← Back to Guardian

SpamAssassin Integration

Leverage Guardian's structural intelligence within your SpamAssassin stack. The Mailuminati Perl plugin allows SpamAssassin to query your local Guardian instance for instant phishing and spam detection.

PERL PLUGIN

Technical Overview

The Mail::SpamAssassin::Plugin::Mailuminati plugin registers custom evaluation rules that communicate with the Guardian sidecar via HTTP.

MIME Analysis: The plugin extracts the pristine message content for structural fingerprinting.
Local Processing: All analysis is performed by your local Guardian instance on port 12421.
Non-Blocking Design: Includes configurable timeouts to ensure mail delivery isn't delayed if the service is unreachable.

Available Rules

The plugin provides two primary evaluation rules for your SpamAssassin configuration:

check_mailuminati_spam: Returns true if Guardian identifies a definitive structural DNA match.
check_mailuminati_suspicious: Returns true if strong structural proximity is detected via LSH.

Configuration

1. Ensure LWP::UserAgent and JSON Perl modules are installed on your system.

2. Load the plugin and define your scores in /etc/mail/spamassassin/local.cf:

loadplugin Mail::SpamAssassin::Plugin::Mailuminati /path/to/Mailuminati.pm

mailuminati_endpoint http://127.0.0.1:12421/analyze
mailuminati_timeout 5

header     MAILUMINATI_SPAM       eval:check_mailuminati_spam()
describe   MAILUMINATI_SPAM       Structural DNA match found by Guardian
score      MAILUMINATI_SPAM       10.0

header     MAILUMINATI_SUSPICIOUS eval:check_mailuminati_suspicious()
describe   MAILUMINATI_SUSPICIOUS Strong structural proximity detected
score      MAILUMINATI_SUSPICIOUS 4.5

Under the Hood

The plugin uses get_pristine() to capture the full message exactly as it was received. It then performs a POST request to the Guardian API, interpreting the action and proximity_match fields from the JSON response to set the appropriate result symbols.