# xorlab

> xorlab is a European email security platform that blocks the advanced phishing attacks Microsoft 365 and on-premises filters miss.

We help organizations move from reactive defense to proactive threat prevention with a behavioral AI email security solution built for complex, high-security, and highly regulated environments.

The platform continuously learns and improves across its entire customer base while preserving the privacy of each individual organization. Beyond enhanced threat prevention, it provides all the capabilities modern SOC teams require: from unparalleled visibility into email flows to powerful automation use cases, such as abuse mailbox handling, where employees can report suspicious emails and responses are intelligently automated using AI.

Trusted by organizations ranging from 500 to 37,000+ employees, xorlab counts Julius Bär, Vontobel, University Hospital Zurich, and CERN among its customers.

Organizations can deploy xorlab on premises with fully local processing and storage, in hybrid configurations, or in the cloud, where European data centers and EU-based staff handle all operations.

The platform is built for critical infrastructure and other highly regulated environments and compliant with DORA, NIS2, and GDPR.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

## Docs

- [xorlab Email Security](https://docs.xorlab.com/index.md): Defend your organization against sophisticated phishing attacks with AI-powered email security. Deploy, configure, and operate xorlab across your on-premises, hybrid, or cloud environment.
- [Feature Overview](https://docs.xorlab.com/latest/feature-overview.md): A map of what the platform does, from detection layers through analyst tooling to end-user self-service.
- [What xorlab Changes for Analysts](https://docs.xorlab.com/latest/analyst-benefits.md): For analysts weighing up the platform: which work it takes over, how much of each decision it shows you, and which corrections you can make on your own.
- [What Integrating xorlab Involves](https://docs.xorlab.com/latest/admin-essentials.md): For the mail, infrastructure and security admins who have to operate it: the deployment choice, the settings an integration adds, and what stays on your plate afterward.
- [Evaluate xorlab](https://docs.xorlab.com/latest/evaluate-xorlab.md): For teams who have not decided yet: how a trial is set up, how long each phase takes, and what you can measure the results against before anything is blocked.
- [What xorlab Connects To](https://docs.xorlab.com/latest/integrations-overview.md): Which systems xorlab integrates with and over which interface: SMTP mail flow, Syslog to SIEM, REST APIs for SOAR and automation, SAML and LDAP identity, Microsoft Graph, and threat intelligence.
- [Terminology](https://docs.xorlab.com/latest/terminology.md): Glossary of every xorlab product, component, and concept name, with the alternative names each one is also known by.
- [Analyst Overview](https://docs.xorlab.com/latest/analyst-overview.md): The analyst's entry point, mapping the daily workflows and the order to learn them in.
- [Concepts Overview](https://docs.xorlab.com/latest/concepts-overview.md): The core detection concepts behind xorlab's proactive model. Read these before the hands-on analyst guides.
- [Relationship](https://docs.xorlab.com/latest/concepts-relationship.md): The relationship (trust) model of who communicates with whom in your organization, built and maintained automatically.
- [Local Reputation](https://docs.xorlab.com/latest/concepts-local-reputation.md): How xorlab learns which domains, file types, and content are normal for your organization, and uses that to spot anomalies.
- [Sender Authentication](https://docs.xorlab.com/latest/concepts-sender-auth.md): How xorlab authenticates email senders with SPF, DKIM, and DMARC, a prerequisite for building the relationship model.
- [Quick Walkthrough](https://docs.xorlab.com/latest/quick-walkthrough.md): A hands-on tour of the most important xorlab features. Read the core concepts first.
- [Video Tutorials](https://docs.xorlab.com/latest/video-tutorials.md): Recorded walkthroughs, as an alternative to reading the analyst guide.
- [Using Campaigns](https://docs.xorlab.com/latest/campaigns.md): Turn a search query into a standing rule, so analysts can close a detection gap without editing configuration files.
- [Understanding an Email Verdict](https://docs.xorlab.com/latest/understand-verdict.md): Trace a classification back to the signals that produced it, using the detail view and the analysis breakdown.
- [Handling the Abuse Mailbox](https://docs.xorlab.com/latest/abuse-mailbox.md): Triage, analyze, and respond to employee-reported emails in the Abuse Mailbox, including automated resolution and reporter feedback.
- [Handling Release Requests](https://docs.xorlab.com/latest/handling-release-requests.md): Review end-user requests to release quarantined emails, and decide whether to release or deny them.
- [Reporting a Misclassification](https://docs.xorlab.com/latest/reporting-misclassification.md): Report a false positive or false negative to xorlab so that the detection can be corrected.
- [Fix a False Positive](https://docs.xorlab.com/latest/fix-false-positives.md): React to a wrongly quarantined email so that xorlab stops quarantining that kind of message.
- [Fix a False Negative](https://docs.xorlab.com/latest/fix-false-negatives.md): React to a missed threat so that xorlab quarantines similar emails in future.
- [Handle Authentication Issues](https://docs.xorlab.com/latest/authentication-issues.md): Diagnose common email authentication problems, such as legitimate senders blocked for missing SPF or DKIM.
- [Use Topics for Searches and Campaigns](https://docs.xorlab.com/latest/topic-detection.md): Filter on what a message is about, such as invoices, credentials, or package delivery, rather than on its sender or headers.
- [Tune Detection](https://docs.xorlab.com/latest/detection-tuning.md): Fine-tune detection to reduce false positives and false negatives. Intended for analysts.
- [Tags](https://docs.xorlab.com/latest/tags.md): The hashtags xorlab adds to processed emails from content, metadata, and email history, and where to find them.
- [Search](https://docs.xorlab.com/latest/search.md): Locate messages with autocomplete-assisted queries, then reuse a query as a saved view or promote it to a campaign.
- [List of Verdicts](https://docs.xorlab.com/latest/verdicts.md): The full classification scale and the action each level triggers, including how confidence modifies the outcome.
- [Dashboard and Messages](https://docs.xorlab.com/latest/dashboard-messages.md): The dashboard and message list views: traffic statistics, filters, and how to navigate processed emails.
- [Keyboard Shortcuts](https://docs.xorlab.com/latest/keyboard-shortcuts.md): All keyboard shortcuts available in XCC, grouped by screen area.
- [File Analysis](https://docs.xorlab.com/latest/file-analysis.md): Upload files to xorlab for static analysis and Sandbox analysis using the same engine that scans email attachments.
- [Email Direction](https://docs.xorlab.com/latest/email-direction.md): How xorlab assigns each email a direction (incoming, outgoing, internal, or external) based on your guarded domains.
- [Lists Overview](https://docs.xorlab.com/latest/lists.md): Overview of the built-in lists that adjust platform behavior on the fly, and where to find them in XCC.
- [VIP Names](https://docs.xorlab.com/latest/vips.md): Flag high-risk identities so that lookalike senders are caught before they reach an inbox.
- [Blacklists](https://docs.xorlab.com/latest/blacklists.md): Block email delivery by sender address, domain, IP, or other indicators, including how subdomain matching behaves.
- [Whitelists](https://docs.xorlab.com/latest/whitelists.md): Accept email based on sender address, domain, IP, or other indicators, including how subdomain matching behaves.
- [Custom Alerts](https://docs.xorlab.com/latest/custom-alerts.md): Tag emails with alert hashtags based on domain, address, and keyword lists under Settings, Lists, Alerts.
- [Fraud Keywords](https://docs.xorlab.com/latest/fraud-keywords.md): Customize the keyword list that marks user-reported incidents as potential fraud.
- [Web Form Senders](https://docs.xorlab.com/latest/web-form-senders.md): Keep automated submissions from your public site out of the trust model without whitelisting the whole domain.
- [Phishing Simulation](https://docs.xorlab.com/latest/phishing-simulation-tools.md): Allow simulated phishing emails from awareness training services to reach inboxes unfiltered.
- [Trusted Senders and Infrastructure](https://docs.xorlab.com/latest/trusted-senders-infrastructure.md): Raise or lower the detection for certain senders and their sending infrastructure, independently of learned reputation.
- [Reporting Addresses](https://docs.xorlab.com/latest/lists-reporting-addresses.md): Configure the addresses used to report suspicious emails to services other than xorlab.
- [Email Bombing Recipient Addresses](https://docs.xorlab.com/latest/email-bombing-list.md): Tighten filtering for a mailbox under a subscription-flood attack, where mass sign-up confirmations bury real mail.
- [Integration Overview](https://docs.xorlab.com/latest/setup-integration-overview.md): Where to start integrating xorlab, including the choice between the Microsoft 365 and on-premises paths.
- [Review What Changes in Your Environment](https://docs.xorlab.com/latest/integration-impact.md): See which settings an integration adds to Microsoft 365 or to your on-premises mail flow, what it leaves untouched — including your MX records — and how to undo it.
- [Before You Begin](https://docs.xorlab.com/latest/before-begin-integration.md): Complete before any integration: configure guarded domains, set data retention, and choose inline or monitoring mode.
- [M365 Overview](https://docs.xorlab.com/latest/m365-integration-overview.md): The complete ordered step list for integrating xorlab with Microsoft 365.
- [Set Up Email Routing in xorlab](https://docs.xorlab.com/latest/m365-smtp.md): Configure email routing and TLS enforcement on xorlab in preparation for the Microsoft 365 integration.
- [Create Entra ID App](https://docs.xorlab.com/latest/m365-entra-id-app.md): Register the mandatory xorlab app in Entra ID for M365 SAML login and optional case isolation or retrospective scanning.
- [Enable Entra ID SAML Login](https://docs.xorlab.com/latest/m365-saml-entra-authentication.md): Wire Entra ID to xorlab as a SAML identity provider, so analysts, admins or end-users sign in with their Microsoft account.
- [Import Past M365 Emails](https://docs.xorlab.com/latest/m365-retrospective-email-scanning.md): Backfill the relationship and reputation models from mailbox history, so protection is effective sooner after go-live.
- [Enable M365 Monitoring Mode](https://docs.xorlab.com/latest/m365-monitoring-mode.md): Set up out-of-band observation in Microsoft 365. In this mode xorlab analyzes traffic but cannot block or quarantine.
- [Enable M365 Inline Mode](https://docs.xorlab.com/latest/m365-inline-mode.md): Put xorlab in the Microsoft 365 delivery path so it can block and quarantine. Your MX records stay untouched.
- [Activate Case Isolation](https://docs.xorlab.com/latest/m365-case-isolation.md): Remove delivered emails from Microsoft 365 mailboxes through the Graph API using the Isolate action.
- [Move M365 Quarantine to xorlab](https://docs.xorlab.com/latest/m365-move-quarantine.md): Move the Microsoft 365 quarantine to xorlab so end users have a single quarantine, including the known limitations.
- [Integrate M365 Abuse Mailbox](https://docs.xorlab.com/latest/m365-reporting-integration.md): Connect the built-in Microsoft 365 reporting button to xorlab so reported emails appear in xorlab and reporters receive feedback.
- [On-prem Overview](https://docs.xorlab.com/latest/on-prem-integration-overview.md): The complete ordered step list for integrating xorlab with on-premises email infrastructure.
- [Set Up Email Routing in xorlab](https://docs.xorlab.com/latest/on-prem-smtp.md): Set up email routing on xorlab for on-premises integration, with a guide for each target architecture.
- [Enable ESA Monitoring with BCC](https://docs.xorlab.com/latest/on-prem-esa-monitoring-mode.md): Configure Cisco ESA message filters to BCC a copy of every email to xorlab for out-of-band monitoring.
- [Enable Exchange Monitoring with BCC](https://docs.xorlab.com/latest/on-prem-exchange-monitoring-mode.md): Configure Exchange to blind-copy traffic to xorlab, letting it analyze without sitting in the delivery path.
- [Enable Exchange Inline](https://docs.xorlab.com/latest/on-prem-exchange-inline.md): Place xorlab in the Exchange delivery path using receive and send connectors, so it can block and quarantine.
- [Add Your Trusted Infrastructure](https://docs.xorlab.com/latest/on-prem-add-trusted-mtas.md): Register your own email infrastructure as trusted so xorlab can trace the true origin of an email.
- [Enable On-prem SAML/LDAP Login](https://docs.xorlab.com/latest/on-prem-saml-ldap-authentication.md): Enable SAML or LDAP login for on-premises deployments. SAML is recommended for a smoother single sign-on experience.
- [Integrate On-prem Abuse Mailbox](https://docs.xorlab.com/latest/on-prem-reporting-integration.md): Route user-reported suspicious mail from a self-hosted mail system into the Abuse Mailbox, with automated replies.
- [Switch Between Inline and Monitoring Mode](https://docs.xorlab.com/latest/inline-and-monitoring-mode.md): Switch between monitoring mode, which observes a copy out of band, and inline mode, which can block and quarantine.
- [Trusted MTAs In-Depth](https://docs.xorlab.com/latest/trusted-mtas.md): How Received headers and trusted MTA configuration let xorlab verify the true path an email traveled.
- [Advanced SMTP Configurations](https://docs.xorlab.com/latest/smtp-configuration.md): Advanced Postfix SMTP settings in the postfix-custom folder, including next-hop syntax.
- [Change Misclassification Reporting](https://docs.xorlab.com/latest/configure-misclassification-reporting.md): Override the default misclassification reporting parameters in xcc.yml.
- [Restrict Access to Expert Editor](https://docs.xorlab.com/latest/restrict-admin-access.md): Restrict which IP addresses can reach the Expert Editor, on top of role-based access control.
- [What to Configure Next](https://docs.xorlab.com/latest/integration-next-steps.md): What to configure once the integration is complete: user login, quarantine, notifications, detection, and logging.
- [Authentication Overview](https://docs.xorlab.com/latest/authentication-overview.md): Compare the available login methods (SAML, LDAP, auto-login, password file) and choose which to enable for admins, analysts, and end users.
- [Enable LDAP Login](https://docs.xorlab.com/latest/authentication-ldap.md): Configure the LDAP backend so users sign in to xorlab with their existing directory credentials.
- [Enable SAML Login](https://docs.xorlab.com/latest/authentication-saml.md): Set up a generic SAML integration for single sign-on. For Entra ID, use the dedicated Entra ID guide instead.
- [Enable Auto-Login](https://docs.xorlab.com/latest/authentication-auto-login-link.md): Passwordless quarantine access for employees, via a time-limited link embedded in notification mails.
- [Enable Login via Password File](https://docs.xorlab.com/latest/authentication-with-a-password-file.md): Define local xorlab users in a static password file, with password and account recommendations.
- [List of Built-in Roles](https://docs.xorlab.com/latest/built-in-user-roles.md): Reference table of the built-in xorlab roles and the capabilities each one grants.
- [Create a Custom Role](https://docs.xorlab.com/latest/create-custom-user-role.md): Define a custom role from permissions and scopes when the built-in roles do not fit.
- [Add Trusted CA Certificates](https://docs.xorlab.com/latest/authentication-certificates.md): Add a custom certificate authority to the xorlab trust store so LDAP and SAML2 connections validate.
- [Enable Request Signing for SAML](https://docs.xorlab.com/latest/authentication-saml-request-signing.md): Sign SAML authentication requests with a key store when your identity provider requires it.
- [Detection Overview](https://docs.xorlab.com/latest/detection-overview.md): The detection features you can enable on top of xorlab's preconfigured protection, in recommended order.
- [Review Default Actions](https://docs.xorlab.com/latest/detection-actions.md): Decide which verdicts are quarantined and which are delivered with a rewritten subject, and set that per tenant.
- [Review Static Policies](https://docs.xorlab.com/latest/detection-static-policies.md): The static policies enforced on every email regardless of relationship or context, and the Filter quarantine they trigger.
- [Enable Contextual Banners](https://docs.xorlab.com/latest/detection-contextual-banners.md): Add contextual warning banners to emails. Requires a subscription; contact support to enable.
- [Enable VirusTotal](https://docs.xorlab.com/latest/detection-virustotal.md): Enable VirusTotal threat intelligence in the email detail view. Informational only, not used for detection.
- [Enable Spamhaus Integration](https://docs.xorlab.com/latest/detection-spamhaus-dqs.md): Integrate Spamhaus DQS through the SpamAssassin plugin by supplying a valid key.
- [Enable Attachment Removal](https://docs.xorlab.com/latest/detection-attachment-removal.md): Strip suspicious attachments and deliver the remaining email. The Self-Service Quarantine is generally the better option.
- [Add Result Header to Email](https://docs.xorlab.com/latest/detection-analysis-result-header.md): Add headers carrying xorlab's analysis results to every email so downstream systems can act on them.
- [SSQ Overview](https://docs.xorlab.com/latest/ssq-overview.md): Let end users view and release their own quarantined emails through the Self-Service Quarantine.
- [Set Up the SSQ](https://docs.xorlab.com/latest/ssq-setup.md): Choose how employees reach the Self-Service Quarantine (SSQ) and what they may do there. It is always on; only access needs configuring.
- [Enable Attachment Airlock](https://docs.xorlab.com/latest/ssq-attachment-airlock.md): Hold emails with encrypted attachments in the Self-Service Quarantine until the user supplies a password, then re-analyze them.
- [Enable Release Requests](https://docs.xorlab.com/latest/ssq-request-release.md): Let end users request release of emails they cannot release themselves, for analyst review.
- [Shared Mailboxes Overview](https://docs.xorlab.com/latest/ssq-shared-mailboxes.md): Give Self-Service Quarantine users access to shared mailboxes, with auto-login as the recommended approach.
- [Enable Shared Mailbox Script for M365](https://docs.xorlab.com/latest/m365-shared-mailbox-script.md): Set the Entra ID attribute that tells xorlab which shared mailboxes each Self-Service Quarantine user may access.
- [List of Quarantines](https://docs.xorlab.com/latest/ssq-list-of-quarantines.md): Which quarantine each verdict lands in, and who is allowed to release from it.
- [Notifications Overview](https://docs.xorlab.com/latest/email-template-overview.md): When xorlab sends end-user notifications: report feedback, quarantine digests, and custom notifications.
- [Customize Templates](https://docs.xorlab.com/latest/email-template-modifications.md): Add, remove, and customize end-user notification templates, including logo, colors, fonts, and text.
- [Trigger Test Notifications](https://docs.xorlab.com/latest/email-template-preview-notification.md): Send a test notification to a mailbox to verify auto-login, template layout, and localization.
- [Change Sender Address](https://docs.xorlab.com/latest/email-template-sender-addresses.md): Set non-standard sender addresses for feedback emails, quarantine notifications, and bounce messages.
- [SIEM & SOAR Overview](https://docs.xorlab.com/latest/integrations-siem-soar-overview.md): The two ways xorlab connects to a SIEM or SOAR: an outbound event stream over Syslog, and an inbound REST API for automation.
- [Connect a SIEM](https://docs.xorlab.com/latest/integrations-siem.md): Stream xorlab verdicts, threat intelligence, and audit events to any SIEM over Syslog in JSON or CEF, with pointers into the ingestion documentation of the common platforms.
- [Automate with a SOAR](https://docs.xorlab.com/latest/integrations-soar.md): Drive xorlab from your SOAR or automation platform: Syslog events as playbook triggers, the List API as the action surface, and worked playbook patterns.
- [Logging Overview](https://docs.xorlab.com/latest/logging-overview.md): The available logging channels (Syslog, email, file) and the order in which to configure them.
- [Before You Begin](https://docs.xorlab.com/latest/logging-before-begin.md): Choose which events to log and which log format to use before configuring any logging channel.
- [Enable Logging via Syslog](https://docs.xorlab.com/latest/logging-via-syslog.md): Forward selected log events over Syslog to a destination such as a SIEM.
- [Enable Logging via Email](https://docs.xorlab.com/latest/logging-via-email.md): Configure xorlab to send an email whenever a chosen log event occurs.
- [Enable Logging to a File](https://docs.xorlab.com/latest/logging-via-file.md): Write log events to a local file. Supported for on-premises deployments only.
- [Examples](https://docs.xorlab.com/latest/logging-examples.md): Copy-ready logback snippets for the most common SIEM and alerting integrations.
- [Concepts](https://docs.xorlab.com/latest/logging-concept.md): How logging works in xorlab through the Logback framework: loggers, appenders, and events.
- [Loggers](https://docs.xorlab.com/latest/logging-events.md): Reference of the loggers you can configure and the events each one records.
- [Format Converters](https://docs.xorlab.com/latest/logging-formats.md): Customize the structure of log messages with format converters for compatibility with your SIEM.
- [Built-in Logging](https://docs.xorlab.com/latest/logging-built-in-properties.md): The audit, error, and operational log files xorlab writes by default, and the logback.properties options for each component.
- [Multi-Tenancy Overview](https://docs.xorlab.com/latest/multi-tenancy-overview.md): Protect and manage multiple organizations from a single xorlab instance, with links to each configuration area.
- [Add a New Tenant](https://docs.xorlab.com/latest/multi-tenancy-new-tenant.md): Step-by-step onboarding of a new tenant, including the one-time prerequisites for the first tenant.
- [Configure Tenant Domains and Routing](https://docs.xorlab.com/latest/multi-tenancy-domain-and-routing.md): Configure tenant domains and SMTP routing for each supported multi-tenant topology.
- [Enable Tenant Login](https://docs.xorlab.com/latest/multi-tenancy-authentication.md): Sign-in options per tenant, and which to pick for analyst portals versus employee quarantine access.
- [Customize Tenant Notifications](https://docs.xorlab.com/latest/multi-tenancy-email-templates.md): Customize end-user email notifications separately for each tenant.
- [Assign Reported Emails to Tenants](https://docs.xorlab.com/latest/multi-tenancy-reported-emails.md): Assign reported emails to the correct tenant using the x-ag-tenant header on the carrier email.
- [Using Tenant Config Templates](https://docs.xorlab.com/latest/multi-tenancy-configsets.md): Define reusable tenant configuration templates with configSets in guarded_tenants.yml.
- [Manage Tenant Rules](https://docs.xorlab.com/latest/multi-tenancy-rules.md): Create rules and parameters per tenant, and override global parameters for individual tenants.
- [Data Retention Overview](https://docs.xorlab.com/latest/data-retention-overview.md): What xorlab stores, for how long by default, and which retention settings you can change.
- [Change Metadata Retention](https://docs.xorlab.com/latest/data-retention-metadata.md): Bound the searchable history window with deliveredTtlDays. Quarantine is governed by its own separate setting.
- [Change Quarantine Retention](https://docs.xorlab.com/latest/data-retention-quarantine.md): Change how long emails remain in quarantine before they are removed and stop being searchable.
- [Change Storing of Subject](https://docs.xorlab.com/latest/data-retention-subject.md): Suppress subject-line storage entirely, or bound how long it is kept. Subjects are retained by default.
- [Change Storing of Previews](https://docs.xorlab.com/latest/data-retention-previews.md): Decide whether screenshots of messages and attachments are captured at all, and which verdicts trigger them.
- [List API](https://docs.xorlab.com/latest/api-rule-list-management.md): Automate list entries with the List API: getLists, listEntries, addEntries, and deleteEntries, with API key authentication and tenant scopes.
- [List available lists](https://docs.xorlab.com/latest/api-reference/list-available-lists.md): Returns metadata for all lists in one tenant-scoped or deployment-global scope.
- [List all entries from one list](https://docs.xorlab.com/latest/api-reference/list-all-entries-from-one-list.md): Streams all entries from one list scope as NDJSON. Each line is one `PublicListsEntry`.
- [Add list entries in bulk](https://docs.xorlab.com/latest/api-reference/add-list-entries-in-bulk.md): Adds entries to one tenant-scoped or deployment-global list. Requests can contain at most 500 entries. Existing entries are updated and counted as modifications.
- [Delete list entries in bulk](https://docs.xorlab.com/latest/api-reference/delete-list-entries-in-bulk.md): Deletes entries from one tenant-scoped or deployment-global list. Requests can contain at most 500 entries. Missing entries are ignored and not counted as modifications.
- [Email Scanning API](https://docs.xorlab.com/latest/abby.md): Submit a message over HTTP and get its analysis result back synchronously, instead of routing it via SMTP. An advanced integration for narrow cases.
- [How to Activate the Configuration](https://docs.xorlab.com/latest/activate-configuration.md): Which Expert Editor changes require a component restart to take effect, and which activate automatically within a minute.
- [Expert Editor](https://docs.xorlab.com/latest/expert-editor.md): Access the Expert Editor, the admin tool that gives full access to every xorlab configuration option.
- [Configuration Files](https://docs.xorlab.com/latest/configuration-files.md): The xorlab YAML configuration files — guarded_tenants.yml, active_guard.yml, xcc.yml and auth.yml — with links to the full reference for each.
- [Rule Profiles](https://docs.xorlab.com/latest/rule-profiles.md): A set of predefined rule parameters, mostly used to switch between monitoring and inline mode.
- [Rule Parameters](https://docs.xorlab.com/latest/rule-parameters.md): The low-level knobs behind the Actions screen, with the suffix conventions for inbound and outbound defense.
- [Adding a Custom Rule](https://docs.xorlab.com/latest/adding-custom-rule.md): Create a custom classification rule as an XML file under rule_sets/90_local/ in the Expert Editor, and add a custom list.
- [Context Variables](https://docs.xorlab.com/latest/context-vars.md): Reference of the context variables you can set in rules to trigger actions or override global settings.
- [Upgrading to a Patch Release](https://docs.xorlab.com/latest/patch-upgrade.md): Apply a Major.Minor.Patch increment to an existing installation, with the backup and rollback steps around it.
- [Upgrading to Version 11.0.X](https://docs.xorlab.com/latest/upgrade-guide.md): Upgrade xorlab across major and minor releases, including the configuration files to review for each release.
- [Release Lifecycle Support](https://docs.xorlab.com/latest/release-lifecycle-support.md): How long each major version stays supported, and what that means for planning an upgrade.
- [Replace MTA SMTP Certificate](https://docs.xorlab.com/latest/tls-certificates-for-mta-smtp.md): Replace the TLS certificate the MTA presents on SMTP connections.
- [Replace MTA GUI Certificate](https://docs.xorlab.com/latest/tls-certificates-for-mta-proxy.md): Replace the TLS certificate used by the MTA GUI reverse proxy.
- [Replace XCC Certificate](https://docs.xorlab.com/latest/tls-certificates-for-xcc.md): Replace the TLS certificate used by the XCC web interface and its HTTPS connections.
- [Operation Reference](https://docs.xorlab.com/latest/operation-reference.md): Component architecture, CLI commands like restart and reboot procedures, and where the log files live.
- [VM Setup Guide](https://docs.xorlab.com/latest/vm-setup-guide.md): Provision the XCC and one or more MTAs on your own virtual infrastructure.
- [VM Setup Script Description](https://docs.xorlab.com/latest/vm-setup-script-breakdown.md): Every configuration value the setup script prompts for, for operators who need to understand or automate it.
- [VM Resource Configuration](https://docs.xorlab.com/latest/vm-resource-configuration.md): The sizing-dependent parameters to set on each xorlab VM, listed per sizing tier.
- [Sizing Guide](https://docs.xorlab.com/latest/sizing-guide.md): Pick a size profile from your mailbox count and daily message throughput, with the parameters each one implies.
- [Network Guide](https://docs.xorlab.com/latest/network-guide.md): The network connections required between xorlab components and external services, for firewall and proxy configuration.
- [Monitoring Overview](https://docs.xorlab.com/latest/monitoring-overview.md): The two parts of xorlab monitoring: central log and metric collection, and alerting to external systems.
- [Set Up Monitoring](https://docs.xorlab.com/latest/monitoring-guide.md): Set up monitoring so that all metrics and logs are centralized on XCC and visible in the dashboards.
- [Enable Alerts](https://docs.xorlab.com/latest/monitoring-alerts.md): Create operational alerts in xorlab and forward them to external systems.
- [Test and Troubleshoot Alerts](https://docs.xorlab.com/latest/monitoring-alerts-testing.md): Fire a synthetic alert to prove the delivery path works, and diagnose it when nothing arrives.
- [Customize Alerts](https://docs.xorlab.com/latest/monitoring-alerts-customizing.md): Add your own alerting rules on the XCC or an MTA, and restyle the messages Alertmanager sends.
- [Change Logs and Metrics Retention](https://docs.xorlab.com/latest/monitoring-data-retention.md): Change how long operational logs and metrics are kept in the monitoring dashboard.
- [Monitoring Architecture](https://docs.xorlab.com/latest/monitoring-architecture.md): How the monitoring and monitored-mta stacks collect metrics and logs on the XCC and MTA VMs.
- [xorlab Sandbox (DANA)](https://docs.xorlab.com/latest/xorlab-sandbox.md): Tuning options for the Sandbox. Self-hosted deployments only; in SaaS xorlab manages these settings.
- [xorlab Tika](https://docs.xorlab.com/latest/xorlab-tika.md): The Tika service that improves URL and text extraction from attachments, including OCR.
- [xorlab NLU](https://docs.xorlab.com/latest/xorlab-nlu.md): The Natural Language Understanding service that classifies email content using xorlab's in-house machine learning models.
- [Backup & Recovery](https://docs.xorlab.com/latest/backup-recovery.md): Configure manual and scheduled full or incremental backups, and restore xorlab after a failure.
- [Set Up DKIM Signing](https://docs.xorlab.com/latest/dkim-and-dmarc-setup.md): Configure DKIM signing and DMARC on xorlab so your outgoing email is authenticated by recipients.
- [Customize QR Code Analysis](https://docs.xorlab.com/latest/qr-code-extraction.md): Customize how xorlab extracts and analyzes URLs from QR codes in attachments and rendered previews.
- [Data Flow Overview](https://docs.xorlab.com/latest/data-flow-overview.md): Which components handle your email, which services they call while analyzing it, and what each of those services receives. Applies to on-premises and SaaS alike.
- [Data Sent to External Services](https://docs.xorlab.com/latest/data-to-external-services.md): Every transfer that leaves the MTAs or the XCC while an email is analyzed, what it contains, and whether it can be switched off. Most destinations are xorlab’s own services.
- [Data Storage](https://docs.xorlab.com/latest/data-storage.md): A per-component inventory of what is kept and for how long, graded by whether the data can identify a customer or a person.
- [List of Data Sub-Processors](https://docs.xorlab.com/latest/data-third-party-subprocessors.md): Which external parties may handle data under each deployment model, and where the contractually binding list lives.
- [Important Operational Resources](https://docs.xorlab.com/latest/important-resources.md): Support address, release announcements, status page, and the contact for reporting a vulnerability.
- [FAQ](https://docs.xorlab.com/latest/frequently-asked-questions.md): Common questions about detection, configuration, integration, and day-to-day operation.
- [Troubleshooting](https://docs.xorlab.com/latest/troubleshooting.md): Solutions to the most common problems, including editing configuration files when the web interface is unreachable.
- [Changelog](https://docs.xorlab.com/changelog.md): See what changed in every xorlab Security Platform release, filtered by major version, with the fixes rolled out via xCloud and those that need an upgrade.
- [Privacy](https://docs.xorlab.com/privacy.md): How this documentation site handles your data.