TL;DR
Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
Xorlab Active Guard Logs | ✅ | ✅ | ✅ | xorlab_active_guard_logs | JSON | S3 |
Overview
xorlab is a Swiss cybersecurity company that provides specialized, AI-driven email security solutions to protect the modern workplace from sophisticated, zero-hour cyberattacks. Founded in 2015 as a spin-off from ETH Zurich's Laboratory of Software Technology, the company developed its core product, 
the ActiveGuard Defense Platform. This platform utilizes behavioral AI and machine learning to analyze context, sender-receiver relationships, and internal communication patterns rather than relying on standard, outdated signatures or blacklists. This unique method allows it to precisely block advanced phishing, ransomware, malware, and business email compromise (BEC) threats before they reach user inboxes, while maintaining an exceptionally low false-positive rate. Compliant with strict European regulations like GDPR, NIS2, and DORA, xorlab's flexible cloud, hybrid, or on-premises deployment options have made it a trusted defense partner for critical enterprise infrastructure, including prominent global organizations, major Swiss banks, hospitals, and scientific institutions like CERN.
Supported data types
Xorlab Active Guard Logs
Overview:
xorlab ActiveGuard (now known as part of their broader xorlab platform) is an AI-powered email security system. It learns how people in your company communicate. It stops tricky email attacks like phishing, fraud, and malware before they reach your inbox.
Table name: xorlab_active_guard_logs
Send data to Hunters
Hunters supports the ingestion of Xorlab Active Guard Logs via an intermediary AWS S3 bucket.
To connect Xorlab Active Guard Logs:
Export your logs from Xorlab Active Guard Logs to an AWS S3 bucket.
Once the export is completed and the logs are collected to S3, follow the steps in this section.
Expected format
Logs are expected in JSON format:
Jul 14 14:17:33 hostname1 {"ggrid":"00000000-0000-0000-0000-000000000001","tenantUid":"00000000-0000-0000-0000-000000000002","pipeline":"emails","decision":"DELIVER","verdict":"partner","direction":"INCOMING","sender":"sender@example.com","recipients":["recipient@example.com"],"from":"Sender Name <sender@example.com>","to":"Recipient Name <recipient@example.com>","elapsedS":"0.655","auditLogType":"trace.msg_verdict"}
Jul 14 07:09:53 hostname2 {"ggrid":"00000000-0000-0000-0000-000000000003","created":"2026-07-14T07:09:47.513Z","riskScore":"725","threatScore":"79","verdict":"spam","tags":["phishing","spam","highrisk","newdomain","embeddedlink"],"url":"https://example.com/sso","domain":"example.com","registrationDate":"2026-05-15T17:09:58Z","localReputation":"0","globalReputation":"0","occurrence":"LINK","auditLogType":"ti.url"}