Sublime Security
Open email security platform with Message Query Language detections and a free self-hosted Docker deployment.
Technical Architecture & Overview
Sublime Security is an email security platform whose detection rules are open source. Analysts write rules in Message Query Language (MQL) against the full parsed structure of a message, and a community rules repository provides a maintained baseline. It deploys against Microsoft 365 and Google Workspace through API, with a free self-hosted Docker deployment limited by active mailbox count and paid managed and AWS deployments.
Targeted Technical Use Cases
Teams that want detection-as-code for email with custom rules.
Evaluation & Trade-offs
Core Strengths
- +MQL queries a standardized JSON model of each parsed message.
- +Free self-hosted Docker edition for a limited number of active mailboxes.
- +Open source detection rules and links to community feeds are maintained in the sublime-rules repository.
Trade-Offs & Limitations
- -Effective use requires analyst time to write and tune rules.
- -The Docker deployment polls for new mail with at least a 15 second delay and is not intended for production.
Defensive Security Application
Custom phishing and BEC detections that respond to organization-specific attack patterns.
Frequently Asked Questions
What is Sublime Security?→
Sublime Security is an email security platform whose detection rules are open source. Analysts write rules in Message Query Language (MQL) against the full parsed structure of a message, and a community rules repository provides a maintained baseline. It deploys against Microsoft 365 and Google Workspace through API, with a free self-hosted Docker deployment limited by active mailbox count and paid managed and AWS deployments.
What is Sublime Security used for?→
Teams that want detection-as-code for email with custom rules.
What are the strengths of Sublime Security?→
- +MQL queries a standardized JSON model of each parsed message.
- +Free self-hosted Docker edition for a limited number of active mailboxes.
- +Open source detection rules and links to community feeds are maintained in the sublime-rules repository.
What are the limitations of Sublime Security?→
- +Effective use requires analyst time to write and tune rules.
- +The Docker deployment polls for new mail with at least a 15 second delay and is not intended for production.
How is Sublime Security used defensively?→
Custom phishing and BEC detections that respond to organization-specific attack patterns.