Phase 7: Behavioral Detection

mail-detector.py
├── connect_imap()        — Connect to dovecot via IMAPS
├── fetch_new_messages()  — Read unprocessed messages from INBOX
├── parse_headers()       — Extract Authentication-Results, From, Reply-To, Received chain
├── score_message()       — Behavioral scoring engine
│   ├── check_auth_results()   — SPF/DKIM/DMARC pass/fail
│   ├── check_domain_similarity() — Levenshtein distance on From domain
│   ├── check_urgency()        — Keyword scan (urgent, wire transfer, password, click here)
│   └── check_sender_history() — First-time sender detection
├── remediate()           — Move suspicious messages to Quarantine folder
└── report_to_wazuh()     — POST detection event to Wazuh API

import requests

def report_to_wazuh(event: dict) -> None:
    """Send detection event to Wazuh manager API."""
    wazuh_url = "https://{k3s-master-ip}:55000"
    payload = {
        "event": {
            "type": "mail-behavioral-detection",
            "score": event["score"],
            "signals": event["signals"],
            "from": event["from"],
            "subject": event["subject"],
            "action": event["action"],  # quarantine | flag | pass
        }
    }
    # POST to Wazuh active response or custom integration
    requests.post(f"{wazuh_url}/active-response", json=payload, verify=False)

# On mail-01
sudo dnf install -y python3 python3-pip
pip3 install --user imapclient python-Levenshtein requests

# Create service
sudo tee /etc/systemd/system/mail-detector.service <<EOF
[Unit]
Description=Behavioral Mail Detection (Abnormal Simulator)
After=dovecot.service

[Service]
Type=simple
User=evan
ExecStart=/usr/bin/python3 /opt/mail-detector/mail-detector.py
Restart=on-failure
RestartSec=30

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now mail-detector