Sublime

Reference for the Tracecat Sublime integration: registered actions, required secrets, expected inputs, and example workflow usage.

Activate rule

Action ID: tools.sublime.activate_rule

Activate a Sublime rule.

Reference: https://docs.sublime.security/reference/activaterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Add list entry

Action ID: tools.sublime.add_list_entry

Add an entry to a Sublime list.

Reference: https://docs.sublime.security/reference/addlistentry-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

string · string · required

String list entry

base_url · string | null

Base URL of the Sublime API.

Default: null.

Analyze EML

Action ID: tools.sublime.analyze_eml

Analyze an EML message against active detection rules and ML attack score in Sublime.

Reference: https://docs.sublime.security/reference/analyzemessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

eml_base64 · string · required

Base64-encoded EML file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Analyze EML with the free analyzer

Action ID: tools.sublime.eml_analyze

Analyze a raw message with the free, unauthenticated Sublime EML Analyzer API.

Reference: https://docs.sublime.security/reference/analysis-api-introduction

Input fields

payload · object · required

API-native request body. Documented fields: raw_message (required), queries, rules, run_active_detection_rules, run_all_detection_rules, run_all_insights.

base_url · string

Base URL of the Sublime EML Analyzer API.

Default: "https://analyzer.sublime.security".

Analyze message by ID

Action ID: tools.sublime.analyze_message_by_id

Analyze an existing Sublime message with API-native rules or queries.

Reference: https://docs.sublime.security/reference/analyzemessagebyid

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

payload · object · required

API-native request body. Documented fields: queries, rules, run_active_detection_rules, run_all_detection_rules, run_all_insights.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Analyze URL

Action ID: tools.sublime.analyze_url

Analyze a URL with ML link analysis in Sublime.

Reference: https://docs.sublime.security/docs/enrichment-functions#mllink_analysis

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

url · string · required

URL to analyze.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Attack score for message

Action ID: tools.sublime.attack_score_for_message

Evaluate the attack score of an existing Sublime message.

Reference: https://docs.sublime.security/reference/attackscoreformessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Attack score for raw message

Action ID: tools.sublime.score_eml

Evaluate the Sublime attack score for a base64-encoded raw EML message.

Reference: https://docs.sublime.security/reference/attackscoreforrawmessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

eml_base64 · string · required

Base64-encoded EML file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

BinExplode file

Action ID: tools.sublime.binexplode

Submit a base64-encoded file to Sublime BinExplode and return the task response.

Reference: https://docs.sublime.security/reference/postscan-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

file_contents · string · required

Base64-encoded raw file contents.

file_name · string · required

Name of the submitted file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create email bomb

Action ID: tools.sublime.create_email_bomb

Declare a mailbox time range as a Sublime email bomb.

Reference: https://docs.sublime.security/reference/createemailbomb

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

end_time · string · required

End of the email bomb time range (must not be in the future)

mailbox_id · string · required

ID of the mailbox to declare the email bomb for

start_time · string · required

Start of the email bomb time range

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create list

Action ID: tools.sublime.create_list

Create a Sublime list.

Reference: https://docs.sublime.security/reference/createlist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

description · string · required

Description of list

name · string · required

Unique name used to reference the list in MQL

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create message

Action ID: tools.sublime.create_message

Create a Sublime message data model from a raw message.

Reference: https://docs.sublime.security/reference/createmessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: raw_message (required), canonical_id, external_created_at, external_message_id, external_thread_id, folder, labels, mailbox_email_address, message_type, route_type.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create rule

Action ID: tools.sublime.create_rule

Create a Sublime detection, DLP, or triage rule.

Reference: https://docs.sublime.security/reference/createrule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: name (required), source (required), action_ids, active, attack_types, authors, auto_review_auto_share, auto_review_classification, description, detection_methods, false_positives, internal_type, label, maturity, references, run_triage_on_excluded_messages, severity, tactics_and_techniques, tags, triage_abuse_reports, triage_classification_changes, triage_dlp_rule_matched, triage_flagged_messages, type, user_provided_tags.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Deactivate rule

Action ID: tools.sublime.deactivate_rule

Deactivate a Sublime rule.

Reference: https://docs.sublime.security/reference/deactivaterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Delete list

Action ID: tools.sublime.delete_list

Delete a Sublime list.

Reference: https://docs.sublime.security/reference/deletelist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Delete list entry

Action ID: tools.sublime.delete_list_entry

Delete an entry from a Sublime list.

Reference: https://docs.sublime.security/reference/deletelistentry-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

string · string · required

String list entry

base_url · string | null

Base URL of the Sublime API.

Default: null.

Delete rule

Action ID: tools.sublime.delete_rule

Delete a Sublime rule.

Reference: https://docs.sublime.security/reference/deleterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Dismiss email bomb

Action ID: tools.sublime.dismiss_email_bomb

Dismiss a Sublime email-bomb incident.

Reference: https://docs.sublime.security/reference/dismissemailbomb

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Email bomb ID.

payload · object · required

API-native request body. Documented fields: review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Dismiss message group

Action ID: tools.sublime.dismiss_message_canonical_group

Dismiss a Sublime message group and its future messages.

Reference: https://docs.sublime.security/reference/dismissmessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native request body. Documented fields: classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Dismiss multiple message groups

Action ID: tools.sublime.dismiss_multiple_message_groups

Dismiss multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/dismissmultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: message_group_ids (required), classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get BinExplode scan

Action ID: tools.sublime.get_binexplode_scan

Retrieve the current status and results of a Sublime BinExplode task.

Reference: https://docs.sublime.security/reference/getscan-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

BinExplode task ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get email bomb

Action ID: tools.sublime.get_email_bomb

Retrieve a Sublime email-bomb incident.

Reference: https://docs.sublime.security/reference/getemailbomb

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Email bomb ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get hunt job

Action ID: tools.sublime.get_hunt_job

Retrieve the current state and summary of a Sublime hunt job.

Reference: https://docs.sublime.security/reference/gethuntjob

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Hunt job ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get hunt job results

Action ID: tools.sublime.get_hunt_job_results

Retrieve detailed results for a Sublime hunt job.

Reference: https://docs.sublime.security/reference/gethuntjobresults

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Hunt job ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

limit · integer | null

The maximum number of results to return.

Default: null.

offset · integer | null

The (zero-based) offset of the first hunt job results to return.

Default: null.

Get list

Action ID: tools.sublime.get_list

Retrieve a Sublime list.

Reference: https://docs.sublime.security/reference/getlist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get list entries

Action ID: tools.sublime.get_list_entries

Retrieve all entries in a Sublime list.

Reference: https://docs.sublime.security/reference/getlistentries-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get list entry

Action ID: tools.sublime.get_list_entry

Check for and retrieve an entry in a Sublime list.

Reference: https://docs.sublime.security/reference/getlistentry-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

string · string · required

String list entry

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get lists

Action ID: tools.sublime.get_lists

Retrieve Sublime lists using API-native filters.

Reference: https://docs.sublime.security/reference/getlists-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

entry_type · string · required

List type to filter by. One of ‘string’, ‘user_group’, ‘provider_org_unit’.

base_url · string | null

Base URL of the Sublime API.

Default: null.

id · string | null

Optional ID (exact match) to filter by

Default: null.

name · string | null

Optional name (exact match) to filter by

Default: null.

Get message

Action ID: tools.sublime.get_message

Retrieve a Sublime message.

Reference: https://docs.sublime.security/reference/getmessage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

recompute_mdm_from_raw · boolean | null

When true, recompute the MDM from the raw EML. For internal use only!

Default: null.

remove_large_text_fields · boolean | null

When true, any text field over 1MB will be cleared before returning

Default: null.

Get message attachment image

Action ID: tools.sublime.get_message_attachment_image

Retrieve rendered images for a PDF attachment by MD5 hash.

Reference: https://docs.sublime.security/reference/getmessageattachmentimage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

hash · string · required

MD5 hash of the attachment.

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get message data model

Action ID: tools.sublime.get_message_data_model

Retrieve the Message Data Model for a Sublime message.

Reference: https://docs.sublime.security/reference/getmessagedatamodel-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

recompute_mdm_from_raw · boolean | null

When true, recompute the MDM from the raw EML. For internal use only!

Default: null.

remove_large_text_fields · boolean | null

When true, any text field over 1MB will be cleared before returning

Default: null.

Get message EML

Action ID: tools.sublime.get_message_eml

Retrieve the raw EML for a Sublime message.

Reference: https://docs.sublime.security/reference/getmessageeml

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get message group

Action ID: tools.sublime.get_message_group

Retrieve a Sublime message group.

Reference: https://docs.sublime.security/reference/getmessagegroup

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

sort_previews_message_id__is · array[string] | null

Sort previews with these message IDs at the top

Default: null.

Get message group action state

Action ID: tools.sublime.get_message_canonical_group_action_state

Retrieve manual action state for a canonical message group.

Reference: https://docs.sublime.security/reference/getmessagecanonicalgroupactionstate

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

created_at__gte · string | null

Only return action states created after this time

Default: null.

limit · integer | null

The maximum number of action states to return. If the value exceeds the maximum, then the maximum value will be used.

Default: null.

offset · integer | null

The (zero-based) offset of the action states to return

Default: null.

Get message group SIEM summary

Action ID: tools.sublime.get_message_group_siem_summary

Retrieve the reduced-field SIEM summary of flagged message groups.

Reference: https://docs.sublime.security/reference/getmessagegroupsiemsummary

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

cursor · string | null

Opaque pagination cursor returned in the previous response’s cursor field.

Default: null.

limit · integer | null

The maximum number of message groups to return.

Default: null.

timestamp__gte · string | null

Inclusive lower bound on the sort timestamp (newest_created_at for type=flagged, first_reported_as_phish_at for type=reported).

Default: null.

timestamp__lt · string | null

Exclusive upper bound on the sort timestamp (newest_created_at for type=flagged, first_reported_as_phish_at for type=reported).

Default: null.

type · string | null

Which timestamp the endpoint sorts/filters on: ‘flagged’ uses newest_created_at, ‘reported’ uses first_reported_as_phish_at. Possible values: flagged, reported.

Default: null.

Get message image

Action ID: tools.sublime.get_message_image

Retrieve rendered images for a Sublime message.

Reference: https://docs.sublime.security/reference/getmessageimage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

recompute_mdm_from_raw · boolean | null

When true, recompute the MDM from the raw EML. For internal use only!

Default: null.

remove_large_text_fields · boolean | null

When true, any text field over 1MB will be cleared before returning

Default: null.

Get message image link

Action ID: tools.sublime.get_message_image_link

Retrieve a temporary link to a rendered Sublime message image.

Reference: https://docs.sublime.security/reference/getmessageimagelink-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

link_duration_seconds · integer | null

Period link should be valid for. Default is 15 minutes, max 7 days.

Default: null.

platform_link · boolean | null

When true, link will always be presigned against Sublime. When false, the link may be to S3 directly.

Default: null.

recompute_mdm_from_raw · boolean | null

When true, recompute the MDM from the raw EML. For internal use only!

Default: null.

remove_large_text_fields · boolean | null

When true, any text field over 1MB will be cleared before returning

Default: null.

Get rule

Action ID: tools.sublime.get_rule

Retrieve a Sublime rule.

Reference: https://docs.sublime.security/reference/getrule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get rule history

Action ID: tools.sublime.get_rule_history

Retrieve history for a Sublime rule.

Reference: https://docs.sublime.security/reference/getrulehistory

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

classification_created_at_gte · string | null

Filter by classifications made after this datetime. Results are limited to the most recent 180 days.

Default: null.

classification_created_at_lte · string | null

Filter by classifications made before this datetime. Results are limited to the most recent 180 days.

Default: null.

use_rule_last_updated_as_created_at · boolean | null

Filter by classifications made since the rule has been updated. Results are limited to the most recent 180 days.

Default: null.

Get task

Action ID: tools.sublime.get_task

Retrieve the current status of a Sublime task.

Reference: https://docs.sublime.security/reference/gettask-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime task ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Graymail multiple message groups

Action ID: tools.sublime.graymail_multiple_message_groups

Move multiple Sublime message groups to Graymail.

Reference: https://docs.sublime.security/reference/graymailmultiplemessagegroups

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: message_group_ids (required), classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

List email bombs

Action ID: tools.sublime.list_email_bombs

List Sublime email-bomb incidents using API-native filters.

Reference: https://docs.sublime.security/reference/listemailbombs

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

active · boolean | null

Filter by active status. true = only active, false = only inactive, null = all

Default: null.

base_url · string | null

Base URL of the Sublime API.

Default: null.

dismissed · boolean | null

Filter by dismissed status. true = only dismissed, false = only not dismissed, null = all

Default: null.

limit · integer | null

The maximum number of email bombs to return

Default: null.

offset · integer | null

The (zero-based) offset of the email bombs to return

Default: null.

List mailboxes

Action ID: tools.sublime.list_mailboxes

List Sublime mailboxes using API-native filters.

Reference: https://docs.sublime.security/reference/listmailboxes

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

active · boolean | null

Filter for effectively active mailboxes (marked active with a live subscription)

Default: null.

base_url · string | null

Base URL of the Sublime API.

Default: null.

email_addresses · string | null

Email addresses of the mailboxes to return (comma-delimited)

Default: null.

limit · integer | null

The maximum number of entries to return. If the value exceeds the maximum, then the maximum value will be used

Default: null.

mailbox_types · string | null

Comma-delimited list of mailbox types to filter by

Default: null.

marked_active · boolean | null

Filter for mailboxes marked active

Default: null.

message_source_id · string | null

ID of the message source the mailboxes belong to

Default: null.

offset · integer | null

The (zero-based) offset of the first mailbox to return

Default: null.

search · string | null

Search across mailbox names and email addresses

Default: null.

sub_error_types · string | null

Comma-delimited list of subscription error types to filter by

Default: null.

List message groups

Action ID: tools.sublime.list_message_groups

List Sublime message groups using API-native filters.

Reference: https://docs.sublime.security/reference/listmessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

attachment_name__is · array[string] | null

Filters result to only message groups with the provided attachment name

Default: null.

attachment_sha256__is · array[string] | null

Filters result to only message groups with the provided attachment SHA256

Default: null.

attack_score_verdict__is · array[string] | null

Filters result to only message groups with the provided attack score verdict. Possible values: unknown, likely_benign, suspicious, malicious, graymail, spam.

Default: null.

attack_surface_reduction__filter · boolean | null

Filters result to only message groups that have flagged (ONLY) rules with the ‘Attack surface reduction’ tag

Default: null.

base_url · string | null

Base URL of the Sublime API.

Default: null.

canonical_id__is · array[string] | null

Filters result to only message groups with the provided canonical ID

Default: null.

created_at__gte · string | null

Inclusive start datetime filter, in UTC using the ISO 8601 format (e.g., ‘2021-03-14T15:09:26Z’). Only message groups that contain a message processed at or after this time will be returned.

Default: null.

created_at__lt · string | null

Exclusive end datetime filter, in UTC using the ISO 8601 format (e.g., ‘2021-05-04T15:09:26Z’). Only message groups that contain a message processed before this time will be returned. Paired with created_at__gte this selects groups that were active at any point in the window, including groups that are still receiving messages after it. Note that this bounds a group’s oldest message while created_at__gte bounds its newest, so the two cannot be served by a single index and the request may time out on high volume organizations or wide date ranges. If you only need groups whose newest message falls inside the window, prefer last_created_at__lt, which bounds the same field as created_at__gte.

Default: null.

first_message_reported_at__gte · string | null

Filters result to only message groups with a message first reported at or after the provided time. Datetime must be in UTC using the ISO 8601 format (e.g., ‘2021-03-14T15:09:26Z’).

Default: null.

flagged · boolean | null

Filters result to only message groups with at least one flagged message

Default: null.

flagged_rule_id__is · array[string] | null

Filters result to only message groups with the provided flagged rule ID

Default: null.

flagged_rule_severity__is · array[string] | null

Filters result to only message groups with the provided flagged rule severity. Possible values: informational, low, medium, high, critical.

Default: null.

historically_flagged_rule_id__is · array[string] | null

Filters result to only message groups with the provided historically flagged rule ID

Default: null.

historically_flagged_rule_severity__is · array[string] | null

Filters result to only message groups with the provided historically flagged rule severity. Possible values: informational, low, medium, high, critical.

Default: null.

last_created_at__gte · string | null

Inclusive start datetime filter, in UTC using the ISO 8601 format (e.g., ‘2021-03-14T15:09:26Z’). Only message groups whose newest message was processed at or after this time will be returned. Equivalent to created_at__gte.

Default: null.

last_created_at__lt · string | null

Exclusive end datetime filter, in UTC using the ISO 8601 format (e.g., ‘2021-05-04T15:09:26Z’). Only message groups whose newest message was processed before this time will be returned. Unlike created_at__lt, groups that are still receiving messages after this time are excluded. Prefer this over created_at__lt for historical lookbacks, since it bounds the same field as created_at__gte and both can then be served by a single index. High volume organizations may still need to request narrow time windows to avoid a timeout.

Default: null.

limit · integer | null

The maximum number of message groups to return. If the value exceeds the maximum, then the maximum value will be used.

Default: null.

mailbox_email__is · array[string] | null

Filters result to only message groups with the provided mailbox email

Default: null.

offset · integer | null

The (zero-based) offset of the message groups to return

Default: null.

recipient_email__is · array[string] | null

Filters result to only message groups with the provided recipient email

Default: null.

reported_as_phish_by__is · array[string] | null

Filters result to only message groups with the provided reporter

Default: null.

reviewed · boolean | null

Filters result to only message groups which have or have not been reviewed

Default: null.

sender_display_name__is · array[string] | null

Filters result to only message groups with the provided sender display name

Default: null.

sender_domain__is · array[string] | null

Filters result to only message groups with the provided sender domain

Default: null.

sender_email__is · array[string] | null

Filters result to only message groups with the provided sender email

Default: null.

spam__is · array[string] | null

Filters result to only message groups with the provided spam status. Possible values: spam, not_spam, mixed.

Default: null.

subject__is · array[string] | null

Filters result to only message groups with the provided subject

Default: null.

user_reported · boolean | null

Filters result to only message groups with at least one reported message

Default: null.

vendor_id__is · array[string] | null

Filters result to only message groups with the provided vendor

Default: null.

List rule history

Action ID: tools.sublime.list_rule_history

List history across Sublime rules using API-native filters.

Reference: https://docs.sublime.security/reference/listrulehistory

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

classification_created_at_gte · string · required

Filter by classifications made after this datetime. Results are limited to the most recent 180 days.

classification_created_at_lte · string · required

Filter by classifications made before this datetime. Results are limited to the most recent 180 days.

active · boolean | null

Restrict to rules that are active

Default: null.

base_url · string | null

Base URL of the Sublime API.

Default: null.

count · integer | null

Number of results to return

Default: null.

in_feed · boolean | null

Restrict to rules that are in a feed

Default: null.

offset · integer | null

Offset from the first result

Default: null.

type · array[string] | null

Restrict to rules that have one of the given types. One of ‘detection’, ‘triage’, ‘dlp’.

Default: null.

List rules

Action ID: tools.sublime.list_rules

List Sublime rules using API-native filters.

Reference: https://docs.sublime.security/reference/listrules-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

in_feed · boolean | null

Restrict to rules that are explicitly in or not in a feed

Default: null.

limit · integer | null

The maximum number of entries to return. Maximum value is 500.

Default: null.

offset · integer | null

The (zero-based) offset of the first rule to return

Default: null.

search · string | null

Search for matching case-insensitive substring across rule name, description, and MQL source

Default: null.

List user reports

Action ID: tools.sublime.list_user_reports

List Sublime user-reported messages using API-native filters.

Reference: https://docs.sublime.security/reference/listuserreports

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

limit · integer | null

The maximum number of message groups to return. If the value exceeds the maximum, then the maximum value will be used.

Default: null.

reported_at_gte · string | null

Inclusive start datetime filter for time of report, in UTC using the ISO 8601 format (e.g., ‘2021-03-14T15:09:26Z’). Only reports at or after this time will be returned.

Default: null.

reported_at_lt · string | null

Exclusive end datetime filter for time of report, in UTC using the ISO 8601 format (e.g., ‘2021-03-14T15:09:26Z’). Only reports before this time will be returned.

Default: null.

Patch list

Action ID: tools.sublime.patch_list

Update a Sublime list with an API-native patch body.

Reference: https://docs.sublime.security/reference/patchlist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

description · string · required

Description of list

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Perform message actions

Action ID: tools.sublime.action_message

Perform API-native actions on an individual Sublime message.

Reference: https://docs.sublime.security/reference/actionmessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

payload · object · required

API-native request body. Documented fields: action, custom_action_ids, share_with_sublime.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Quarantine message group

Action ID: tools.sublime.quarantine_message_canonical_group

Quarantine a Sublime message group and its future messages.

Reference: https://docs.sublime.security/reference/quarantinemessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native request body. Documented fields: classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Quarantine multiple message groups

Action ID: tools.sublime.quarantine_multiple_message_groups

Quarantine multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/quarantinemultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: message_group_ids (required), classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Render attachment image

Action ID: tools.sublime.get_message_attachment_image_raw

Render images from a base64-encoded raw attachment.

Reference: https://docs.sublime.security/reference/getmessageattachmentimageraw-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: raw (required), file_type.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Restore message

Action ID: tools.sublime.restore_message

Restore a previously remediated Sublime message.

Reference: https://docs.sublime.security/reference/restoremessage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Restore message group

Action ID: tools.sublime.restore_message_canonical_group

Restore a Sublime message group and disable future remediation.

Reference: https://docs.sublime.security/reference/restoremessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native request body. Documented fields: classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Restore multiple message groups

Action ID: tools.sublime.restore_multiple_message_groups

Restore multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/restoremultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: message_group_ids (required), classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Retrieve ASA report

Action ID: tools.sublime.retrieve_asa_report

Retrieve the Autonomous Security Analyst report for a message.

Reference: https://docs.sublime.security/reference/retrieveasareport

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Retrieve ASA verdict

Action ID: tools.sublime.retrieve_asa_verdict

Retrieve the Autonomous Security Analyst verdict for a message.

Reference: https://docs.sublime.security/reference/retrieveasaverdict

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Review message groups

Action ID: tools.sublime.review_message_groups

Review, classify, and take actions on Sublime message groups.

Reference: https://docs.sublime.security/reference/reviewmessagegroups

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: classification (required), message_group_ids (required), action, custom_action_ids, generate_asa_lesson, review_comment, share_with_sublime.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Scan file with BinExplode

Action ID: tools.sublime.scan_file

Scan a file with BinExplode and return the completed scan results.

Reference: https://docs.sublime.security/reference/postscan-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

file_base64 · string · required

Base64-encoded file.

file_name · string · required

Name of the file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Search message groups

Action ID: tools.sublime.search_message_groups

Search Sublime message groups using API-native query parameters.

Reference: https://docs.sublime.security/reference/searchmessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

any · string | null

Searches every field (performs a case insensitive, OR search in all fields). Not compatible with other search fields.

Default: null.

attachment_md5 · string | null

Search for messages containing an attachment MD5 match

Default: null.

attachment_sha1 · string | null

Search for messages containing an attachment SHA1 match

Default: null.

attachment_sha256 · string | null

Search for messages containing an attachment SHA256 match

Default: null.

base_url · string | null

Base URL of the Sublime API.

Default: null.

created_at_gte · string | null

Inclusive start datetime filter for search, in UTC using the ISO 8601 format (e.g., ‘2021-03-14T15:09:26Z’). Only message groups with a message processed at or after this time will be returned.

Default: null.

created_at_lt · string | null

Exclusive end datetime filter for search, in UTC using the ISO 8601 format (e.g., ‘2021-05-04T15:09:26Z’). Only message groups with a message processed before this time will be returned.

Default: null.

file_name · string | null

Search in attachment filenames (case insensitive wildcard match)

Default: null.

first_reported_as_phish_at_gte · string | null

Inclusive start datetime filter for search, in UTC using the ISO 8601 format (e.g., ‘2021-03-14T15:09:26Z’). Only message groups reported at or after this time will be returned.

Default: null.

first_reported_as_phish_at_lt · string | null

Exclusive end datetime filter for search, in UTC using the ISO 8601 format (e.g., ‘2021-05-04T15:09:26Z’). Only message groups reported before this time will be returned.

Default: null.

limit · integer | null

The maximum number of message groups to return. If the value exceeds the maximum, then the maximum value will be used.

Default: null.

mailbox · string | null

Search for a mailbox by email address (case insensitive, wildcard match)

Default: null.

message_id · string | null

Search in the Message-ID header (case insensitive exact match; wildcards are not supported)

Default: null.

offset · integer | null

The (zero-based) offset of the message groups to return

Default: null.

sender · string | null

Search in the From field (case insensitive wildcard match)

Default: null.

states · array[string] | null

Search for messages in any of the given states

Default: null.

subject · string | null

Search in the message subject (case insensitive wildcard match)

Default: null.

to · string | null

Search in the To, CC, and Bcc fields (case insensitive wildcard match). If possible, use ‘mailbox’ and ‘type’ instead for better performance

Default: null.

type · array[string] | null

Search for messages by type. Multiple values are OR’d together.

Default: null.

Set list entries

Action ID: tools.sublime.set_list_entries

Replace all entries in a Sublime list.

Reference: https://docs.sublime.security/reference/setlistentries-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

entries · array[string] · required

List entries

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Set message access justification

Action ID: tools.sublime.set_message_access_justification

Set the message-content access justification for the API user.

Reference: https://docs.sublime.security/reference/setmessageaccessjustification-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

payload · object · required

API-native request body. Documented fields: justification.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Share message group with Sublime

Action ID: tools.sublime.share_with_sublime_public

Share a message group with the Sublime team.

Reference: https://docs.sublime.security/reference/sharewithsublimepublic-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native request body. Documented fields: destination, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Start hunt job

Action ID: tools.sublime.start_hunt_job

Start an asynchronous Sublime hunt job.

Reference: https://docs.sublime.security/reference/starthuntjob

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: range_end_time (required), range_start_time (required), source (required), name, private, triage_email_bomb, triage_flagged, triage_reported.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Trash message

Action ID: tools.sublime.trash_message

Trash an individual Sublime message.

Reference: https://docs.sublime.security/reference/trashmessage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Trash message group

Action ID: tools.sublime.trash_message_canonical_group

Trash a Sublime message group and its future messages.

Reference: https://docs.sublime.security/reference/trashmessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native request body. Documented fields: classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Trash multiple message groups

Action ID: tools.sublime.trash_multiple_message_groups

Trash multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/trashmultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: message_group_ids (required), classification, report_label, review_comment.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Update rule

Action ID: tools.sublime.update_rule

Replace a Sublime rule definition.

Reference: https://docs.sublime.security/reference/updaterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

payload · object · required

API-native request body. Documented fields: name (required), source (required), action_ids, attack_types, authors, auto_review_auto_share, auto_review_classification, description, detection_methods, false_positives, internal_type, label, maturity, references, run_triage_on_excluded_messages, severity, tactics_and_techniques, tags, triage_abuse_reports, triage_classification_changes, triage_dlp_rule_matched, triage_flagged_messages, user_provided_tags.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Validate rule

Action ID: tools.sublime.validate_rule

Validate an API-native Sublime rule definition.

Reference: https://docs.sublime.security/reference/validaterule

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: name (required), source (required), action_ids, active, attack_types, authors, auto_review_auto_share, auto_review_classification, description, detection_methods, false_positives, internal_type, label, maturity, references, run_triage_on_excluded_messages, severity, tactics_and_techniques, tags, triage_abuse_reports, triage_classification_changes, triage_dlp_rule_matched, triage_flagged_messages, type, user_provided_tags.

base_url · string | null

Base URL of the Sublime API.

Default: null.