> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# xorlab Sandbox (DANA)

> Tuning options for the Sandbox. Self-hosted deployments only; in SaaS xorlab manages these settings.

<Note>
  The Sandbox appliance, its containers, and its configuration files are named **DANA**. This page uses *Sandbox* for the feature and *DANA* only where it refers to those.
</Note>

## Show screenshots for benign attachments

For benign verdicts, xorlab does not store and show the screenshots of the attachment.

If you want to change this behavior, follow [Change Storing of Attachment Previews](/latest/data-retention-previews#change-attachment-previews).

## Apply the Sandbox for quarantined emails

By default, the Sandbox is not applied if an email is put into quarantine already without a Sandbox scan.

If you want to change this behavior and force a Sandbox scan for all quarantined emails, apply the following:

1. Open the file `/activeguard/core/rule_sets/90_local/params/local.properties` in the Expert Editor.

2. Add the following properties:
   ```shell local.properties theme={null}
   DYNAMIC_ANALYSIS_default_mode=AlwaysInline
   DYNAMIC_ANALYSIS_always_for_office_with_vbascript_mode=AlwaysInline
   DYNAMIC_ANALYSIS_always_for_office_with_xlmscript_mode=AlwaysInline
   DYNAMIC_ANALYSIS_always_for_office_with_vbascript_trusted_mode=AlwaysInline
   DYNAMIC_ANALYSIS_always_for_office_with_xlmscript_trusted_mode=AlwaysInline
   DYNAMIC_ANALYSIS_exposed_accounts_mode=AlwaysInline
   DYNAMIC_ANALYSIS_exposed_high_value_targets_mode=AlwaysInline
   DYNAMIC_ANALYSIS_always_for_specific_recipients_mode=AlwaysInline
   ```

3. Click **Publish**. These rule-set settings become active within about one minute.

## Disable the Sandbox except for specific recipients

To apply the Sandbox *only* for specific recipients:

1. Open the file `shared/guarded_tenants.yml` in the Expert Editor.

2. Add the [Profile](/latest/rule-profiles) `no_dana_except_for_specific_recipients.properties`. Make sure to add it after `default_dana.properties`:
   ```yaml guarded_tenants.yml highlight={8} theme={null}
   tenants:
     - name: example
       ruleProfiles:
         - default_dana.properties
         - no_dana_except_for_specific_recipients.properties
         - ...
   ```

3. Add the specific recipients to the list `Recipient dynamic analysis (regex)` in the List editor.

4. Click **Publish**. The new configuration becomes active within about one minute.

## Disable the Sandbox completely

It is possible to disable the xorlab Sandbox completely:

1. Open the file `activeguard/core/active_guard.yml` in the Expert Editor.

2. Add the following lines:
   ```yaml active_guard.yml theme={null}
   dynamicAnalysisService:
     enabled: false
   ```

3. Click **Publish**, then restart all MTAs. The `dynamicAnalysisService` setting in `active_guard.yml` requires an MTA restart; see [How to Activate the Configuration](/latest/activate-configuration).

## Default behavior

The Sandbox is applied to a defined set of document types, configured via the [Profile](/latest/rule-profiles) `default_dana.properties`.

The `*_mode` parameters can have the following values:

* `NoDynamicScan`— no scan
* `Inline`— wait with email delivery until the scan results are fully processed (if there was no quarantine decision before)
* `AlwaysInline`— same as `Inline`, but additionally forces a dynamic scan even if the email is already quarantined for other reasons
* `Offline`— force a scan but don’t wait for its result; decisions are based on static analysis only

More specific rules overrule the generic ones. This is implemented via `_weight` parameters, which accept integer values between 1 and 10 (inclusive). The higher the weight value, the higher the precedence.

<Info>
  The scanned file types and the delivered `*_mode` and `_weight` values are documented in
  [Detection Defaults → Sandbox](/latest/detection-defaults#sandbox).
  Access to that page is restricted.
</Info>