Sublime

---
name: sublime
description: "Expert agent for Sublime Security. Covers MQL (Message Query Language), YAML detection rules, programmable email security, open-source community detections, and API-based M365/Google Workspace integration. WHEN: \"Sublime Security\", \"Sublime\", \"MQL\", \"Message Query Language\", \"email detection rules\", \"programmable email security\", \"Sublime YAML rules\", \"open source email detection\"."
license: MIT
---

# Sublime Security

This skill covers Sublime Security, the programmable email security platform that uses MQL (Message Query Language) and YAML detection rules to detect email threats. Sublime's open-source detection library and community-driven approach make it uniquely transparent and customizable.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **MQL rule writing** — Create or debug MQL detection rules
   - **YAML rule configuration** — Rule structure, severity, tags, actions
   - **Deployment** — API integration, M365/Google setup, self-hosted vs. cloud
   - **Detection tuning** — False positive reduction, safe sender lists, rule logic
   - **Investigation** — Message analysis, triage workflow, rule hit analysis

2. **MQL syntax** — MQL (Message Query Language) is Sublime's detection-rule language; use exact field names and operators from `references/architecture.md`, not generic YARA-style syntax.

3. **Recommend open-source rules** — Sublime's community library at `github.com/sublime-security/detection-rules` is a primary resource.

## MQL (Message Query Language)

MQL is Sublime's domain-specific language for expressing email detection conditions. It operates on a structured message object.

### Message Object Structure

```
sender                 # Sender metadata
  .email               # Full email address (string)
  .domain              # Domain only (string)
  .display_name        # Display name from From header (string)
  .local_part          # Part before @ (string)

recipients             # List of recipient objects
  [].email
  [].display_name

subject                # Subject line (string)

body                   # Message body
  .html                # HTML content (string)
  .plain               # Plain text content (string)
  .current_thread      # Current thread only (strips quoted replies)
    .text

attachments            # List of attachment objects
  [].filename          # Filename (string)
  [].extension         # File extension (string)
  [].content_type      # MIME type (string)
  [].size              # File size in bytes (int)
  [].sha256            # SHA256 hash (string)

headers                # All headers
  .reply_to            # Reply-To header addresses
  [].email
  [].display_name
  .return_path         # Return-Path (string)
  .received            # Received headers list
  .in_reply_to         # In-Reply-To header
  .message_id

links                  # Extracted URLs
  [].href              # Full URL (string)
  [].domain            # URL domain (string)
  [].tld               # Top-level domain (string)

authentication         # Authentication results
  .spf                 # SPF verdict (string: "pass"|"fail"|"softfail"|"neutral"|"none")
  .dkim                # DKIM verdict (string)
  .dmarc               # DMARC verdict (string)
  .dmarc_details
    .policy            # DMARC policy (string: "none"|"quarantine"|"reject")

conversation           # Thread/conversation data
  .is_reply            # Boolean — is this a reply?
  
network                # Network/sending data
  .client
    .ip                # Sending IP (string)
```

### MQL Operators and Functions

**String operations:**
```mql
strings.contains(str, "substring")        # Case-insensitive substring match
strings.icontains(str, "substring")       # Explicitly case-insensitive
strings.starts_with(str, "prefix")
strings.ends_with(str, "suffix")
strings.like(str, "wildcard*pattern")     # * and ? wildcards
strings.regex_match(str, "regex")         # Regular expression
strings.downcase(str)                     # Convert to lowercase
strings.length(str)                       # String length
```

**List operations:**
```mql
any(list, condition)     # True if any item in list matches condition
all(list, condition)     # True if all items in list match condition
length(list)             # Number of items
```

**Number operations:**
```mql
x > y, x < y, x >= y, x <= y, x == y, x != y
```

**Logical operators:**
```mql
and, or, not
```

**Custom functions:**
```mql
# ML scoring (when Sublime ML is enabled)
ml.link_analysis(href)          # ML-based URL risk score (0.0-1.0)
ml.body_analysis(text)          # ML-based body risk score
ml.sender_risk(email)           # Sender reputation score

# Display name analysis
profile.by_sender()             # Look up sender profile data
profile.by_sender_domain()      # Domain-level profile
```

### MQL Examples

**Simple BEC — external sender using executive display name:**
```mql
sender.email.domain not in $org_domains        // sender is external
and any($org_vip_display_names, strings.icontains(sender.display_name, .))
and headers.reply_to[0].email != sender.email  // reply-to differs
```

**Credential phishing — suspicious link in new sender message:**
```mql
any(links, strings.icontains(.domain, "login") or
           strings.icontains(.href, "password") or
           strings.icontains(.href, "verify"))
and not profile.by_sender_domain().prevalence.total > 100
and not conversation.is_reply
```

**Attachment with suspicious extension:**
```mql
any(attachments,
    .extension in ["exe", "vbs", "js", "wsf", "bat", "cmd", "ps1", "hta"]
)
```

**Lookalike domain detection:**
```mql
// Sender domain similar to org domain but not exact
strings.edit_distance(sender.email.domain, "example.com") in [1, 2]
and sender.email.domain != "example.com"
```

**QR code phishing:**
```mql
any(attachments,
    .content_type in ["image/png", "image/jpeg", "image/gif"]
)
and not any(links, .)   // no URLs in message body — only image
and (
    strings.icontains(body.plain, "scan") or
    strings.icontains(body.plain, "QR") or
    strings.icontains(body.plain, "camera")
)
```

**Invoice fraud — payment detail change request:**
```mql
(
    strings.icontains(body.current_thread.text, "banking") or
    strings.icontains(body.current_thread.text, "account number") or
    strings.icontains(body.current_thread.text, "routing number") or
    strings.icontains(body.current_thread.text, "wire transfer")
)
and (
    strings.icontains(body.current_thread.text, "update") or
    strings.icontains(body.current_thread.text, "change") or
    strings.icontains(body.current_thread.text, "new bank")
)
and not profile.by_sender_domain().prevalence.total > 50  // not an established sender
```

## YAML Rule Structure

Sublime detection rules are YAML files that combine metadata with MQL logic.

### Full Rule Schema

```yaml
name: "BEC - Executive Impersonation via Reply-To Mismatch"
description: |
  Detects messages where an external sender uses an executive's display name
  and provides a different reply-to address, a common BEC tactic to intercept
  replies.
  
  References:
  - https://attack.mitre.org/techniques/T1534/

type: "rule"
severity: "high"
source: |
  type.inbound
  and sender.email.domain not in $org_domains
  and any($org_vip_display_names, strings.icontains(sender.display_name, .))
  and headers.reply_to
  and all(headers.reply_to, .email.domain not in $org_domains)
  and headers.reply_to[0].email != sender.email

authors:
  - twitter: "@author_handle"
    name: "Author Name"

attack_types:
  - "BEC/Fraud"
  
tactics_and_techniques:
  - "Impersonation: Employee"
  - "Social engineering"

detection_methods:
  - "Header analysis"
  - "Sender analysis"

tags:
  - "BEC"
  - "Impersonation"

references:
  - "https://attack.mitre.org/techniques/T1534/"

testing_emails:
  - plain_text: "John, I need you to process an urgent wire transfer..."
```

### Rule Types

- `type: "rule"` — Standard detection rule
- `type: "signal"` — A boolean signal that can be referenced in other rules (for composability)

**Signal example:**
```yaml
name: "Signal - Sender Has No Prior Messages to Organization"
type: "signal"
source: |
  not profile.by_sender_domain().prevalence.total > 0

id: "sig_new_sender_domain"
```

**Rule referencing signal:**
```yaml
source: |
  $sig_new_sender_domain
  and any(links, ml.link_analysis(.href).credphish_score > 0.8)
```

### Built-in Variables

**Org-defined variables:**
```
$org_domains           # Your organization's email domains
$org_vip_display_names # List of executive names to protect
$safe_sender_list      # Allow-listed sender emails/domains
$internal_relay_ips    # Internal sending infrastructure IPs
```

These are configured in Sublime platform settings and injected into all rule evaluations.

## Deployment Architecture

### API-Based Integration (No MX Change)

Like Abnormal, Sublime connects via platform APIs.

**M365:**
- Microsoft Graph API via Azure App Registration
- Permissions: `Mail.ReadWrite`, `Mail.Read`, `User.Read.All`, `MailboxSettings.Read`
- Admin consent required

**Google Workspace:**
- Gmail API + Directory API
- Service account with domain-wide delegation

### Self-Hosted Option

Sublime Security can be deployed self-hosted (Docker/Kubernetes) for organizations with strict data residency requirements.

**Components:**
- `sublime-platform` — Core service
- `sublime-ui` — Web interface
- PostgreSQL — Message metadata storage
- Elasticsearch — Full-text search

Self-hosted retains full MQL capability; some ML features may require cloud connectivity.

### Cloud (SaaS)

Sublime cloud SaaS in US and EU regions. Data processed in tenant's selected region.

## Open-Source Detection Rules

Sublime's detection rule library is open-source at `github.com/sublime-security/detection-rules`.

**Organization of the library:**
```
detection-rules/
├── attack_tactics/
│   ├── bec/           # BEC rules
│   ├── credential-phishing/
│   ├── malware/
│   └── vishing/
├── brand-impersonation/
│   ├── microsoft/
│   ├── google/
│   ├── paypal/
│   └── ...
├── infrastructure/
│   ├── free-email-providers.yml
│   ├── link-shorteners.yml
│   └── ...
└── supplementary/
    ├── spf-dkim-dmarc/
    └── ...
```

**Contributing rules:** Rules can be contributed to the community library. Sublime Labs reviews and publishes community contributions.

**Rule updates:** Sublime automatically syncs new community rules to deployed instances (configurable sync schedule).

## Triage and Investigation Workflow

### Message Triage

When a rule fires, Sublime creates an alert in the triage queue.

**Triage view shows:**
- Rule name and description
- Matched signals (which MQL conditions were true)
- Message preview (sender, subject, body snippet)
- Sender profile data (prevalence, first-seen, risk indicators)
- Links with ML scores
- Attachments with hashes and verdicts

**Triage actions:**
- **Remediate:** Move to junk or delete
- **Mark safe:** Move to inbox, add sender to safe list
- **Escalate:** Assign to analyst for investigation

### Rule Performance Analysis

Sublime tracks per-rule performance:
- Hit rate (messages matched per day)
- False positive rate (% marked safe by analysts)
- True positive rate (% remediated as malicious)

Low-precision rules (high false positives) can be tuned or demoted in severity.

## Integration with Security Stack

**SIEM integration:**
Sublime sends alert events via webhook or syslog:
```json
{
  "event_type": "alert",
  "rule_name": "BEC - Executive Impersonation",
  "severity": "high",
  "message_id": "...",
  "sender": "attacker@domain.com",
  "recipients": ["finance@org.com"],
  "timestamp": "2024-01-01T10:00:00Z",
  "remediation_action": "moved_to_junk"
}
```

**API:**
```
GET  /v1/message-groups          # Alert/triage queue
GET  /v1/message-groups/{id}     # Alert details
POST /v1/message-groups/{id}/remediate
GET  /v1/rules                   # List active rules
POST /v1/rules                   # Create new rule
```

**Threat intel feeds:** Sublime can ingest indicator feeds (IPs, domains, URLs) to use in MQL rules via custom variables.