Configure the org_vips list

Overview

The Sublime Platform provides a standard list named org_vips that is useful for creating rules to detect VIP/Executive impersonations.

See all the Sublime Core Feed Rules that uses this list.

The org_vips list is backed by a Google Workspace group or a Microsoft 365 distribution list you specify, which should be a relatively small group or distribution list including VIPs in your organization who are especially likely to be impersonated by attackers. Members of this group are synced to Sublime daily, so that the list stays fresh.

📘

How groups sync to Sublime

The initial sync of Google Workspace groups or Microsoft 365 distribution lists takes up to a few hours after you connect Sublime. If you don't see any groups when following the setup below, check back later.

Sublime then refreshes both Google Workspace groups and Microsoft 365 distribution lists once a day, in a window that starts around 2:00 UTC. A group you create after that day's window won't appear in the picker below until the next one, so plan on waiting at least a day. Large tenants can take longer, because the refresh itself runs for a while after the window opens.

Sublime discovers your Google Workspace groups through the read-only directory permissions you grant when you connect the message source. A group's visibility setting in the Google Workspace Admin console doesn't affect whether Sublime can sync it. Microsoft 365 works the same way: Sublime reads your distribution lists through the read-only directory and group permissions granted when you consent to the Sublime app, so no separate sharing or visibility step is needed in Exchange.

Setup

To configure the org_vips list:

1. In the Sublime dashboard, click Lists in the navigation bar
2. Click the row for the org_vips list
3. Click the Edit button in the modal that appears
4. In the User Group section, search for the group or distribution list for your VIPs/executives
5. Select the matching group or list
6. Click Save
7. Click the row for the org_vips list again to view the list members synced to Sublime from Google Workspace or Microsoft 365

You're now able to use the org_vips list in your Sublime rules!

MQL Example

Here is an MQL snippet that checks if a message's sender matches the display name of any member of the org_vips list:

any($org_vips, .display_name == sender.display_name)

And here's a Sublime Feed Rule that uses this list.