Skip to main content
The Sandbox appliance, its containers, and its configuration files are named DANA. This page uses Sandbox for the feature and DANA only where it refers to those.

​
Show screenshots for benign attachments

For benign verdicts, xorlab does not store and show the screenshots of the attachment. If you want to change this behavior, follow Change Storing of Attachment Previews.

​
Apply the Sandbox for quarantined emails

By default, the Sandbox is not applied if an email is put into quarantine already without a Sandbox scan. If you want to change this behavior and force a Sandbox scan for all quarantined emails, apply the following:
  1. Open the file /activeguard/core/rule_sets/90_local/params/local.properties in the Expert Editor.
  2. Add the following properties:
    local.properties
  3. Click Publish. These rule-set settings become active within about one minute.

​
Disable the Sandbox except for specific recipients

To apply the Sandbox only for specific recipients:
  1. Open the file shared/guarded_tenants.yml in the Expert Editor.
  2. Add the Profile no_dana_except_for_specific_recipients.properties. Make sure to add it after default_dana.properties:
    guarded_tenants.yml
  3. Add the specific recipients to the list Recipient dynamic analysis (regex) in the List editor.
  4. Click Publish. The new configuration becomes active within about one minute.

​
Disable the Sandbox completely

It is possible to disable the xorlab Sandbox completely:
  1. Open the file activeguard/core/active_guard.yml in the Expert Editor.
  2. Add the following lines:
    active_guard.yml
  3. Click Publish, then restart all MTAs. The dynamicAnalysisService setting in active_guard.yml requires an MTA restart; see How to Activate the Configuration.

​
Default behavior

The Sandbox is applied to a defined set of document types, configured via the Profile default_dana.properties. The *_mode parameters can have the following values:
  • NoDynamicScan— no scan
  • Inline— wait with email delivery until the scan results are fully processed (if there was no quarantine decision before)
  • AlwaysInline— same as Inline, but additionally forces a dynamic scan even if the email is already quarantined for other reasons
  • Offline— force a scan but don’t wait for its result; decisions are based on static analysis only
More specific rules overrule the generic ones. This is implemented via _weight parameters, which accept integer values between 1 and 10 (inclusive). The higher the weight value, the higher the precedence.
The scanned file types and the delivered *_mode and _weight values are documented in Detection Defaults → Sandbox. Access to that page is restricted.