Set Up the SSQ

​

Quickstart

1. Choose how end-users should access the SSQ.
   Preferred: Auto-Login

   Via Auto-Login, users can access their SSQ by just clicking on the link in the quarantine notifications. Follow Auto-Login Setup Guide to set it up

   SAML or LDAP

   End-users authenticate via SAML or LDAP to access the SSQ. If this has not yet been setup:

   • SaaS: Follow M365 SAML Login
   • On-prem: Follow On-prem SAML or LDAP Login
2. If you use Auto-login, this step can be skipped. Otherwise: Assign the xcc_quarantine_user role to the users that should be able to access the SSQ. Depending on the user login, this looks different:
   SAML

   1. Assign the users a dedicated SSQ role in your IDP. We name it here saml_xor_quarantine_user.
   2. Add the role mapping to auth.yml under your SAML backend in saml2AuthBackends:
      auth.yml

      roleMapping:
        xcc_quarantine_user:
        - saml_xor_quarantine_user
      

   LDAP

   1. Assign the users a dedicated SSQ role in your Active Directory. We name it here ldap_xor_quarantine_user.
   2. Add the role mapping to auth.yml under your LDAP configuration in ldapAuthDataSources:
      auth.yml

      roleMapping:
        xcc_quarantine_user:
        - ldap_xor_quarantine_user
      

   Local user

   1. Open the file auth/auth/passwordFile.yml
   2. Add the role to the user that should access the SSQ:

   passwordFile.yml

   users:
     - username: admin
       roles:
         - xcc_quarantine_user
   

   Click Publish. The authentication configuration becomes active within about one minute, and the users should then be able to access the SSQ in xorlab.
3. Review the default quarantine permissions. No action is required if the default works for you.

   Permission	Description	Default
   canView	Users can view emails in their SSQ	true for all quarantines
   canRelease	Users can release emails in their SSQ	true for Phishing and Spam, false for all other quarantines
   canRequestRelease	Users can request the release of emails, and an Analyst/Admin needs to confirm it. Works only when canRelease is disabled	false for all quarantines
   To see all quarantines and their defaults: List of Quarantines.
   To overwrite the permission of a quarantine, add the following to guarded_tenants.yml:

   shared/guarded_tenants.yml

   tenants:
     - name: xorlab
       quarantine:
         quarantines:
             ## Add the quarantines here where you want to overwrite the default configuration
             - name: Malware
               canView: true
               canRelease: false
               canRequestRelease: true
   

4. Open the file shared/email_templates/info/default.yml and set the following parameters. They will be shown in the footer of the quarantine notifications.
   The url parameter must be set to the URL of your xorlab
   default.yml

   name: "Example, Inc."
   details: "Security Operations Center"
   email: "secops@example.com"
   url: "https://xyz.activeguard.cloud"
   provider: "xorlab AG"
   
5. Customize the quarantine notifications such that they match your organization brand. All customizations are described under Customize Templates. We recommend to at least change the Logo.
6. Optional: Adjust the sender address that is used for quarantine notifications: Change Sender Address. The default is quarantine@<templateDomain>.
7. Enable quarantine notifications and choose their frequency. The frequency can be overwritten by each user individually in their SSQ. Notifications are only sent for quarantines with canView: true.
   shared/guarded_tenants.yml

   tenants:
     - name: xorlab
       quarantine:
         notifications:
           enabled: true
           frequency: DAILY
           ## - NEVER: Sending of a quarantine notification is disabled for the user.
           ## - IMMEDIATELY: Sending of a quarantine notification happens immediately if a message for the user is quarantined.
           ## - DAILY: Sending the quarantine notification every day at the time specified in the dailyCron option.
           ## - WEEKLY: Sending the quarantine notification once a week at the time specified in the weeklyCron option.
   

   Daily/Weekly notifications

   You can adjust the frequency and timing of daily and weekly digest notifications like this:

   shared/guarded_tenants.yml

   tenants:
     - name: xorlab
       quarantine:
         notifications:
           enabled: true
           frequency: DAILY
         digest:
            ## The maximum number of recent quarantined messages mentioned in the daily/weekly digest email.
            mentionedEntries: 10
            ## Daily digest frequency. It must be written in the following format (default: send daily digest at the beginning of each workday):
            ## .------------------ second (0 - 59)
            ## | .---------------- minute (0 - 59)
            ## | | .-------------- hour (0 - 23)
            ## | | | .------------ day of month (must be a *)
            ## | | | | .---------- month (must be a *)
            ## | | | | | .-------- period of week (e.g., MON-FRI)
            ## * * * * * *
            ## Note that sending daily digest emails is not instantaneous and takes at least `shippingTimespanMinutes`
            dailyCron: "0 0 0 * * MON-FRI"
            ## Weekly digest frequency. It must be written in the following format (default: send weekly digest at the beginning of each work weak):
            ## .------------------ second (0 - 59)
            ## | .---------------- minute (0 - 59)
            ## | | .-------------- hour (0 - 23)
            ## | | | .------------ day of month (must be a *)
            ## | | | | .---------- month (must be a *)
            ## | | | | | .-------- day of week (MON, TUE, WED, THU, FRI, SAT, or SUN)
            ## * * * * * *
            ## Note that sending weekly digest emails is not instantaneous and takes at least `shippingTimespanMinutes`
            weeklyCron: "0 0 0 * * MON"
            ## Default time zone of this tenant.
            zoneId: "Europe/Zurich"
   
   More information

   The frequency above is the global default. Users can change it in their own SSQ. Shared mailboxes: Every user with access to a mailbox can configure the notification settings for that specific mailbox. The notification setting per mailbox is global, so for shared mailboxes the setting is changeable by every user that has SSQ access to that mailbox. Reset frequency: As soon as a user logged in to their SSQ the first time, they will not be affected anymore when you change the frequency. Therefore, to reset the notification frequency of all users, you can use these database queries:

   SELECT * FROM xcc.user_settings_quarantine_notification;
   UPDATE xcc.user_settings_quarantine_notification SET frequency='IMMEDIATELY' WHERE frequency='NEVER';
   
8. Click Publish. The new configuration becomes active within about one minute.

​

Configure additional SSQ features

​

Multi-Tenancy