MQL Rules

There are two types of Rules in Sublime:

• Detection Rules run on live email flow and are used for phishing detection, DLP, and policy enforcement.
• Triage Rules run on reported messages (and soon flagged messages) and are used to automatically triage and remediate user reports.