For AI agents: the docs index is at https://docs.sublime.security/llms.txt. Append .md to any documentation page URL to get its markdown version.

Jump to Content

Documentation API Reference Product Releases

Documentation

Documentation API Reference Product Releases

Getting Started

Overview

Install Sublime

Installation Options
Sublime Cloud
Amazon AWS

Manage Sublime

Add Email/Message Sources
Configure "Report Phishing"
Configure "Quarantine Digests"
Access & Authentication
Export to S3
- Export Message MDMs
- Export Audit Logs and Message Events
Email Data Loss Prevention (DLP)
Inline Protection for Inbound Messages
IP Authentication Override

Use Sublime

Message types
Message groups
MQL Detection Rules
Automations
- Auto-respond to User Reports
Actions
Lists
- Configure the org_vips list
Exclusions
- Configure Link Analysis Exclusions
Blocklisting
Attack Score
ASA: Autonomous Security Analyst
Prompt injection detection (beta)
ADÉ: Autonomous Detection Engineer
Email Bomb Protection
Advanced Graymail Protection
Tailored Phishing Simulations and Training

Tutorials

MQL Guides

Reference

Message Data Model (MDM)
Message Query Language (MQL)
Metrics Collection in Self-Hosted Deployments

How-to Guides

Onboarding Guide: MDR, MSP and MSSP Partners
Mimecast Migration Guide
Proofpoint Migration Guide

Integrations

OpenCTI
CrowdStrike Next-Gen SIEM
CrowdStrike Falcon Fusion (SOAR)
CrowdStrike Falcon Sandbox

Support

Sublime Security - Access Requests

MQL Guides

This section contains some guides on Sublime MQL to help you get started in customizing MQL rules:

How to use message header values in a rule
How to detect manual outbound forwards
How to detect text in attachments
How to detect lookalike domains
How to detect keywords or phrases in the body content of messages

Updated about 1 month ago

Tailored Phishing Simulations and Training

How to use message header values in MQL