Skip to main content
The Sublime Security integration connects to the Sublime Platform API with an API key. It only collects message groups that Sublime flagged or that users reported. It never pulls full mailbox traffic.

​
Supported data

  • Detections are created from flagged message groups, one detection per group. Sublime groups similar messages, so a campaign sent to many mailboxes becomes one detection. Each detection includes the flagged rules with their severity and attack types, the sender, recipients, subject, link clicks, user reports, and the group’s classification and review state at ingestion time. The detection severity is the highest severity among the flagged rules.
  • Message group summaries from Sublime’s SIEM summary feed are stored as logs for both flagged and user-reported groups. They include senders, sender domains, subjects, source IPs, attachment names and hashes, detection rule names, message and recipient counts, and link clicks.
Senders, recipients, clicking mailboxes, source and client IPs, clicked URL hosts, and attachment hashes are indexed as observables.

​
Prerequisites

  1. In the Sublime dashboard, go to Automate → API and create an API key. Save the key when it is displayed; it is only shown once.
  2. Note the API host from your dashboard URL, for example platform.sublime.security or na-east-3.platform.sublime.security.

​
Connect Sublime Security

  1. In Wirespeed, go to Settings → Integrations → Add Integration → Sublime Security.
  2. Enter the API Host and API Key.
  3. Save and enable the integration.

​
Synchronization behavior

Detections and summaries are polled in fixed time windows that trail the current time by two minutes. The first run looks back three days. Pagination state only advances after Wirespeed successfully ingests each page, so an interrupted run resumes where it stopped. Message groups already classified as benign or simulation in Sublime are not ingested as detections. When a new message joins a group that was already ingested, the existing detection is kept and the new summary is stored as a log. Sublime detections initially use a non-escalating default category until dedicated categorization rules are defined.

​
Not included

The integration does not retrieve message bodies, raw EML, or Message Data Models, and does not synchronize mailboxes as users. Detections are not refreshed after ingestion, and closing or recategorizing a Wirespeed detection does not review, quarantine, or restore messages in Sublime.