Sublime email telemetry sources
Sublime detects email threats with MQL (Message Query Language), a declarative query language that runs over one unified Message Data Model (MDM) rather than a numbered event log. The catalog models each top-level section of the MDM as a synthetic The sections and their attributes are taken from the Sublime Message Data Model reference and the Platform API schema. An MQL rule is a single boolean expression over the Message Data Model. It typically scopes by the message direction (the Sublime-Message-<section> provider, with each attribute group (addressed by dotted path, e.g. sender.email.domain.root_domain) as an event. These sections are branches of one message schema, not independent log sources. Sublime's MQL detection rules are catalogued under detection rules. These pages are kept separate from the Windows event catalog.Message Data Model sections
Section Attribute groups What it models Sublime-Message-sender 2 Sender identity: the display name and the sender email address, with its domain broken out into root domain, subdomain and TLD. Sublime-Message-recipients 4 Envelope recipients: the to, cc and bcc collections, each address carrying its email and decomposed domain. Sublime-Message-mailbox 2 Recipient mailbox identity: the mailbox owner name and the mailbox email address. Sublime-Message-subject 1 Message subject: the raw subject, its reply and forward flags, and the base subject with prefixes stripped. Sublime-Message-headers 9 SMTP headers: the DMARC and SPF results in auth_summary, the per-hop authentication results (which add DKIM), and reply_to, return_path, message_id and the originating IP. Sublime-Message-body 7 Message body: the HTML and plain text, the extracted links with per-link URL decomposition, embedded IPs, and the reconstructed current and previous threads. Sublime-Message-attachments 1 File attachments: the file name, detected file_type, content type, size, and MD5, SHA1 and SHA256 hashes. Sublime-Message-type 1 Message direction: whether the message is inbound, outbound or internal. How an MQL rule reads the model
type section: inbound, outbound, or internal), reads attributes by dotted path (for example sender.email.domain.root_domain), and walks the array-valued sections (attachments, recipients, headers.hops, body.links) with iteration. It also calls enrichment functions, including ML classifiers, attachment explosion, and link and sender analysis, that synthesize fields the raw message does not carry. The rule fires when the whole expression evaluates true.