Detection rules › Sublime MQL

Sublime MQL rules: beta

Rule	Severity
beta.DLP: AWS Access Key	`high`
beta.DLP: Basic Auth Header	`high`
beta.DLP: Canadian Social Insurance Number (SIN)	`high`
beta.DLP: Crypto Wallet Address	`high`
beta.DLP: Date of Birth	`high`
beta.DLP: GitHub Token	`high`
beta.DLP: IBAN Code	`high`
beta.DLP: ICD-10 Code	`high`
beta.DLP: ICD-9 Code	`high`
beta.DLP: IP Address	`low`
beta.DLP: NHS Number	`high`
beta.DLP: OAuth Client Secret	`high`
beta.DLP: PCI US Credit Card Number (Any Network)	`high`
beta.DLP: Person Name	`medium`
beta.DLP: Phone Number	`low`
beta.DLP: Private Key	`high`
beta.DLP: SSL/TLS Certificate	`high`
beta.DLP: SWIFT/BIC Code	`high`
beta.DLP: UK Driver's License	`high`
beta.DLP: UK Electoral Roll	`high`
beta.DLP: UK National Insurance Number	`high`
beta.DLP: UK Passport	`high`
beta.DLP: UK UTR (Tax)	`high`
beta.DLP: US ABA Routing Number	`high`
beta.DLP: US Bank Account Number	`medium`
beta.DLP: US Driver's License	`high`
beta.DLP: US Individual Taxpayer Identification Number (ITIN)	`high`
beta.DLP: US Passport Number	`high`
beta.DLP: US Physical Address	`medium`
beta.DLP: US Social Security Number (SSN)	`high`
DLP - Clear-Text Credentials Outbound	`critical`
DLP - Outbound to Personal Email Domains	`medium`

beta.DLP: AWS Access Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing AWS access keys.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "aws_access_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "aws_access_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "aws_access_key" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "aws_access_key" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing AWS access keys.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'aws_access_key'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'aws_access_key'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'aws_access_key'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'aws_access_key'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "aws_access_key"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "aws_access_key"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "aws_access_key"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "aws_access_key"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Basic Auth Header

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing basic authentication headers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "http_authorization_header" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "http_authorization_header" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "http_authorization_header" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "http_authorization_header" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing basic authentication headers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'http_authorization_header'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'http_authorization_header'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'http_authorization_header'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'http_authorization_header'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "http_authorization_header"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "http_authorization_header"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "http_authorization_header"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "http_authorization_header"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canadian Social Insurance Number (SIN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian Social Insurance Numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "canadian_sin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "canadian_sin" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "canadian_sin" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "canadian_sin" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing Canadian Social Insurance Numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'canadian_sin'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'canadian_sin'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'canadian_sin'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'canadian_sin'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "canadian_sin"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "canadian_sin"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "canadian_sin"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "canadian_sin"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Crypto Wallet Address

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing cryptocurrency wallet addresses.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing cryptocurrency wallet addresses.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'crypto_wallet_address'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'crypto_wallet_address'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'crypto_wallet_address'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'crypto_wallet_address'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "crypto_wallet_address"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "crypto_wallet_address"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "crypto_wallet_address"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "crypto_wallet_address"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Date of Birth

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing dates of birth.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "date_of_birth" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "date_of_birth" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "date_of_birth" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "date_of_birth" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing dates of birth.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'date_of_birth'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'date_of_birth'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'date_of_birth'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'date_of_birth'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`date_of_birth`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`date_of_birth`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`date_of_birth`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`date_of_birth`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "date_of_birth"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "date_of_birth"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "date_of_birth"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "date_of_birth"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: GitHub Token

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing GitHub tokens.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "github_token" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "github_token" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "github_token" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "github_token" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing GitHub tokens.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'github_token'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'github_token'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'github_token'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'github_token'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "github_token"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "github_token"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "github_token"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "github_token"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: IBAN Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing IBAN codes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "iban_code" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "iban_code" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "iban_code" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "iban_code" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing IBAN codes.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'iban_code'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'iban_code'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'iban_code'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'iban_code'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "iban_code"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "iban_code"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "iban_code"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "iban_code"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: ICD-10 Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing ICD-10 medical diagnosis codes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_icd10" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_icd10" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_icd10" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_icd10" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing ICD-10 medical diagnosis codes.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_icd10'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_icd10'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_icd10'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_icd10'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_icd10"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_icd10"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_icd10"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_icd10"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: ICD-9 Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing ICD-9 medical diagnosis codes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_icd9" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_icd9" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_icd9" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_icd9" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing ICD-9 medical diagnosis codes.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_icd9'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_icd9'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_icd9'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_icd9'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_icd9"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_icd9"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_icd9"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_icd9"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: IP Address

Severity: low
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing IP addresses.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Infrastructure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ip_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ip_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "ip_address" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "ip_address" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing IP addresses.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ip_address'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ip_address'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ip_address'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ip_address'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ip_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ip_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ip_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ip_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ip_address"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ip_address"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ip_address"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ip_address"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: NHS Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK NHS numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nhs_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nhs_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "nhs_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "nhs_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK NHS numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'nhs_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'nhs_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'nhs_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'nhs_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "nhs_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "nhs_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "nhs_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "nhs_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: OAuth Client Secret

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing OAuth client secrets.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "oauth_client_secret" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "oauth_client_secret" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "oauth_client_secret" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "oauth_client_secret" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing OAuth client secrets.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'oauth_client_secret'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'oauth_client_secret'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'oauth_client_secret'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'oauth_client_secret'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "oauth_client_secret"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "oauth_client_secret"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "oauth_client_secret"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "oauth_client_secret"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: PCI US Credit Card Number (Any Network)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing credit card numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "credit_card_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "credit_card_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "credit_card_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "credit_card_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing credit card numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'credit_card_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'credit_card_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'credit_card_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'credit_card_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "credit_card_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "credit_card_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "credit_card_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "credit_card_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Person Name

Severity: medium
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing person names.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "person" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "person" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "person" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "person" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing person names.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'person'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'person'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'person'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'person'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`person`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`person`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`person`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`person`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "person"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "person"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "person"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "person"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Phone Number

Severity: low
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing phone numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "phone_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "phone_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "phone_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "phone_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing phone numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'phone_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'phone_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'phone_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'phone_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`phone_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`phone_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`phone_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`phone_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "phone_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "phone_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "phone_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "phone_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Private Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing private keys.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "private_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "private_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "private_key" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "private_key" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing private keys.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'private_key'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'private_key'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'private_key'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'private_key'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "private_key"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "private_key"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "private_key"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "private_key"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: SSL/TLS Certificate

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing SSL/TLS certificates.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure, DLP: Infrastructure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ssl_certificate" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ssl_certificate" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "ssl_certificate" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "ssl_certificate" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing SSL/TLS certificates.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ssl_certificate'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ssl_certificate'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ssl_certificate'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ssl_certificate'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ssl_certificate"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ssl_certificate"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ssl_certificate"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ssl_certificate"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: SWIFT/BIC Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound messages containing SWIFT/BIC codes. SWIFT codes are used to identify banks and financial institutions globally and may indicate financial account details being shared externally.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "swift_bic" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "swift_bic" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "swift_bic" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "swift_bic" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects outbound messages containing SWIFT/BIC codes. SWIFT codes are used to identify banks and financial institutions globally and may indicate financial account details being shared externally.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'swift_bic'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'swift_bic'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'swift_bic'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'swift_bic'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "swift_bic"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "swift_bic"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "swift_bic"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "swift_bic"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_drivers_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_drivers_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_drivers_license" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_drivers_license" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_drivers_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_drivers_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_drivers_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_drivers_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_drivers_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_drivers_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_drivers_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_drivers_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Electoral Roll

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK electoral roll information.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_electoral_roll" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_electoral_roll" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_electoral_roll" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_electoral_roll" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK electoral roll information.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_electoral_roll'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_electoral_roll'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_electoral_roll'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_electoral_roll'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_electoral_roll"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_electoral_roll"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_electoral_roll"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_electoral_roll"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK National Insurance Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK National Insurance numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_nino" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_nino" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "uk_nino" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "uk_nino" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing UK National Insurance numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_nino'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_nino'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_nino'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_nino'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_nino"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_nino"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_nino"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_nino"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Passport

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_passport" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_passport" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_passport" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_passport" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_passport'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_passport'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_passport'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_passport'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_passport`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_passport`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_passport`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_passport`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_passport"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_passport"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_passport"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_passport"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK UTR (Tax)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK Unique Taxpayer Reference numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_utr" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_utr" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_utr" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_utr" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK Unique Taxpayer Reference numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_utr'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_utr'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_utr'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_utr'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_utr"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_utr"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_utr"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_utr"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US ABA Routing Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US ABA routing numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_aba_routing_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_aba_routing_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_aba_routing_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_aba_routing_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing US ABA routing numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_aba_routing_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_aba_routing_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_aba_routing_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_aba_routing_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_aba_routing_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_aba_routing_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_aba_routing_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_aba_routing_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Bank Account Number

Severity: medium
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US bank account numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_bank_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_bank_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_bank_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_bank_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US bank account numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_bank_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_bank_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_bank_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_bank_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_bank_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_bank_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_bank_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_bank_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_driver_license" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_driver_license" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_driver_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_driver_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_driver_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_driver_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_driver_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_driver_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_driver_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_driver_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Individual Taxpayer Identification Number (ITIN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Individual Taxpayer Identification Numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_itin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_itin" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_itin" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_itin" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US Individual Taxpayer Identification Numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_itin'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_itin'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_itin'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_itin'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_itin"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_itin"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_itin"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_itin"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_passport_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_passport_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Physical Address

Severity: medium
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US physical addresses.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_physical_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_physical_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_physical_address" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_physical_address" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US physical addresses.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_physical_address'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_physical_address'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_physical_address'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_physical_address'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_physical_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_physical_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_physical_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_physical_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_physical_address"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_physical_address"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_physical_address"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_physical_address"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Social Security Number (SSN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Social Security Numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "social_security_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "social_security_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "social_security_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "social_security_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US Social Security Numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'social_security_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'social_security_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'social_security_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'social_security_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "social_security_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "social_security_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "social_security_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "social_security_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

DLP - Clear-Text Credentials Outbound

Severity: critical
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound emails containing clear-text credentials in the body, subject, or attachments using ML extraction. Covers private keys, AWS access keys, GitHub tokens, HTTP Basic auth headers, and OAuth client secrets. Attachment content is scanned via ml_extract on both raw text and OCR surfaces, catching credentials embedded in images or binary document formats. Note: GCP API keys, Slack tokens, JWTs, and database connection strings are not covered by ml_extract and are intentionally omitted to avoid regex FPs.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.current_thread
subject
type

Rule body

type.outbound
and (
    // ── ML extraction: body ────────────────────────────────────────────────

    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── ML extraction: subject ─────────────────────────────────────────────

    or any(beta.ml_extract_sensitive_information(subject.subject).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── Credential-bearing file types by extension and name ────────────────

    or any(attachments,
        .file_extension in~ ("env", "pem", "key", "p12", "pfx", "jks", "keystore", "ovpn")
        or strings.icontains(.file_name, "credential")
        or strings.icontains(.file_name, "secret")
        or strings.icontains(.file_name, "password")
    )

    // ── ML extraction: attachments (raw text + OCR) ────────────────────────

    or any(attachments,
        any(file.explode(.),
            any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
            or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
        )
    )
)

Detection logic

Scope: outbound message.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
  - .confidence in ('medium', 'high')
- any of attachments where any holds:
  - .file_extension in ('env', 'pem', 'key', 'p12', 'pfx', 'jks', 'keystore', 'ovpn')
  - .file_name contains 'credential'
  - .file_name contains 'secret'
  - .file_name contains 'password'
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
    .confidence in ('medium', 'high')

Inspects: attachments[].file_extension, attachments[].file_name, body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode, strings.icontains.

Indicators matched (39)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`oauth_client_secret`

27 more

`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`attachments[].file_extension`	member	`env`
`attachments[].file_extension`	member	`pem`
`attachments[].file_extension`	member	`key`
`attachments[].file_extension`	member	`p12`
`attachments[].file_extension`	member	`pfx`
`attachments[].file_extension`	member	`jks`
`attachments[].file_extension`	member	`keystore`
`attachments[].file_extension`	member	`ovpn`
`strings.icontains`	substring	`credential`
`strings.icontains`	substring	`secret`
`strings.icontains`	substring	`password`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
    any(attachments)
      or
        attachments.file_extension in ["env", "jks", "key", "keystore", "ovpn", "p12", "pem", "pfx"]
        attachments.file_name contains "credential"
        attachments.file_name contains "password"
        attachments.file_name contains "secret"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

DLP - Outbound to Personal Email Domains

Severity: medium
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound emails routed to free or disposable personal email providers when accompanied by at least one amplifying signal: any file attachment, a recipient display name matching an internal org mailbox (misdirection via $org_mailboxes), or a recipient local part resembling the sender's own address (self-exfiltration signal, levenshtein distance <= 2). No ml_extract applicable. Signals are domain routing and address similarity, not structured sensitive data patterns. Sensitive language keyword matching omitted to reduce FPs. Pair with the sensitive work product rule for content-specific escalation.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Data Exfiltration

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

recipients
recipients.bcc
recipients.cc
recipients.to
sender.email
type

Rule body

type.outbound
and (
    any(recipients.to,
        .email.domain.root_domain in $free_email_providers
        or .email.domain.root_domain in $disposable_email_providers
    )
    or any(recipients.cc,
        .email.domain.root_domain in $free_email_providers
        or .email.domain.root_domain in $disposable_email_providers
    )
    or any(recipients.bcc,
        .email.domain.root_domain in $free_email_providers
        or .email.domain.root_domain in $disposable_email_providers
    )
)
and (
    // Any attachment to a personal domain
    length(attachments) > 0

    // Misdirection: recipient display name resembles any internal org mailbox
    or any(recipients.to,
        any($org_mailboxes, strings.ilevenshtein(.display_name, ..display_name) <= 2)
        and (
            .email.domain.root_domain in $free_email_providers
            or .email.domain.root_domain in $disposable_email_providers
        )
    )
    or any(recipients.cc,
        any($org_mailboxes, strings.ilevenshtein(.display_name, ..display_name) <= 2)
        and (
            .email.domain.root_domain in $free_email_providers
            or .email.domain.root_domain in $disposable_email_providers
        )
    )
    or any(recipients.bcc,
        any($org_mailboxes, strings.ilevenshtein(.display_name, ..display_name) <= 2)
        and (
            .email.domain.root_domain in $free_email_providers
            or .email.domain.root_domain in $disposable_email_providers
        )
    )

    // Self-exfiltration: recipient local part resembles sender's own
    or any(recipients.to,
        strings.levenshtein(
            strings.replace_confusables(.email.local_part),
            strings.replace_confusables(sender.email.local_part)
        ) <= 2
        and (
            .email.domain.root_domain in $free_email_providers
            or .email.domain.root_domain in $disposable_email_providers
        )
    )
    or any(recipients.cc,
        strings.levenshtein(
            strings.replace_confusables(.email.local_part),
            strings.replace_confusables(sender.email.local_part)
        ) <= 2
        and (
            .email.domain.root_domain in $free_email_providers
            or .email.domain.root_domain in $disposable_email_providers
        )
    )
    or any(recipients.bcc,
        strings.levenshtein(
            strings.replace_confusables(.email.local_part),
            strings.replace_confusables(sender.email.local_part)
        ) <= 2
        and (
            .email.domain.root_domain in $free_email_providers
            or .email.domain.root_domain in $disposable_email_providers
        )
    )
)

Detection logic

Scope: outbound message.

outbound message
any of:
- any of recipients.to where any holds:
  - .email.domain.root_domain in $free_email_providers
  - .email.domain.root_domain in $disposable_email_providers
- any of recipients.cc where any holds:
  - .email.domain.root_domain in $free_email_providers
  - .email.domain.root_domain in $disposable_email_providers
- any of recipients.bcc where any holds:
  - .email.domain.root_domain in $free_email_providers
  - .email.domain.root_domain in $disposable_email_providers
any of:
- length(attachments) > 0
- any of recipients.to where all hold:
  - any of $org_mailboxes where:
    
    strings.ilevenshtein(.display_name) ≤ 2
  - any of:
    
    .email.domain.root_domain in $free_email_providers
    .email.domain.root_domain in $disposable_email_providers
- any of recipients.cc where all hold:
  - any of $org_mailboxes where:
    
    strings.ilevenshtein(.display_name) ≤ 2
  - any of:
    
    .email.domain.root_domain in $free_email_providers
    .email.domain.root_domain in $disposable_email_providers
- any of recipients.bcc where all hold:
  - any of $org_mailboxes where:
    
    strings.ilevenshtein(.display_name) ≤ 2
  - any of:
    
    .email.domain.root_domain in $free_email_providers
    .email.domain.root_domain in $disposable_email_providers
- any of recipients.to where all hold:
  - strings.levenshtein(strings.replace_confusables(.email.local_part)) ≤ 2
  - any of:
    
    .email.domain.root_domain in $free_email_providers
    .email.domain.root_domain in $disposable_email_providers
- any of recipients.cc where all hold:
  - strings.levenshtein(strings.replace_confusables(.email.local_part)) ≤ 2
  - any of:
    
    .email.domain.root_domain in $free_email_providers
    .email.domain.root_domain in $disposable_email_providers
- any of recipients.bcc where all hold:
  - strings.levenshtein(strings.replace_confusables(.email.local_part)) ≤ 2
  - any of:
    
    .email.domain.root_domain in $free_email_providers
    .email.domain.root_domain in $disposable_email_providers

Inspects: recipients.bcc, recipients.bcc[].display_name, recipients.bcc[].email.domain.root_domain, recipients.bcc[].email.local_part, recipients.cc, recipients.cc[].display_name, recipients.cc[].email.domain.root_domain, recipients.cc[].email.local_part, recipients.to, recipients.to[].display_name, recipients.to[].email.domain.root_domain, recipients.to[].email.local_part, sender.email.local_part, type.outbound. Sensors: strings.ilevenshtein, strings.levenshtein, strings.replace_confusables. Reference lists: $disposable_email_providers, $free_email_providers, $org_mailboxes.

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(recipients.bcc)
      and
        any($org_mailboxes)
          strings.ilevenshtein func_call "strings.ilevenshtein($org_mailboxes[].display_name) <= 2"
        or
           macro "recipients.bcc[].email.domain.root_domain in disposable_email_providers"
           macro "recipients.bcc[].email.domain.root_domain in free_email_providers"
    any(recipients.cc)
      and
        any($org_mailboxes)
          strings.ilevenshtein func_call "strings.ilevenshtein($org_mailboxes[].display_name) <= 2"
        or
           macro "recipients.cc[].email.domain.root_domain in disposable_email_providers"
           macro "recipients.cc[].email.domain.root_domain in free_email_providers"
    any(recipients.to)
      and
        any($org_mailboxes)
          strings.ilevenshtein func_call "strings.ilevenshtein($org_mailboxes[].display_name) <= 2"
        or
           macro "recipients.to[].email.domain.root_domain in disposable_email_providers"
           macro "recipients.to[].email.domain.root_domain in free_email_providers"
    any(recipients.bcc)
      and
        or
           macro "recipients.bcc[].email.domain.root_domain in disposable_email_providers"
           macro "recipients.bcc[].email.domain.root_domain in free_email_providers"
        strings.levenshtein func_call "strings.levenshtein(strings.replace_confusables(recipients.bcc[].email.local_part)) <= 2"
    any(recipients.cc)
      and
        or
           macro "recipients.cc[].email.domain.root_domain in disposable_email_providers"
           macro "recipients.cc[].email.domain.root_domain in free_email_providers"
        strings.levenshtein func_call "strings.levenshtein(strings.replace_confusables(recipients.cc[].email.local_part)) <= 2"
    any(recipients.to)
      and
        or
           macro "recipients.to[].email.domain.root_domain in disposable_email_providers"
           macro "recipients.to[].email.domain.root_domain in free_email_providers"
        strings.levenshtein func_call "strings.levenshtein(strings.replace_confusables(recipients.to[].email.local_part)) <= 2"
    attachments length_compare "0"
  or
    any(recipients.bcc)
      or
         macro "recipients.bcc[].email.domain.root_domain in disposable_email_providers"
         macro "recipients.bcc[].email.domain.root_domain in free_email_providers"
    any(recipients.cc)
      or
         macro "recipients.cc[].email.domain.root_domain in disposable_email_providers"
         macro "recipients.cc[].email.domain.root_domain in free_email_providers"
    any(recipients.to)
      or
         macro "recipients.to[].email.domain.root_domain in disposable_email_providers"
         macro "recipients.to[].email.domain.root_domain in free_email_providers"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

Sublime MQL rules: beta

beta.DLP: AWS Access Key

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Basic Auth Header

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Canadian Social Insurance Number (SIN)

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Crypto Wallet Address

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Date of Birth

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: GitHub Token

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: IBAN Code

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: ICD-10 Code

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`