Sublime Security
Open email security platform with Message Query Language detections and a free community edition.
Technical Architecture & Overview
Sublime Security is an email security platform whose detection engine is open source. Analysts write rules in Message Query Language (MQL) against the full parsed structure of a message, and a community rules repository provides a maintained baseline. It deploys against Microsoft 365 and Google Workspace through API, with a free self-hosted community edition and paid enterprise plans.
Targeted Technical Use Cases
Teams that want detection-as-code for email, with custom rules version-controlled and tested like other detections.
Evaluation & Trade-offs
Core Strengths
- +MQL exposes message internals that closed products hide.
- +Open core with a genuinely usable free edition.
- +Community rule feed shortens deployment time.
Trade-Offs & Limitations
- -Effective use requires analyst time to write and tune rules.
- -Younger ecosystem than the established gateway vendors.
Defensive Security Application
Custom phishing and BEC detections that respond to organization-specific attack patterns.
Frequently Asked Questions
What is Sublime Security?→
Sublime Security is an email security platform whose detection engine is open source. Analysts write rules in Message Query Language (MQL) against the full parsed structure of a message, and a community rules repository provides a maintained baseline. It deploys against Microsoft 365 and Google Workspace through API, with a free self-hosted community edition and paid enterprise plans.
What is Sublime Security used for?→
Teams that want detection-as-code for email, with custom rules version-controlled and tested like other detections.
What are the strengths of Sublime Security?→
- +MQL exposes message internals that closed products hide.
- +Open core with a genuinely usable free edition.
- +Community rule feed shortens deployment time.
What are the limitations of Sublime Security?→
- +Effective use requires analyst time to write and tune rules.
- +Younger ecosystem than the established gateway vendors.
How is Sublime Security used defensively?→
Custom phishing and BEC detections that respond to organization-specific attack patterns.