# Introduction - Welcome to CFM

## 🚀 CFM Feature Summary

CFM is a powerful system for managing threat intelligence, spam filtering, phishing protection, and reputation data — backed by automation and agent-based sync.

---

### 🛡️ Security & Threat Intelligence

- **Blocklist & Whitelist Management** (IP & domain)
- **Reverse DNS**, **ASN**, **GeoIP**, and **country resolution**
- **Keyword-based spam detection**
- **Phishing URL detection & logging**

---

### 🔁 Automation & Scheduling

- Scheduled **feed imports**, **auto-deletion**, and **rule generation**
- Commands for IP list generation, rule updates, config sync
- Cron-style job scheduling with overlap protection

---

### 🛰️ Agent Infrastructure (C++-Based)

- Syncs config and rule files
- Reports **blocks**, **unblocks**, and **last seen**
- Triggers service restarts after updates
- Integrates with unblock portal for auto-removal
- Sends **Slack alerts** for offline agents

---

### 🧪 Antivirus & RBL Integration

- Generates **ClamAV signatures** from phishing URLs and file hashes (MD5/SHA1/SHA256)
- Maintains **SpamAssassin-compatible phishing DB**
- Exports **RBL and URIBL zones** for RBLDNSD

---

### 💻 API & External Access

- Token-authenticated API for:
    
    
    - Checking block status
    - Reporting blocks/unblocks
    - Fetching rules/feeds
    - Submitting config/trigger reports
- Optional **rate limiting** and **IP filtering**

---

### 📊 Admin Panel (Filament)

- Dashboard with real-time widgets and charts
- Interfaces for:
    
    
    - Spam keywords
    - Block/allow lists
    - Feed logs
    - Unblock requests
    - Agent activity

---

### 🌐 Web Interface

- Public-facing **Unblock Request Form**
- Feed endpoints (IP, domain, phishing, etc.)
- Admin redirect and login flow

---

### 💡 Bonus Features

- File-based config sync with integrity hashing
- Config-targeting for agent groups
- Slack alerts and activity logs
- Multi-source feed support (manual, API, auto)

### 🔑 Key Features

✅ **Blocklist & Whitelist Management**  
Manage IPs and domains across multiple lists, including manual entries, feed imports, and API-reported threats.

✅ **Spam & Phishing Protection**

- Keyword-based spam filtering (supports Greek/Greeklish, loose/strict)
- Maintains a live phishing URL database
- Generates **ClamAV-compatible** virus definitions from phishing URLs and file hashes (MD5/SHA1/SHA256)

✅ **RBL & URIBL Generator**  
Creates real-time blocklists and URI lists (RBLDNSD format) for DNS-based blacklisting — used by SpamAssassin, Postfix, etc.

✅ **GeoIP Intelligence for Blocklist Entries**  
Automatically resolves:

- Reverse DNS (PTR)
- ASN and ISP
- Country and region This enables rich filtering, analytics, and decision-making.

✅ **Automated Feed Processing**  
Processes threat feeds on a schedule with logs and rule generation.

✅ **Agent Communication & API**  
Lightweight agents (or servers) can:

- Report blocked IPs back to CFM
- Fetch updates and policy
- Submit files, triggers, logs, etc.

✅ **Dashboard with Widgets & Metrics**  
Summarized view of:

- Top IPs by country or source
- Phishing trends
- Recent feed activity
- System health and jobs

✅ **Unblock Request Portal**  
Public-facing form for users to request delisting — reviewed via admin panel.

✅ **Full Admin UI via Filament**  
Modern interface for managing:

- Spam keywords
- Feeds & logs
- Phishing database
- Block/allow lists
- Scheduled jobs
- Settings & tokens

✅ **Scheduled Jobs & Artisan Tools**

- Generate IP and domain blocklists
- Run cleanup jobs
- Sync filesystem configs
- Rebuild ClamAV signatures
- Trigger per-feed processing

✅ **Agent Infrastructure (C++ Powered)**  
Includes high-performance **C++ agents** deployed on remote servers that:

- 🔄 Sync configuration and rule files from CFM
- 📤 Report blocked and unblocked IPs
- 🧼 Remove blocks upon updates or unblocks
- ♻️ Restart services (e.g., mail, firewall) when needed
- 🧭 Report "last seen" heartbeat to monitor health
- 🔔 Trigger Slack alerts if an agent goes offline
- 🤝 Integrate with the public unblock form to re-allow mistakenly blocked users

✅ **Blocklist & Whitelist Management**  
Manage IPs and domains across multiple lists (manual, API, or feed-driven), enriched with PTR, ASN, country, and GeoIP.

✅ **Phishing & Spam Defense**

- Greek-aware spam keyword detection (strict/loose)
- Maintains a phishing URL database
- Generates **ClamAV virus signatures** from URLs and hashes (MD5/SHA1/SHA256)
- Exports phishing data for **SpamAssassin compatibility**

✅ **RBL & URIBL Generation**  
Creates and serves real-time DNS blacklists (RBLDNSD format) for both IP and domain-based blocklists.

✅ **Scheduled Feed Ingestion & Rule Generation**  
Automates external feed syncing and keyword/rule building via Laravel Scheduler and Artisan commands.

✅ **Admin Dashboard**  
Modern UI with dashboard widgets, charts, and management panels for:

- Blocked items
- Keyword rules
- Feed logs
- Unblock requests
- Agent status

✅ **Unblock Request Portal**  
Frontend form where blocked users can request removal — triggers backend unblock workflows and agent sync.

✅ **API Interface**  
Secure, token-authenticated API to:

- Check IP/domain status
- Report blocks/unblocks
- Pull feed or rule updates
- Trigger diagnostics or config checks

✅ **ClamAV + CSF Integration**  
Outputs live files for:

- IP blocklists (`csf.deny`)
- ClamAV custom signatures
- RBLDNSD-based DNS lists

---

### 💡 Bonus Features

- Slack integration for agent down alerts
- Per-country analytics of blocked IPs
- Top reporters / sources breakdown
- File-based config sync and hashing
- Agent group targeting for rules

---

---

### 🧠 Use Cases

- Internal **spam firewall**
- Self-hosted **RBL/URIBL provider**
- **CSF / UFW / iptables** blocklist hub
- Aggregator for multiple **threat feeds**
- **Email security gateway** enhancement
- Coordinated threat response via **reporting agents**

---

### 💡 Built With

- Laravel + Filament (UI)
- MySQL (DB)
- Tailwind (optional UI)
- GeoLite2 (GeoIP)
- Artisan + Laravel Scheduler
- RBLDNSD & SpamAssassin compatibility
- API-first design