--- title: Sublime Security slug: connectors/sublime-security docTags: createdAt: 2026-06-09T16:30:22.079Z --- The Sublime Security connector enables seamless integration with Swimlane Turbine, allowing users to manage email security rules and lists, and analyze message content for threats directly through the automation platform. Sublime Security provides a robust platform for email threat detection and rule management. This connector enables Swimlane Turbine users to integrate with Sublime Security's services, allowing for the activation and deactivation of security rules, analysis of messages, and management of lists and rules within the organization. By leveraging this integration, users can automate complex security workflows, enhance email security, and streamline threat detection and response without the need for coding. ### Limitations - The connector requires a valid API key with appropriate permissions - API rate limits may apply based on your Sublime Security subscription ### Supported Version The Sublime Security connector supports v0 version of the Sublime Security API. ## Configuration ### Prerequisites To utilize the Sublime Security connector within Swimlane Turbine, ensure you have the following prerequisites: - Sublime Security API Authentication: - URL: Endpoint for the Sublime Security API. - API Key: Unique identifier to authenticate requests to the Sublime Security API. ## Authentication Methods Sublime Security uses API Key authentication for secure access to its endpoints. When authenticating with the Sublime Security connector, provide your API key in the asset configuration. The connector will automatically include the key in the `Authorization` header of every request. **API Key Location:** - Header: `Authorization: Bearer ` **How to Retrieve API Key:** 1. Log into your Sublime Security admin portal. 2. Go to the API section under account settings or integrations. 3. Generate a new API key (or reuse an existing one with sufficient permissions). 4. Copy this key and paste it into the **API Key** field during asset setup in Swimlane. :::BlockQuote **Important:** Always store and handle your API key securely. Do not share your key externally. If you believe your API key is compromised, revoke it immediately and generate a new one. ::: ## Capabilities This connector provides the following capabilities: - Activate Rule - Analyze a Raw Message - Create List - Create Message - Create Rule - Deactivate Rule - Delete List - Delete Rule - Get List - List Rules - Patch List - Retrieve Message Data Model - Retrieve Rule - Retrieve lists - Update Rule ## Notes - For detailed API documentation, refer to the [Sublime Security API Reference](https://docs.sublime.security/reference/introduction) - Authentication documentation: [Sublime Security Authentication Guide](https://docs.sublime.security/reference/authentication) - The API uses RESTful conventions with JSON request/response bodies - All API requests require API key authentication using the `x-apikey` header - Base URL format varies by deployment type (cloud, on-premises, etc.) and region - Raw email messages must be base64 encoded before sending to the Create Message and Analyze Message endpoints - For Triage rules, at least one `triage_` field must be set to `true` - For issues, questions, or contributions, please visit the [connector repository](https://github.com/swimlane-connectors/t_sublime_security). # Configurations ## Sublime Security API Authentication Sublime Security API Authentication ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | x-apikey | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Activate Rule Activates a specified rule within your Sublime Security organization using the rule's unique identifier. ### Endpoint - **URL:** `v0/rules/{{id}}/activate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the rule to activate | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------- | | `id` | string | Unique identifier | | `active` | boolean | Output field: active | | `message` | string | Response message | ### Output Example `{"id":"string","active":true,"message":"string"}` ## Analyze a Raw Message Analyzes a raw message using the active or specified rules within your Sublime Security organization. ### Endpoint - **URL:** `v0/messages/analyze` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | ------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `raw_message` | string | Optional | The full base64 encoded raw eml message. | | `queries` | array | Optional | Queries to analyze. | | `queries.name` | \['string', 'null'] | Optional | Query name. | | `queries.severity` | \['string', 'null'] | Optional | Severity associated with the query. | | `queries.source` | \['string', 'null'] | Required | The MQL source to run against the message. | | `rules` | array | Optional | Rules to analyze. | | `run_active_detection_rules` | boolean | Optional | Whether to analyze the message with all active detection rules in your organization. Defaults to false. | | `run_all_detection_rules` | boolean | Optional | Whether to analyze with all detection rules from all Feeds, including uninstalled/inactive Feed rules and your active rules. Defaults to false. | | `run_all_insights` | boolean | Optional | Whether to analyze with all insights. Defaults to false. | ### Input Example `{"raw_message":"string","queries":[],"rules":[],"run_active_detection_rules":true,"run_all_detection_rules":true,"run_all_insights":true}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `query_results` | array | Result of the operation | | `query_results.error` | string | Result of the operation | | `query_results.execution_time` | number | Result of the operation | | `query_results.external_errors` | array | Result of the operation | | `query_results.query` | object | Result of the operation | | `query_results.query.name` | string | Name of the resource | | `query_results.query.severity` | string | Result of the operation | | `query_results.query.source` | string | Result of the operation | | `query_results.success` | boolean | Result of the operation | | `rule_results` | array | Result of the operation | | `rule_results.error` | string | Result of the operation | | `rule_results.execution_time` | number | Result of the operation | | `rule_results.external_errors` | array | Result of the operation | | `rule_results.matched` | boolean | Result of the operation | | `rule_results.rule` | object | Result of the operation | | `rule_results.rule.id` | string | Unique identifier | | `rule_results.rule.name` | string | Name of the resource | | `rule_results.rule.severity` | string | Result of the operation | | `rule_results.rule.source` | string | Result of the operation | | `rule_results.success` | boolean | Result of the operation | ### Output Example `{"json_body":{"query_results":[{}],"rule_results":[{}]},"status_code":200,"reason":"OK"}` ## Create List Generates a new list within your Sublime Security organization using the specified name. ### Endpoint - **URL:** `v0/lists` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------- | | `name` | string | Optional | Name of the list | | `description` | string | Optional | Description of the list (optional) | ### Input Example `{"name":"Example Name","description":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `id` | string | Unique identifier for the list. | | `name` | string | Name of the created list. | | `description` | string | Description of the list. | | `created_at` | string | Creation timestamp of the list. | | `updated_at` | string | Last updated timestamp for the list. | | `editable` | boolean | Indicates if the list is editable. | | `entry_type` | string | Entry type of the list. | ### Output Example `{"id":"string","name":"string","description":"string","created_at":"string","updated_at":"string","editable":true,"entry_type":"string"}` ## Create Message Generates a new message data model in Sublime Security from a base64 encoded raw message. ### Endpoint - **URL:** `v0/messages/create` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `raw_message` | string | Optional | The full base64 encoded raw eml message | | `canonical_id` | string | Optional | The canonical ID of the message, if known (optional) | | `external_created_at` | string | Optional | Timestamp the message created at according to the external source (optional) | | `external_message_id` | string | Optional | ID of the message according to the external source (optional) | | `external_thread_id` | string | Optional | ID of the thread the message belongs to according to the external source (optional) | | `folder` | string | Optional | The mailbox folder the message is in (optional) | | `labels` | array | Optional | Labels applied to the message by the mailbox (optional) | | `mailbox_email_address` | string | Optional | The email address of the mailbox containing this message (optional) | | `message_type` | object | Optional | Override on message types, defined from the perspective of your organization (optional) | | `message_type.inbound` | boolean | Optional | Message was sent from someone outside your organization, to at least one recipient inside your organization | | `message_type.internal` | boolean | Optional | Message was sent from someone inside your organization, to at least one recipient inside your organization. Messages must be authenticated by either SPF or DKIM to be treated as internal. | | `message_type.outbound` | boolean | Optional | Message was sent from someone inside your organization, to at least one recipient outside your organization | | `route_type` | string | Optional | The directional route type of the message (optional) | ### Input Example `{"raw_message":"string","canonical_id":"string","external_created_at":"string","external_message_id":"string","external_thread_id":"string","folder":"string","labels":["string"],"mailbox_email_address":"string","message_type":{"inbound":true,"internal":true,"outbound":true},"route_type":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------- | | `id` | string | Unique identifier | | `message_id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | ### Output Example `{"id":"string","message_id":"string","created_at":"string"}` ## Create Rule Generates a new detection rule in Sublime Security using the specified 'name' and 'source'. A JSON body input is required. ### Endpoint - **URL:** `v0/rules` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` | string | Optional | Rule name | | `source` | string | Optional | Source | | `type` | string | Optional | Type of the rule | | `description` | string | Optional | Description of rule | | `active` | boolean | Optional | Activate the rule immediately | | `action_ids` | array | Optional | IDs of actions to run when the rule is triggered | | `attack_types` | array | Optional | Rule attack types | | `authors` | array | Optional | Rule authors. Defaults to the user that made the request | | `authors.name` | string | Optional | Name of a rule author | | `authors.twitter` | string | Optional | Twitter handle for a rule author | | `auto_review_auto_share` | boolean | Optional | Whether auto-reviewed messages will be shared | | `auto_review_classification` | string | Optional | The classification auto-reviewed messages will have, when an auto-review action is associated with the rule | | `detection_methods` | array | Optional | Rule detection technologies | | `false_positives` | array | Optional | Descriptions of known false positives that could occur | | `label` | string | Optional | Rule label | | `maturity` | string | Optional | Rule maturity | | `references` | array | Optional | URL references | | `severity` | string | Optional | Rule severity | | `tactics_and_techniques` | array | Optional | Rule tactics and techniques | | `tags` | array | Optional | Tags | | `triage_abuse_reports` | boolean | Optional | For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage\_ field must be true. | | `triage_classification_changes` | boolean | Optional | For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage\_ field must be true. | | `triage_flagged_messages` | boolean | Optional | For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage\_ field must be true. | | `user_provided_tags` | array | Optional | User-provided tags | ### Input Example `{"name":"Example Name","source":"string","type":"string","description":"string","active":true,"action_ids":["string"],"attack_types":["string"],"authors":[{"name":"Example Name","twitter":"string"}],"auto_review_auto_share":true,"auto_review_classification":"string","detection_methods":["string"],"false_positives":["string"],"label":"string","maturity":"string","references":["string"],"severity":"string","tactics_and_techniques":["string"],"tags":["string"],"triage_abuse_reports":true,"triage_classification_changes":true,"triage_flagged_messages":true,"user_provided_tags":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ---------------------------------------------------------------- | | `id` | string | Unique identifier for the rule | | `name` | string | Name of the rule | | `source` | string | MQL source code of the rule | | `type` | string | Type of the rule | | `description` | string | Description of the rule | | `active` | boolean | Whether the rule is active | | `passive` | boolean | Whether the rule is passive | | `action_ids` | array | IDs of actions associated with the rule | | `attack_types` | array | Attack types associated with the rule | | `authors` | array | Authors of the rule | | `authors.name` | string | Name of the resource | | `authors.twitter` | string | Output field: authors.twitter | | `auto_review_auto_share` | boolean | Whether auto-reviewed messages will be shared | | `auto_review_classification` | string | Classification for auto-reviewed messages | | `detection_methods` | array | Detection methods used by the rule | | `false_positives` | array | Known false positives | | `label` | string | Rule label | | `maturity` | string | Rule maturity | | `references` | array | URL references | | `severity` | string | Rule severity | | `tactics_and_techniques` | array | Tactics and techniques | | `tags` | array | Tags associated with the rule | | `triage_abuse_reports` | boolean | Whether rule runs for reported messages (Triage rules only) | | `triage_classification_changes` | boolean | Whether rule runs for classification changes (Triage rules only) | | `triage_flagged_messages` | boolean | Whether rule runs for flagged messages (Triage rules only) | ### Output Example `{"id":"string","name":"string","source":"string","type":"string","description":"string","active":true,"passive":true,"action_ids":[],"attack_types":[],"authors":[],"auto_review_auto_share":true,"auto_review_classification":"string","detection_methods":[],"false_positives":[],"label":"string"}` ## Deactivate Rule Deactivates a specified rule within your Sublime Security organization using the rule's unique identifier. ### Endpoint - **URL:** `v0/rules/{{id}}/deactivate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the rule to deactivate | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------- | | `id` | string | Unique identifier | | `active` | boolean | Output field: active | | `message` | string | Response message | ### Output Example `{"id":"string","active":true,"message":"string"}` ## Delete List Remove a specified list from your organization in Sublime Security by providing the unique identifier. ### Endpoint - **URL:** `v0/lists/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the list to delete | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `success` | boolean | Whether the operation was successful | | `message` | string | Response message | ### Output Example `{"success":true,"message":"string"}` ## Delete Rule Remove a specified rule from your organization in Sublime Security by providing the unique identifier. ### Endpoint - **URL:** `v0/rules/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the rule to delete | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `success` | boolean | Whether the operation was successful | | `message` | string | Response message | ### Output Example `{"success":true,"message":"string"}` ## Get List Retrieves detailed information for a specific list in Sublime Security using the provided list ID. ### Endpoint - **URL:** `v0/lists/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the list to retrieve | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `id` | string | Unique identifier for the list. | | `name` | string | Name of the list. | | `description` | string | Description of the list. | | `created_at` | string | Creation timestamp of the list. | | `updated_at` | string | Last updated timestamp for the list. | | `editable` | boolean | Indicates if the list is editable. | | `entry_type` | string | Entry type of the list. | ### Output Example `{"id":"string","name":"string","description":"string","created_at":"string","updated_at":"string","editable":true,"entry_type":"string"}` ## List Rules Retrieve a list of all active security rules from Sublime Security for further analysis or management. ### Endpoint - **URL:** `v0/rules` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------- | | `parameters.in_feed` | boolean | Optional | Restrict to rules that are explicitly in or not in a feed | | `parameters.limit` | integer | Optional | The maximum number of entries to return. Maximum value is 500. | | `parameters.offset` | integer | Optional | The (zero-based) offset of the first rule to return | | `parameters.search` | string | Optional | Search for matching case-insensitive substring across rule name, description, and MQL source | ### Input Example `{"parameters":{"in_feed":true,"limit":50,"offset":123,"search":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------------------- | | `count` | integer | Number of rules returned in this response | | `rules` | array | Output field: rules | | `rules.id` | string | Unique identifier for the rule | | `rules.name` | string | Name of the rule | | `rules.description` | string | Description of the rule | | `rules.active` | boolean | Whether the rule is active | | `rules.severity` | string | Severity level of the rule | | `rules.source` | string | MQL source code of the rule | | `rules.references` | array | List of references used by the rule | | `rules.tags` | array | Tags associated with the rule | | `rules.created_at` | string | ISO timestamp when the rule was created | | `rules.updated_at` | string | ISO timestamp when the rule was last updated | | `total` | integer | Total number of rules matching the query | ### Output Example `{"count":123,"rules":[],"total":123}` ## Patch List Updates an existing list identified by 'id' in Sublime Security with a new 'description'. Required inputs include path parameters and JSON body. ### Endpoint - **URL:** `v0/lists/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the list to update | | `description` | string | Optional | Updated description of the list. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"description":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | --------------------------------------------- | | `id` | string | The unique identifier for the list. | | `name` | string | Name of the list. | | `description` | string | Updated description of the list. | | `created_at` | string | ISO timestamp when the list was created. | | `updated_at` | string | ISO timestamp when the list was last updated. | | `editable` | boolean | Indicates if the list can be edited. | | `entry_type` | string | The type of entries contained in the list. | ### Output Example `{"id":"string","name":"string","description":"string","created_at":"string","updated_at":"string","editable":true,"entry_type":"string"}` ## Retrieve lists Retrieve filtered lists from Sublime Security based on the specified entry type parameter. ### Endpoint - **URL:** `v0/lists` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------------------------------------------- | | `parameters.entry_type` | string | Required | List type to filter by. Currently must be set to 'string' | | `parameters.id` | string | Optional | Optional ID (exact match) to filter by | | `parameters.name` | string | Optional | Optional name (exact match) to filter by | ### Input Example `{"parameters":{"entry_type":"string","id":"12345678-1234-1234-1234-123456789abc","name":"Example Name"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | ------------------------------- | | `lists` | array | Output field: lists | | `lists.id` | string | Unique identifier | | `lists.name` | string | Name of the resource | | `lists.description` | string | Output field: lists.description | | `lists.entry_type` | string | Type of the resource | | `lists.editable` | boolean | Output field: lists.editable | | `lists.created_at` | string | Output field: lists.created\_at | | `lists.updated_at` | string | Output field: lists.updated\_at | ### Output Example `{"lists":[]}` ## Retrieve Message Data Model Retrieve the data model for a specific message in Sublime Security using the message's unique identifier. ### Endpoint - **URL:** `v0/messages/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the message to retrieve. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | ----------------------------------------- | | `_errors` | array | Error message if any | | `_errors.additionalProp` | string | Error message if any | | `_meta` | object | Output field: \_meta | | `_meta.canonical_id` | string | Unique identifier | | `_meta.created_at` | string | Output field: \_meta.created\_at | | `_meta.effective_at` | string | Output field: \_meta.effective\_at | | `_meta.id` | string | Unique identifier | | `attachments` | array | Output field: attachments | | `attachments.content_id` | string | Unique identifier | | `attachments.content_transfer_encoding` | string | Response content | | `attachments.content_type` | string | Type of the resource | | `attachments.file_extension` | string | Output field: attachments.file\_extension | | `attachments.file_name` | string | Name of the resource | | `attachments.file_type` | string | Type of the resource | | `attachments.md5` | string | Output field: attachments.md5 | | `attachments.raw` | string | Output field: attachments.raw | | `attachments.sha1` | string | Output field: attachments.sha1 | | `attachments.sha256` | string | Output field: attachments.sha256 | | `attachments.size` | integer | Output field: attachments.size | | `body` | object | Request body data | | `body.current_thread` | object | Request body data | | `body.current_thread.links` | array | Request body data | | `body.current_thread.links.display_text` | string | Request body data | | `body.current_thread.links.display_url` | string | Display URL | | `body.current_thread.links.href_url` | string | Href URL | ### Output Example `{"_errors":[],"_meta":{"canonical_id":"string","created_at":"string","effective_at":"string","id":"12345678-1234-1234-1234-123456789abc"},"attachments":[],"body":{"current_thread":{"links":[],"text":"string"},"html":{"charset":"string","content_transfer_encoding":"string","display_text":"string","inner_text":"string","raw":"string"},"ips":[{}],"links":[{}],"plain":{"charset":"string","content_transfer_encoding":"string","raw":"string"},"previous_threads":[{}]},"external":{"created_at":"string","...` ## Retrieve Rule Retrieve details of a specific rule in Sublime Security using the unique identifier provided as a path parameter. ### Endpoint - **URL:** `v0/rules/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the rule to retrieve | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------------- | | `id` | string | Unique identifier for the rule. | | `name` | string | Name of the rule. | | `description` | string | Description of the rule. | | `action_ids` | array | IDs of actions to run when the rule is triggered. | | `active` | boolean | Whether the rule is active. | | `attack_types` | array | Rule attack types. | | `authors` | array | Rule authors. | | `authors.name` | string | Name of a rule author. | | `authors.twitter` | string | Twitter handle for a rule author. | | `auto_review_auto_share` | boolean | Whether auto-reviewed messages will be shared. | | `auto_review_classification` | string | The classification for auto-reviewed messages. | | `created_at` | string | Creation timestamp of the rule. | | `detection_methods` | array | Rule detection technologies. | | `false_positives` | array | Known false positives that could occur. | | `label` | string | Label of the rule. | | `last_activated_at` | string | Last time the rule was activated. | | `maturity` | string | Maturity of the rule. | | `passive` | boolean | Whether the rule runs passively. | | `references` | array | Rule references. | | `severity` | string | Severity level of the rule. | | `source` | string | MQL source of the rule. | | `tactics_and_techniques` | array | MITRE ATT\&CK tactics and techniques. | | `tags` | array | Tags associated with the rule. | | `triage_abuse_reports` | boolean | Whether to triage abuse reports. | | `triage_classification_changes` | boolean | Whether to triage classification changes. | ### Output Example `{"id":"string","name":"string","description":"string","action_ids":[],"active":true,"attack_types":[],"authors":[],"auto_review_auto_share":true,"auto_review_classification":"string","created_at":"string","detection_methods":[],"false_positives":[],"label":"string","last_activated_at":"string","maturity":"string"}` ## Update Rule Updates an existing rule in Sublime Security with a new definition, requiring the rule's ID, name, and source. ### Endpoint - **URL:** `v0/rules/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | Rule ID | | `name` | string | Optional | Rule name | | `source` | string | Optional | Source | | `description` | string | Optional | Description of rule | | `action_ids` | array | Optional | IDs of actions to run when the rule is triggered | | `attack_types` | array | Optional | Rule attack types | | `authors` | array | Optional | Rule authors. Defaults to the user that made the request | | `authors.name` | string | Optional | Name of a rule author | | `authors.twitter` | string | Optional | Twitter handle for a rule author | | `auto_review_auto_share` | boolean | Optional | Whether auto-reviewed messages will be shared | | `auto_review_classification` | string | Optional | The classification auto-reviewed messages will have, when an auto-review action is associated with the rule | | `detection_methods` | array | Optional | Rule detection technologies | | `false_positives` | array | Optional | Descriptions of known false positives that could occur | | `label` | string | Optional | Rule label | | `maturity` | string | Optional | Rule maturity | | `references` | array | Optional | URL references | | `severity` | string | Optional | Rule severity | | `tactics_and_techniques` | array | Optional | Rule tactics and techniques | | `tags` | array | Optional | Tags | | `triage_abuse_reports` | boolean | Optional | For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage\_ field must be true. | | `triage_classification_changes` | boolean | Optional | For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage\_ field must be true. | | `triage_flagged_messages` | boolean | Optional | For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage\_ field must be true. | | `user_provided_tags` | array | Optional | User-provided tags | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"name":"Example Name","source":"string","description":"string","action_ids":["string"],"attack_types":["string"],"authors":[{"name":"Example Name","twitter":"string"}],"auto_review_auto_share":true,"auto_review_classification":"string","detection_methods":["string"],"false_positives":["string"],"label":"string","maturity":"string","references":["string"],"severity":"string","tactics_and_techniques":["string"],"tags":["string"],"triage_abuse_reports":true,"triage_classification_changes":true,"triage_flagged_messages":true,"user_provided_tags":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ---------------------------------------------------------------- | | `id` | string | Unique identifier for the rule | | `name` | string | Name of the rule | | `source` | string | MQL source code of the rule | | `type` | string | Type of the rule | | `description` | string | Description of the rule | | `active` | boolean | Whether the rule is active | | `passive` | boolean | Whether the rule is passive | | `action_ids` | array | IDs of actions associated with the rule | | `attack_types` | array | Attack types associated with the rule | | `authors` | array | Authors of the rule | | `authors.name` | string | Name of the resource | | `authors.twitter` | string | Output field: authors.twitter | | `auto_review_auto_share` | boolean | Whether auto-reviewed messages will be shared | | `auto_review_classification` | string | Classification for auto-reviewed messages | | `detection_methods` | array | Detection methods used by the rule | | `false_positives` | array | Known false positives | | `label` | string | Rule label | | `maturity` | string | Rule maturity | | `references` | array | URL references | | `severity` | string | Rule severity | | `tactics_and_techniques` | array | Tactics and techniques | | `tags` | array | Tags associated with the rule | | `triage_abuse_reports` | boolean | Whether rule runs for reported messages (Triage rules only) | | `triage_classification_changes` | boolean | Whether rule runs for classification changes (Triage rules only) | | `triage_flagged_messages` | boolean | Whether rule runs for flagged messages (Triage rules only) | ### Output Example `{"id":"string","name":"string","source":"string","type":"string","description":"string","active":true,"passive":true,"action_ids":[],"attack_types":[],"authors":[],"auto_review_auto_share":true,"auto_review_classification":"string","detection_methods":[],"false_positives":[],"label":"string"}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |