Introduction

๐Ÿ“˜

Early access

The Sublime Platform is currently in early access. You can request early access here.

The Sublime Platform lets security and IT teams run custom detection rules on live email flow in Microsoft 365 and Google Workspace environments. IMAP and APIs for direct ingestion are also supported.

Use the Sublime Platform to:

  • catch phishing attacks and automatically remediate before users report them
  • catch and block attacks that you're receiving right now but can't do anything about

At its core, Sublime is a rules engine that ingests email messages from arbitrary sources, evaluates it using a powerful query language, and then takes any number of actions like generating a webhook notification or inserting a warning banner. Below is an example of a simple rule:

name: HTML smuggling via attachment
severity: high
source: |
  type.inbound
  and any(attachments, .file_extension in~ ('html', 'htm') 
          and any(binexplode(.),
                  any(.scan.javascript.identifiers, . == "unescape")
          )
  )
actions: 
  alert: webhook
  block: quarantine
tags: 
  - "Suspicious attachment"
  - "HTML smuggling"