Product Updates

Leveraging XARF for internal reporting with AbuseHQ


New in XARF Version 2: Internal Processing

March 2021: Starting with version 2 XARF allows including information that helps with processing when you use it for internal reporting. You can, for example, include information about the subscriber and contract, or add tags. The following is an example of the new structure:


You can view a complete and valid example here:

Internal Processing is completely optional and only needed for use cases where you already know certain information at the point where you are creating the report. This simplifies internal processes because you don’t need to perform additional lookup steps later on.

Automatic Parsing and Resolving in AbuseHQ

If you are using AbuseHQ you can immediately leverage the new XARF version for internal reporting. If you include a subscriber id and potentially some more data about subscriber and contract, then you don’t have to perform additional resolving in the Inbound Processing part of AbuseHQ anymore.

There are only two requisites needed for that:

  1. You need to send XARF reports as explained above. They need to include at least a subscriber id. You can send them via API as explained here or via email as explained here.
  2. In your inbound processing configuration, you need to add a filter to check whether that id has already been set and avoid any other resolver components, because otherwise the information would be overwritten.

To setup inbound processing correctly create a new filter component first:

Then attach this component before any resolvers and make sure that the green/positive output doesn’t route through any resolvers. This is a simplified example:

Don’t forget to save the configuration and take it live. From now on all your XARF reports that contain subscriber (and contract) information won’t need to be resolved during inbound processing anymore. As you can see here, the subscriber information is added to the subscriber and case in AbuseHQ:

Linkedin Icon Twitter Icon Facebook Icon E-mal Icon
Two computer monitors showing AbuseHQ

Request a demo of AbuseHQ

Let’s get in touch to discuss what AbuseHQ can do for your organization.

Get in touch

Products & Tools



Get in touch

Talk to us

Do you want to remove your IP/domain from one of our blocklists?
Please use our lookup-service and follow the instructions there in order to get that resolved.