Unfortunately that won't help in this context. I want to know the from/to address for each email that comes in to my server, and use that with an algorithm I'm developing to alter the spam weight score. There is a pattern I've seen over the long term that I think can identify a lot of the missed spam. Ideally, would like to see the from/to/IP address combination.
This would be a lot easier if SM had a global filter list that I could update dynamically, but it doesn't. In lieu of that, I might be able to update the content filters at each domain level. What triggers refreshing those? If an external process updated the xml file for the content filter list, would SM see it had been updated and re-read it?