Analyze a raw message

post

{scheme}://{server}/v0/messages/analyze

Analyze a raw message with provided, active, or Feed rules in your Sublime organization. Raw messages are treated as inbound unless message_type specifies outbound or internal.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

message_type

object

Override on message types, defined from the perspective of your organization

queries

array of objects

Queries to analyze

queries

raw_message

string

required

The full base64 encoded raw eml message

rules

array of objects

Rules to analyze

rules

run_active_detection_rules

boolean

Defaults to false

Whether to analyze the message with all active detection rules in your organization

run_active_dlp_rules

boolean

Defaults to false

Whether to analyze the message with all active DLP rules in your organization. Requires read_dlp_rules, and the message being analyzed must be outbound or internal (sent).

run_all_detection_rules

boolean

Defaults to false

Whether to analyze with all detection rules from all Feeds, including uninstalled + inactive Feed rules, as well as any active detection rules you’ve created that are not part of a Feed.

run_all_dlp_rules

boolean

Defaults to false

Whether to analyze with all DLP rules from all Feeds, including uninstalled + inactive Feed rules, as well as any active DLP rules you've created that are not part of a Feed. Requires read_dlp_rules, and the message being analyzed must be outbound or internal (sent).

run_all_insights

boolean

Defaults to false

Whether to analyze with all insights

Response

200OK