How the-minecrafters/mailent works
Mailent is a mail-transport security platform for forensic analysis, infrastructure assessment, and continuous monitoring. Analysts use the web console or CLI to inspect captures, assess mail infrastructure, review findings, and manage remediation; sensors and probes also submit evidence to the core service. The documented analysis flow combines normalized evidence with deterministic policy evaluation, drift/posture analysis, and separate Jev risk triage, then exposes results and reports. Major subsystems are included from the README and tree; detailed wiring for unsampled API handlers and optional integrations is necessarily summarized.
Main entry points: mod.rs Core API · pipeline.rs Evidence Pipeline · dual_storage.rs Storage Facade · main.rs Sensor Agent
Components 22
Analyst Interfaces
- Web Console
apps/web/src/App.tsx - Web API Client
apps/web/src/api.ts - CLI
apps/cli/src/main.rs - Core Service
apps/core/src/main.rs - Core API
apps/core/src/api/mod.rs
Evidence Collection
- Zeek Analyzer
- Sensor Agent
apps/sensor/src/main.rs - Active Probe
apps/probe/src/main.rs - Infrastructure Scanner
crates/scanner/src/scanner.rs - Mail Security Lookups
crates/integrations/src/lib.rs
Security Analysis
- Evidence Pipeline
apps/core/src/pipeline.rs - Deterministic Policies
crates/policy/src/evaluator.rs - Drift and Posture
crates/correlation/src/lib.rs - Jev Risk Triage
crates/decision/src/jev.rs - Forensic Reports
crates/reporting/src/builder.rs - Domain Models
crates/domain/src/lib.rs
Security Operations
- Remediation Workflow
apps/core/src/remediation.rs - Connected Devices
apps/core/src/api/devices.rs - Live Monitoring
apps/sensor/src/live.rs
Persistence
- Storage Facade
apps/core/src/dual_storage.rs - Postgres and ClickHouse
crates/storage/src/lib.rs
Other components
- Analyst
Connections 24
- Analyst → Web Console: uses console
- Analyst → CLI: runs commands
- Web Console → Web API Client: requests data
- Web API Client → Core API: calls endpoints
- CLI → Zeek Analyzer: analyzes captures
- Sensor Agent → Zeek Analyzer: analyzes traffic
- Sensor Agent → Core API: submits observations
- Active Probe → Domain Models: produces probe evidence
- Analyst → Infrastructure Scanner: requests assessment
- Infrastructure Scanner → Mail Security Lookups: checks mail security
- Core Service → Core API: serves routes
- Core API → Evidence Pipeline: processes observations
- Evidence Pipeline → Deterministic Policies: evaluates findings
- Evidence Pipeline → Drift and Posture: correlates drift
- Evidence Pipeline → Jev Risk Triage: requests triage
- Evidence Pipeline → Domain Models: builds security records
- Core API → Forensic Reports: builds dossiers
- Core API → Remediation Workflow: manages fixes
- Core API → Connected Devices: manages enrollment
- Sensor Agent → Live Monitoring: runs live capture
- Core API → Storage Facade: reads and writes
- Evidence Pipeline → Storage Facade: persists results
- Storage Facade → Postgres and ClickHouse: delegates repository operations
- Storage Facade → Domain Models: stores domain records