic in the email body (HTML or plaintext part) |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings (case-insensitive). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. See [topic detection](/latest/topic-detection) for possible values |
| Query | Result |
| - | - |
| `body.topic:sexualcontent` | Returns all emails with the topic `sexualcontent` in the email body |
| `body.topic:[sexualcontent,invoice]` | Returns all emails with one of the topics `sexualcontent` or `invoice` in the email body |
### Subject
| Query | Description |
| - | - |
| `subject:` | Returns all emails with a given subject |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings (case-insensitive) and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the subject to be matched contains spaces, then you must enclose the subject string in double quotes. Use `\` to escape quotes |
| Query | Result |
| - | - |
| `subject:"How the world works"` | Returns all emails with a subject equal to `How the world works` |
| `subject:"This is \"a laser\""` | Returns all emails with a subject equal to `This is "a laser"` |
| `subject:[The*,*world*]` | Returns all emails with a subject that begins with `The` or contains `world`, e.g., `The world works like this` |
| Query | Description |
| - | - |
| `subject.topic:` | Returns all emails with a given topic in the subject |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings (case-insensitive). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. See [topic detection](/latest/topic-detection) for possible values |
| Query | Result |
| - | - |
| `subject.topic:sexualcontent` | Returns all emails with the topic `sexualcontent` in the subject |
| `subject.topic:[sexualcontent,invoice]` | Returns all emails with one of the topics `sexualcontent` or `invoice` in the subject |
### Embedded links
xorlab Security Platform extracts links from the email body and attached documents.
| Query | Description |
| - | - |
| `link:` | Returns all emails that contain the matching link |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the link to be matched contains the reserved characters (i.e., `:`, `#`, `(`, `)`, `[`, `]` ), then you must enclose the link in double quotes. Use `\` to escape quotes |
| Query | Result |
| - | - |
| `link:"http://www.xorlab.com"` | Returns all emails that contain at least one link to [xorlab.com](http://www.xorlab.com/) |
| `link:"http://www.xorlab.*"` | Returns all emails that contain at least one link that starts with [*http://www.xorlab*](http://www.xorlab) |
| Query | Description |
| - | - |
| `link.displaytext:` | Returns all emails that contain a link matching the given display text |
| | Description |
| :- | :- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the display text of a link to be matched contains spaces, then you must enclose the display text string in double quotes. Use `\` to escape quotes |
| Query | Result |
| - | - |
| `link.displaytext:"Click me!"` | Returns all emails that contain at least one link with the display text `Click me!` |
| `link.displaytext:"Click *!"` | Returns all emails that contain at least one link with the display text that starts with `Click ` and that ends with `!` |
| `link.displaytext:["Click me!", "Click here!"]` | Returns all emails that contain at least one link with the display text `Click me!` or `Click here!` |
| Query | Description |
| - | - |
| `link.location:` | Returns all emails that contain a link in the given location (e.g., message body or a message attachment) |
| Argument | Description |
| :- | :- |
| `Location` | Accepts `body` and `attachment` |
| Query | Result |
| - | - |
| `link.location:body` | Returns all emails that contain at least one link within their body |
### Embedded domains
xorlab Security Platform extracts domains from the links it finds in the email body and attachments. This includes domains that surface in network activity during dynamic file analysis.
| Query | Description |
| - | - |
| `domain:` | Returns all emails that contain a given domain |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| - | - |
| `domain:xorlab.com` | Returns all emails that contain at least one link to the [xorlab.com](http://www.xorlab.com/) domain |
| `domain:[*xorlab.com,*xorlab.ch]` | Returns all emails that contain at least one link to the subdomains of [xorlab.com](http://www.xorlab.com/) and [xorlab.ch](http://www.xorlab.ch/) |
| Query | Description |
| - | - |
| `domain.date:since: \| \| ` | Returns emails that contain a domain registered since the specified [date and time](#date-and-time) |
| `domain.date:before: \| \| ` | Returns emails that contain a domain registered before the specified [date and time](#date-and-time) |
| `domain.date:[ TO ]` | Returns emails that contain a domain registered in the specified date and time interval (inclusive) |
| `domain.ip:` | Returns emails that contain a domain with the specified IP |
| Argument | Description |
| :- | :- |
| `IpValue` | Accepts a valid IP version 4. Multiple IP matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| - | - |
| `domain.ip:172.217.10.78` | Returns all emails that contain at least one domain with the IP matching `172.217.10.78` |
| Query | Description |
| - | - |
| `domain.(local \| global)::` | Returns emails that contains a domain with the local or global reputation system score within [a given range](#scores) |
| Argument | Description |
| :- | :- |
| `Relation` | Accepts `eq` (equal), `gt` (greater than), `gte` (greater than or equal), `lt` (less than) and `lte` (less than or equal) |
| `Number` | Accepts integers (for scores `trust`, `reputation`, `risk`, `threat`) and floating point values (for `spam`) |
| Query | Result |
| - | - |
| `domain.global:gt:5` | Returns all emails that contain a domain with a global reputation greater than 5 |
| `domain.local:lt:5` | Returns all emails that contain a domain with a local reputation lower than 5 |
## Email attachments
xorlab Security Platform supports file name and file hash filters as well as specific file analysis verdicts.
| Query | Description |
| - | - |
| `file.name:` | Returns all emails that contain a file matching the given term |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. If the link display text to be matched contains spaces, then you must enclose the link display text string in double quotes. Use `\` to escape quotes |
| Query | Result |
| - | - |
| `file.name:"Please open.exe"` | Returns all emails with an attachment named `Please open.exe` |
| `file.name:*.exe` | Returns all emails with an attachment that ends with `.exe` |
| `file.name:[*exe, *hta, *bat]` | Returns all emails with attachments name ending with the tokens `exe`, `hta` or `bat` |
| Query | Description |
| - | - |
| `file.hash:` | Returns all emails that contain a file matching the given SHA256 hash value |
| Argument | Description |
| - | - |
| `SHA256` | Accepts hash values computed with the SHA256 algorithm. Multiple hash value matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| - | - |
| `file.hash:275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f` | Returns all emails with an attachment whose SHA256 hash value equals `275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f` |
| Query | Description |
| - | - |
| `file.type:` | Returns all emails that contain a file matching the xorlab Security Platform extracted file type |
| Argument | Description |
| - | - |
| `Match` | Accepts strings and wildcards (using `matches:`). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. |
| Query | Result |
| - | - |
| `file.type:document` | Returns all emails with attachments of the `document` type |
| `file.type:[exe, document]` | Returns all emails with attachments of the `exe` or `document` type |
| Query | Description |
| - | - |
| `file.topic:` | Returns all emails with a given topic in an attachment |
| Argument | Description |
| :- | :- |
| `Match` | Accepts strings (case-insensitive). Multiple matches can be combined with `[, ...]` which translates to ` OR ...`. See [topic detection](/latest/topic-detection) for possible values |
| Query | Result |
| - | - |
| `file.topic:sexualcontent` | Returns all emails with the topic `sexualcontent` in an attachment |
| `file.topic:[sexualcontent,invoice]` | Returns all emails with one of the topics `sexualcontent` or `invoice` in an attachment |
| Query | Description |
| - | - |
| `verdict: ` | Returns all emails that contain a file with a given verdict class or with a specific verdict |
| Argument | Description |
| - | - |
| `Verdict` | Accepts `activex`, `archive`, `data`, `dde`, `document`, `embobject`, `encrypted`, `executable`, `extobject`, `flash`, `image`, `iso`, `legacy`, `script`, `shortcut`, and `vbascript`. Multiple verdict matches can be combined with a comma-separated list (which is similar to logical `OR`) using the special syntax `:[, ...]` |
| Query | Result |
| - | - |
| `verdict:activex` | Returns all emails containing an attachment with ActiveX content |
## Email headers
xorlab Security Platform supports searching across the message header name and values.
| Query | Description |
| - | - |
| `header.:` | Returns all emails that contain a header matching the given name or value |
| `header:{name: AND value:}` | Returns all emails that contain one header matching both the name and the value |
| Argument | Description |
| :- | :- |
| `Part` | Accepts `name` or `value` |
| `Match` | Accepts strings and wildcards. Multiple matches can be combined with `[, ...]` which translates to ` OR ...` |
| Query | Result |
| - | - |
| `header.name:"x-spam-score"` | Returns all emails that contain a header with the `x-spam-score` name |
| `header.name:"*malicious"` | Returns all emails that contain a header name that ends with `malicious` |
| `header:{name:"x-spam-result" AND value:"*MIME_HTML_ONLY*"}` | Returns all emails with `MIME_HTML_ONLY` in the `x-spam-result` header |
## Predefined filters
| Filter | Description |
| - | - |
| `messages` | Returns all processed emails from regular mail traffic |
| `reported` | Returns all emails that were reported as suspicious |
| `quarantine:` | Returns all emails from a given quarantine, where `` accepts `malware`, `phishing`, `extortion`, `impersonation`, `fraud` (deprecated), `filter`, and `spam` **Examples:** - `quarantine:malware` returns all emails that contained malware - `quarantine:impersonation quarantine:phishing` returns all emails that impersonated somebody to deliver a phishing link |
| `files` | Returns all uploaded files |
### Queries using rules
| Query | Description |
| - | - |
| `rule:` | Returns all emails for which the specified rule has been executed during the processing of the email |
| `passiverule:` | Returns all emails for which the specified rule has been executed, but was configured as passive, so it did not influence the decision or tags |
| Argument | Description |
| - | - |
| `Rule` | Accepts any rule name. A rule name must contain only lower and upper-case letters and no other character except underscore |
| Query | Result |
| - | - |
| `rule:TAG_link_no_reputation` | Returns all emails for which the rule `TAG_link_no_reputation` was applied. The rule adds the `#noreputation` hashtag to an email, as the name of the rule suggests |
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.