xorlab Tika - xorlab

Tika runs on the Sandbox appliance (DANA) if you have an on-premises Sandbox, otherwise the SaaS Tika service of xorlab will be used. Tika is mandatory for detection, and is applied to the following emails:

Disabled by default: outgoing
Active by default: incoming, coming from internal and external servers, and reported by users

Enable Tika for outgoing emails

Open activeguard/core/rule_sets/90_local/params/local.properties in the Expert Editor.

Add the following line:

local.properties

EXECUTE_TEXT_EXTRACTION_for_outgoing_emails_state=ACTIVE

Click Publish. The rule-set setting becomes active within about one minute.

Disable Tika

Tika should not be disabled in any production environment as it will severely impact classification accuracy. However, if needed, it can be disabled using the Expert Editor. In the activeguard/core/active_guard.yml file, add the following lines:

active_guard.yml

tikaService:
  enabled: false

Click Publish, then restart all MTAs. The tikaService setting in active_guard.yml requires an MTA restart; see How to Activate the Configuration.

List of configuration parameters

Tika is controlled via the following rule properties:

EXECUTE_TEXT_EXTRACTION_for_analysis_pipelines_state=ACTIVE
EXECUTE_TEXT_EXTRACTION_for_external_emails_state=ACTIVE
EXECUTE_TEXT_EXTRACTION_for_incoming_emails_state=ACTIVE
EXECUTE_TEXT_EXTRACTION_for_internal_emails_state=ACTIVE
EXECUTE_TEXT_EXTRACTION_for_reported_emails_state=ACTIVE
EXECUTE_TEXT_EXTRACTION_for_outgoing_emails_state=DISABLED

Processed file formats

Tika extracts text and URLs from a defined set of file formats.

The full list of processed file formats is documented in Detection Defaults → Tika processed file formats. Access to that page is restricted.

⌘I

​Enable Tika for outgoing emails

​Disable Tika

​List of configuration parameters

​Processed file formats

Enable Tika for outgoing emails

Disable Tika

List of configuration parameters

Processed file formats