← Back to Documentation

Security Intelligence System

Advanced AI-powered threat detection, IP reputation tracking, anomaly detection, and automated security responses.

Table of Contents

Key Features

🔔

Real-time Alerts

Instant notifications for security events via email, webhook, or Slack.

🛡

IP Reputation

Dynamic scoring system that tracks sender IP behavior over time.

📊

Anomaly Detection

AI-powered detection of compromised accounts based on sending patterns.

🚫

Auto-Blacklist

Automatic blocking of IPs based on configurable behavior rules.

📧

Multi-channel Notifications

Email, Webhook, and Slack integration for instant alert delivery.

📈

Scheduled Reports

Daily, weekly, and monthly reports delivered to your inbox.

System Architecture

The Security Intelligence System operates across two main components that work together to protect your mail server.

SecZim Daemon (Port 10031) - Real-time Processing
Auto-Blacklist
Priority: 98
IP Reputation
Priority: 95
Anomaly Detection
Priority: 92
↓
Events & Updates
↓
SecZim API Server (Port 8880) - Background Workers
Alert Notifier
Every 30 sec
Reputation Recovery
Every 6 hours
Report Generator
Every 5 min

Alert System

The Alert System provides real-time notifications for security events, helping you stay informed about potential threats.

How Alerts Flow Through the System

1. Event Detected
Security module detects suspicious activity (quota exceeded, IP spike, anomaly, etc.)
2. Alert Created
System creates alert with severity level and stores in database
3. Notification Queued
Based on alert rules, notification is queued for enabled channels
4. Delivery
Alert Notifier worker sends via Email, Webhook, or Slack

Alert Types

Type Description Severity
compromised_account Anomaly detected in sender behavior Critical
quota_exceeded User exceeds sending quota Critical
ip_spike IP with many rejections detected Warning
auto_blacklist IP automatically blacklisted Warning
rbl_block_spike Spike in RBL blocks Warning
geo_block_spike Spike in geographic blocks Info

IP Reputation System

The IP Reputation system tracks the behavior of sender IPs over time and assigns a dynamic score that determines how emails are processed.

Score Visualization

50
80-100: Excellent - Skips greylisting
50-79: Good - Normal processing
20-49: Suspicious - Extra scrutiny
0-19: Bad - Blocked automatically

Score Changes

Event Score Change Effect
Email Accepted +1 IP gains trust
Email Rejected -5 IP loses trust significantly
Email Deferred -2 IP loses some trust
Inactivity Recovery +5 Inactive IPs gradually recover reputation
🔄 How Reputation Recovery Works

When an IP has a low reputation score and becomes inactive (stops sending emails), the system automatically helps it recover:

1. Every 6 hours, the Recovery worker checks for IPs that haven't sent emails in the configured Decay Days period (default: 7 days).

2. Those inactive IPs receive +5 points (configurable via Decay Amount) per cycle, gradually improving their score.

3. This ensures that IPs that were temporarily bad (e.g., compromised then fixed) can eventually return to normal status.

Example: An IP blocked at score 5 will recover to 50+ after approximately 2 weeks of inactivity (receiving +5 points every 6 hours once the Decay Days threshold is met).

💡 Configuration Defaults

Block Threshold: Default is 10. IPs with score ≤ 10 are automatically blocked. Set to 0 or negative values to disable blocking.

Score Range: 0-100 (MinScore=0, MaxScore=100). New IPs start at 50 (InitialScore).

Skip Greylist Threshold: Default is 80. IPs with score ≥ 80 skip greylisting.

Anomaly Detection

The Anomaly Detection system identifies potentially compromised email accounts by analyzing sending patterns and comparing them to established baselines.

Module Controls

The Anomaly Detection module has two separate toggles that control its behavior:

Module Enabled Main toggle - enables/disables the entire anomaly detection module

When Enabled: The system actively monitors all outbound emails for anomalies, comparing sending patterns against learned baselines.

When Disabled: The module is completely off - no monitoring, no detection, no alerts.

Auto-Block Secondary toggle - controls automatic blocking of detected anomalies

When Enabled: Detected anomalies result in automatic blocking of the sender.

When Disabled: Anomalies are detected and logged (alerts created), but senders are NOT automatically blocked.

Operating Modes

Module Enabled Auto-Block Behavior
ON ON Full protection - detects anomalies AND automatically blocks senders
ON OFF Monitor mode - detects and logs anomalies, creates alerts, but does NOT block
OFF N/A Module disabled - no monitoring, no detection, no alerts
💡 Recommended Configuration

New installations: Start with Module Enabled and Auto-Block Disabled to monitor your email patterns for a few weeks before enabling automatic blocking.

Production systems: Once you've verified the detection accuracy, enable Auto-Block for automatic protection.

Detection Process

Email Sent
User sends email through server
↓
Compare to Baseline
Check against learned behavior (needs 7+ days)
↓
NORMAL
Allow
Update baseline
ANOMALY
Flag & Alert
Block if auto-block enabled

Detection Criteria

Metric Default Triggers When
Volume Multiplier 5x Sender sends 5x more emails than their average
New Recipients Threshold 50 Sender emails 50+ never-before-seen recipients
Min Baseline Days 7 Minimum days of history needed before detection activates
⚠ Learning Period

New senders need at least 7 days of baseline data before anomaly detection activates for them. During this period, their behavior is recorded but not flagged as anomalous.

Auto-Blacklist System

The Auto-Blacklist system automatically blocks IPs that exhibit malicious behavior patterns, based on configurable rules.

Default Rules

Rule Trigger Block Duration
High Rejection Rate 10+ rejections in 1 hour 24 hours
Auth Failures 5+ failed auth attempts in 30 min 6 hours
Spam Score 5+ high spam score emails in 1 hour 24 hours
🔒 Manual Actions

Auto-blacklisted IPs can be:

Notification Channels

Configure how you want to receive security alerts. Multiple channels can be active simultaneously.

Available Channels

Channel Configuration Best For
Email SMTP server, recipients list Audit trail, compliance
Webhook HTTP endpoint URL Integration with external systems
Slack Webhook URL Team collaboration, real-time alerts

Configuration Reference

Understanding which settings can be modified from the dashboard and which are system defaults.

IP Reputation Settings

Setting Default Configurable Description
Module Enabled true Yes Enable/disable the IP Reputation module
Block Threshold 10 Read-only IPs with score ≤ this value are blocked
Skip Greylist Threshold 80 Read-only IPs with score ≥ this value skip greylisting
Decay Amount 5 Read-only Points recovered per decay cycle
Decay Days 7 Read-only Days of inactivity before reputation recovers

Anomaly Detection Settings

Setting Default Configurable Description
Module Enabled true Yes Enable/disable anomaly detection
Auto-Block false Yes Automatically block detected anomalies
Volume Multiplier 5.0x Read-only Trigger when sending Nx more emails than average
New Recipients Threshold 50 Read-only Trigger when emailing N+ new recipients
Min Baseline Days 7 Read-only Days of history needed before detection activates
⚠ Read-only Parameters

Parameters marked as Read-only are displayed in the dashboard for informational purposes but cannot be modified from the web interface. These values are optimized for most environments and can only be changed by modifying the database directly or via API.

Best Practices

Initial Setup

  1. Enable monitoring first - Start with Anomaly Detection Enabled but Auto-Block Disabled
  2. Configure notifications - Set up at least email notifications for critical alerts
  3. Review for 1-2 weeks - Monitor alerts to understand your normal traffic patterns
  4. Enable auto-blocking - Once confident, enable Auto-Blacklist and Anomaly Auto-Block

Ongoing Maintenance

📈 Dashboard Access

Access the Intelligence Dashboard at /intelligence in the SecZim web interface to view all security metrics, active alerts, and system status.

SecZim Security Intelligence System v3.0.0 | Documentation last updated: December 2024