> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Set Up the SSQ
> Choose how employees reach the Self-Service Quarantine (SSQ) and what they may do there. It is always on; only access needs configuring.
## Quickstart
1. Choose how end-users should access the SSQ.
Via Auto-Login, users can access their SSQ by just clicking on the link in the quarantine notifications.
Follow [Auto-Login Setup Guide](/latest/authentication-auto-login-link#quickstart) to set it up
End-users authenticate via SAML or LDAP to access the SSQ. If this has not yet been setup:
* **SaaS**: Follow [M365 SAML Login](/latest/m365-saml-entra-authentication)
* **On-prem**: Follow [On-prem SAML or LDAP Login](/latest/on-prem-saml-ldap-authentication)
2. If you use [Auto-login](/latest/authentication-auto-login-link), this step can be skipped. Otherwise: Assign the `xcc_quarantine_user` role to the users that should be able to access the SSQ. Depending on the user login, this looks different:
1. Assign the users a dedicated SSQ role in your IDP. We name it here `saml_xor_quarantine_user`.
2. Add the role mapping to `auth.yml` under your SAML backend in `saml2AuthBackends`:
```yaml auth.yml highlight={2-3} theme={null}
roleMapping:
xcc_quarantine_user:
- saml_xor_quarantine_user
```
1. Assign the users a dedicated SSQ role in your Active Directory. We name it here `ldap_xor_quarantine_user`.
2. Add the role mapping to `auth.yml` under your LDAP configuration in `ldapAuthDataSources`:
```yaml auth.yml highlight={2-3} theme={null}
roleMapping:
xcc_quarantine_user:
- ldap_xor_quarantine_user
```
1. Open the file `auth/auth/passwordFile.yml`
2. Add the role to the user that should access the SSQ:
```yaml passwordFile.yml highlight={4} theme={null}
users:
- username: admin
roles:
- xcc_quarantine_user
```
Click **Publish**. The authentication configuration becomes active within about one minute, and the users should then be able to access the SSQ in xorlab.
3. Review the default quarantine permissions. No action is required if the default works for you.
| Permission | Description | Default |
| :------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------ |
| `canView` | Users can view emails in their SSQ | `true` for all quarantines |
| `canRelease` | Users can release emails in their SSQ | `true` for *Phishing* and *Spam*, `false` for all other quarantines |
| `canRequestRelease` | Users can request the release of emails, and an Analyst/Admin needs to confirm it. Works only when `canRelease` is disabled | `false` for all quarantines |
| To see all quarantines and their defaults: [List of Quarantines](/latest/ssq-list-of-quarantines). | | |
| To overwrite the permission of a quarantine, add the following to `guarded_tenants.yml`: | | |
```yaml shared/guarded_tenants.yml highlight={6-9} theme={null}
tenants:
- name: xorlab
quarantine:
quarantines:
## Add the quarantines here where you want to overwrite the default configuration
- name: Malware
canView: true
canRelease: false
canRequestRelease: true
```
4. Open the file `shared/email_templates/info/default.yml` and set the following parameters. They will be shown in the footer of the quarantine notifications.
**The `url` parameter must be set to the URL of your xorlab**
```yaml default.yml theme={null}
name: "Example, Inc."
details: "Security Operations Center"
email: "secops@example.com"
url: "https://xyz.activeguard.cloud"
provider: "xorlab AG"
```
5. Customize the quarantine notifications such that they match your organization brand. All customizations are described under [Customize Templates](/latest/email-template-modifications). We recommend to at least change the [Logo](/latest/email-template-modifications#change-the-logo).
6. Optional: Adjust the sender address that is used for quarantine notifications: [Change Sender Address](/latest/email-template-sender-addresses#quarantine-notifications). The default is `quarantine@`.
7. Enable quarantine notifications and choose their frequency. The frequency can be overwritten by each user individually in their SSQ. Notifications are only sent for quarantines with `canView: true`.
```yaml shared/guarded_tenants.yml highlight={4-6} theme={null}
tenants:
- name: xorlab
quarantine:
notifications:
enabled: true
frequency: DAILY
## - NEVER: Sending of a quarantine notification is disabled for the user.
## - IMMEDIATELY: Sending of a quarantine notification happens immediately if a message for the user is quarantined.
## - DAILY: Sending the quarantine notification every day at the time specified in the dailyCron option.
## - WEEKLY: Sending the quarantine notification once a week at the time specified in the weeklyCron option.
```
You can adjust the frequency and timing of daily and weekly digest notifications like this:
```yaml shared/guarded_tenants.yml theme={null}
tenants:
- name: xorlab
quarantine:
notifications:
enabled: true
frequency: DAILY
digest:
## The maximum number of recent quarantined messages mentioned in the daily/weekly digest email.
mentionedEntries: 10
## Daily digest frequency. It must be written in the following format (default: send daily digest at the beginning of each workday):
## .------------------ second (0 - 59)
## | .---------------- minute (0 - 59)
## | | .-------------- hour (0 - 23)
## | | | .------------ day of month (must be a *)
## | | | | .---------- month (must be a *)
## | | | | | .-------- period of week (e.g., MON-FRI)
## * * * * * *
## Note that sending daily digest emails is not instantaneous and takes at least `shippingTimespanMinutes`
dailyCron: "0 0 0 * * MON-FRI"
## Weekly digest frequency. It must be written in the following format (default: send weekly digest at the beginning of each work weak):
## .------------------ second (0 - 59)
## | .---------------- minute (0 - 59)
## | | .-------------- hour (0 - 23)
## | | | .------------ day of month (must be a *)
## | | | | .---------- month (must be a *)
## | | | | | .-------- day of week (MON, TUE, WED, THU, FRI, SAT, or SUN)
## * * * * * *
## Note that sending weekly digest emails is not instantaneous and takes at least `shippingTimespanMinutes`
weeklyCron: "0 0 0 * * MON"
## Default time zone of this tenant.
zoneId: "Europe/Zurich"
```
The frequency above is the global default. Users can change it in their own SSQ.
**Shared mailboxes**: Every user with access to a mailbox can configure the notification settings for that specific mailbox. The notification setting per mailbox is global, so for shared mailboxes the setting is changeable by every user that has SSQ access to that mailbox.
**Reset frequency**: As soon as a user logged in to their SSQ the first time, they will not be affected anymore when you change the `frequency`. Therefore, to reset the notification frequency of all users, you can use these database queries:
```sql theme={null}
SELECT * FROM xcc.user_settings_quarantine_notification;
UPDATE xcc.user_settings_quarantine_notification SET frequency='IMMEDIATELY' WHERE frequency='NEVER';
```
8. Click **Publish**. The new configuration becomes active within about one minute.
Now the SSQ is setup and ready to be used.
## Configure additional SSQ features
We recommend to additionally configure the following features to provide the best SSQ experience.
Quarantine all encrypted attachments that cannot be decrypted. The user can enter the password in the SSQ to release it.
Allow users to request the release of emails in the SSQ.
Allow users to access shared mailboxes in the SSQ.
## Multi-Tenancy
Every `guarded_tenants.yml` block on this page is set on a single tenant, so the setup above already works per tenant. Repeat it for each tenant, or share it via [Using Tenant Config Templates](/latest/multi-tenancy-configsets).