HIP — Customer Self-Implementation Guide

HIP stands for historical ingestion process. This process pulls historical message data from to establish a baseline within an email environment.

Confirm which mail platform you use (Microsoft 365 or Google Workspace)
Confirm which mailboxes are in scope
- Whether you want all mailboxes or a subset
Time range for the backfill
- 90 days being the max, 30 days as best practice
Confirm you can provide the required permissions (admin-level w/in Sublime)

Ensure a message source is added
Go to mailboxes on the left side bar and click on activate for any you want to run during the HIP process

Sublime’s detection rules use organizational context to detect impersonation of high-value employees.
- Go to the left side bar and click on lists
- Scroll down to Org_VIPS and add either a manual string list of emails or a user group list.

Start ingestion for the agreed mailbox set
- Go to finish account set up in the top right corner
- Click on start Historical Ingestion
Expect processing time to vary based on:
- Number of mailboxes
- Size of backfill window
- API rate limits and platform constraints

Use this checklist:

Monitor for:
- Permission changes
- Mailbox adds or removals
- API quota/rate limit issues
Apply Exclusions:
- Remove known spam
- Confirm mailbox scope still matches your policy
Turn on standard Automations in Passive
- Confirm actions based on attack score verdict
- Confirm actions are agreed upon, reduce FP's and FN's
** If a small amount of messages try to clear all messages before starting live flow, if you have thousands of messages focus on known malicious.

Step 6: Turn on Live Flow
- Once you have zero'd out or reduced the amount of back flow to your satisfaction then click "turn on live flow". This will begin ingesting all live mail from your native mail provider into Sublime