For AI agents: visit https://docs.sublime.security/llms.txt for an index of all pages formatted in Markdown and endpoints in OpenAPI. Append .md to any documentation page URL to get its markdown version.

Jump to Content

Documentation API Reference Product Releases

Documentation

Documentation API Reference Product Releases

Getting Started

Overview

Install Sublime

Installation Options
Sublime Cloud
Amazon AWS
Microsoft Azure
- Microsoft Azure ARM Install
Docker

Manage Sublime

Add Email/Message Sources
Configure "Report Phishing"
Configure "Quarantine Digests"
Access & Authentication
Export to S3
- Export Message MDMs
- Export Audit Logs and Message Events
Email Data Loss Prevention (DLP)
Inline Protection for Inbound Messages
IP Authentication Override

Use Sublime

Message types
Message groups
MQL Detection Rules
Automations
- Auto-respond to User Reports
Actions
Lists
- Configure the org_vips list
Exclusions
- Configure Link Analysis Exclusions
Blocklisting
Attack Score
ASA: Autonomous Security Analyst
ADÉ: Autonomous Detection Engineer
Email Bomb Protection
Multi-Tenancy Management
Advanced Graymail Protection
Tailored Phishing Simulations (Beta)

Tutorials

MQL Guides

Reference

Message Data Model (MDM)
Message Query Language (MQL)
Metrics Collection in Self-Hosted Deployments

How-to Guides

Onboarding Guide: MDR, MSP and MSSP Partners
Mimecast Migration Guide
Proofpoint Migration Guide

Integrations

OpenCTI
CrowdStrike Next-Gen SIEM
CrowdStrike Falcon Fusion (SOAR)
CrowdStrike Falcon Sandbox

MQL Guides

This section contains some guides on Sublime MQL to help you get started in customizing MQL rules:

How to use message header values in a rule
How to detect manual outbound forwards
How to detect text in attachments
How to detect lookalike domains
How to detect keywords or phrases in the body content of messages

Updated 15 days ago

Tailored Phishing Simulations (Beta)

How to use message header values in MQL