Detection rules › Sublime MQL

Sublime MQL rules: beta

Rule	Severity
beta.DLP: Australia ABN	`high`
beta.DLP: Australia Bank Account	`high`
beta.DLP: Australia Driver's License	`high`
beta.DLP: Australia Medicare	`high`
beta.DLP: Australia Passport Number	`high`
beta.DLP: Australia Tax File Number	`high`
beta.DLP: Austria VAT	`high`
beta.DLP: AWS Access Key	`high`
beta.DLP: Basic Auth Header	`high`
beta.DLP: Belgium VAT	`high`
beta.DLP: Blood Test Term	`high`
beta.DLP: Canada Bank Account	`high`
beta.DLP: Canada Driver's License	`high`
beta.DLP: Canada Health Service Number	`high`
beta.DLP: Canada Passport Number	`high`
beta.DLP: Canada PHIN	`high`
beta.DLP: Canadian Social Insurance Number (SIN)	`high`
beta.DLP: China Resident ID	`high`
beta.DLP: Crypto Wallet Address	`high`
beta.DLP: DEA Number	`high`
beta.DLP: Disability / Impairment	`high`
beta.DLP: FDA Drug Name	`high`
beta.DLP: Finland European Health Insurance	`high`
beta.DLP: France Bank Account	`high`
beta.DLP: France Driver's License	`high`
beta.DLP: France National ID (CNI)	`high`
beta.DLP: France Passport Number	`high`
beta.DLP: France Social Security Number (INSEE)	`high`
beta.DLP: France VAT	`high`
beta.DLP: Germany Identity Card (Personalausweis)	`high`
beta.DLP: Germany Passport Number	`high`
beta.DLP: Germany Tax ID (Steueridentifikationsnummer)	`high`
beta.DLP: Germany VAT	`high`
beta.DLP: GitHub Token	`high`
beta.DLP: Google / GCP API Key	`high`
beta.DLP: Hungary TAJ	`high`
beta.DLP: Hungary VAT	`high`
beta.DLP: IBAN Code	`high`
beta.DLP: ICD-10 Code	`high`
beta.DLP: ICD-9 Code	`high`
beta.DLP: Japan Driver's License	`high`
beta.DLP: Japan MyNumber ID	`high`
beta.DLP: Japan Passport Number	`high`
beta.DLP: JSON Web Token (JWT)	`high`
beta.DLP: Luxembourg Non-Natural ID	`high`
beta.DLP: MAC Address	`high`
beta.DLP: Medical Condition	`high`
beta.DLP: Medical Specialty	`high`
beta.DLP: National Provider Identifier (NPI)	`high`
beta.DLP: Netherlands BSN / Tax ID	`high`
beta.DLP: Netherlands VAT	`high`
beta.DLP: New Zealand Bank Account	`high`
beta.DLP: New Zealand MOH	`high`
beta.DLP: NHS Number	`high`
beta.DLP: OAuth Client Secret	`high`
beta.DLP: Outbound references an email address outside recipient domains	`low`
beta.DLP: PCI US Credit Card Number (Any Network)	`high`
beta.DLP: Poland REGON	`high`
beta.DLP: Private Key	`high`
beta.DLP: Singapore NRIC	`high`
beta.DLP: Singapore UEN	`high`
beta.DLP: Slack Access Token	`high`
beta.DLP: South Korea Resident Registration Number	`high`
beta.DLP: Spain Bank Account	`high`
beta.DLP: Spain DNI/NIE / Passport / SSN / Tax ID	`high`
beta.DLP: SSL/TLS Certificate	`high`
beta.DLP: Surgical Procedure	`high`
beta.DLP: Sweden Personnummer / Tax ID	`high`
beta.DLP: SWIFT/BIC Code	`high`
beta.DLP: UK Driver's License	`high`
beta.DLP: UK Electoral Roll	`high`
beta.DLP: UK National Insurance Number	`high`
beta.DLP: UK Passport	`high`
beta.DLP: UK UTR (Tax)	`high`
beta.DLP: US ABA Routing Number	`high`
beta.DLP: US Bank Account Number	`medium`
beta.DLP: US Driver's License	`high`
beta.DLP: US Individual Taxpayer Identification Number (ITIN)	`high`
beta.DLP: US Medicare Beneficiary ID	`high`
beta.DLP: US Passport Number	`high`
beta.DLP: US Social Security Number (SSN)	`high`
beta.DLP: Vehicle VIN	`high`
DLP - Clear-Text Credentials Outbound	`critical`

beta.DLP: Australia ABN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian Business Numbers (ABN).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_abn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_abn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_abn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_abn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Australian Business Numbers (ABN).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'au_abn'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'au_abn'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'au_abn'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'au_abn'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "au_abn"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "au_abn"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "au_abn"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "au_abn"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian bank account numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Australian bank account numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'au_bank_account'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'au_bank_account'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'au_bank_account'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'au_bank_account'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "au_bank_account"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "au_bank_account"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "au_bank_account"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "au_bank_account"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Australian driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'au_driver_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'au_driver_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'au_driver_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'au_driver_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "au_driver_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "au_driver_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "au_driver_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "au_driver_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Medicare

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian Medicare numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_medicare" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_medicare" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_medicare" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_medicare" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Australian Medicare numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'au_medicare'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'au_medicare'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'au_medicare'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'au_medicare'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "au_medicare"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "au_medicare"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "au_medicare"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "au_medicare"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Australian passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'au_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'au_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'au_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'au_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "au_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "au_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "au_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "au_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Tax File Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian Tax File Numbers (TFN).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_tfn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_tfn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_tfn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_tfn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Australian Tax File Numbers (TFN).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'au_tfn'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'au_tfn'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'au_tfn'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'au_tfn'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "au_tfn"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "au_tfn"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "au_tfn"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "au_tfn"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Austria VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Austrian VAT numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "at_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "at_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "at_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "at_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Austrian VAT numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'at_vat'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'at_vat'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'at_vat'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'at_vat'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "at_vat"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "at_vat"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "at_vat"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "at_vat"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: AWS Access Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing AWS access keys.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "aws_access_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "aws_access_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "aws_access_key" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "aws_access_key" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing AWS access keys.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'aws_access_key'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'aws_access_key'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'aws_access_key'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'aws_access_key'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "aws_access_key"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "aws_access_key"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "aws_access_key"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "aws_access_key"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Basic Auth Header

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing basic authentication headers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "http_authorization_header" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "http_authorization_header" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "http_authorization_header" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "http_authorization_header" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing basic authentication headers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'http_authorization_header'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'http_authorization_header'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'http_authorization_header'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'http_authorization_header'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "http_authorization_header"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "http_authorization_header"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "http_authorization_header"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "http_authorization_header"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Belgium VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Belgian VAT numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "be_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "be_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "be_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "be_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Belgian VAT numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'be_vat'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'be_vat'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'be_vat'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'be_vat'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "be_vat"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "be_vat"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "be_vat"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "be_vat"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Blood Test Term

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing blood test terminology.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "blood_test_term" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "blood_test_term" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "blood_test_term" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "blood_test_term" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing blood test terminology.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'blood_test_term'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'blood_test_term'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'blood_test_term'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'blood_test_term'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`blood_test_term`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`blood_test_term`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`blood_test_term`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`blood_test_term`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "blood_test_term"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "blood_test_term"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "blood_test_term"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "blood_test_term"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian bank account numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Canadian bank account numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ca_bank_account'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ca_bank_account'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ca_bank_account'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ca_bank_account'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ca_bank_account"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ca_bank_account"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ca_bank_account"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ca_bank_account"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Canadian driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ca_driver_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ca_driver_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ca_driver_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ca_driver_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ca_driver_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ca_driver_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ca_driver_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ca_driver_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Health Service Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian health service numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_health_service" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_health_service" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_health_service" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_health_service" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Canadian health service numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ca_health_service'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ca_health_service'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ca_health_service'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ca_health_service'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ca_health_service"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ca_health_service"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ca_health_service"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ca_health_service"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Canadian passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ca_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ca_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ca_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ca_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ca_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ca_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ca_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ca_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada PHIN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian Personal Health Identification Numbers (PHIN).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_phin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_phin" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_phin" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_phin" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Canadian Personal Health Identification Numbers (PHIN).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ca_phin'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ca_phin'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ca_phin'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ca_phin'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ca_phin"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ca_phin"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ca_phin"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ca_phin"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canadian Social Insurance Number (SIN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian Social Insurance Numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "canadian_sin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "canadian_sin" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "canadian_sin" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "canadian_sin" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing Canadian Social Insurance Numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'canadian_sin'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'canadian_sin'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'canadian_sin'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'canadian_sin'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "canadian_sin"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "canadian_sin"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "canadian_sin"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "canadian_sin"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: China Resident ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Chinese Resident Identity Card numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "cn_prc_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "cn_prc_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "cn_prc_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "cn_prc_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Chinese Resident Identity Card numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'cn_prc_id'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'cn_prc_id'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'cn_prc_id'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'cn_prc_id'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "cn_prc_id"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "cn_prc_id"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "cn_prc_id"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "cn_prc_id"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Crypto Wallet Address

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing cryptocurrency wallet addresses.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing cryptocurrency wallet addresses.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'crypto_wallet_address'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'crypto_wallet_address'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'crypto_wallet_address'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'crypto_wallet_address'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "crypto_wallet_address"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "crypto_wallet_address"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "crypto_wallet_address"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "crypto_wallet_address"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: DEA Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Drug Enforcement Administration (DEA) numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_dea_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_dea_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_dea_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_dea_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing US Drug Enforcement Administration (DEA) numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_dea_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_dea_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_dea_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_dea_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_dea_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_dea_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_dea_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_dea_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Disability / Impairment

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing disability or impairment information.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_disability_impairment" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_disability_impairment" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_disability_impairment" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_disability_impairment" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing disability or impairment information.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_disability_impairment'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_disability_impairment'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_disability_impairment'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_disability_impairment'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_disability_impairment`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_disability_impairment`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_disability_impairment`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_disability_impairment`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_disability_impairment"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_disability_impairment"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_disability_impairment"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_disability_impairment"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: FDA Drug Name

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing FDA drug names.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fda_drug_name" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fda_drug_name" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fda_drug_name" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fda_drug_name" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing FDA drug names.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fda_drug_name'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fda_drug_name'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fda_drug_name'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fda_drug_name'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fda_drug_name`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fda_drug_name`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fda_drug_name`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fda_drug_name`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fda_drug_name"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fda_drug_name"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fda_drug_name"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fda_drug_name"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Finland European Health Insurance

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Finnish European Health Insurance card numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Finnish European Health Insurance card numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fi_european_health_insurance'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fi_european_health_insurance'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fi_european_health_insurance'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fi_european_health_insurance'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fi_european_health_insurance"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fi_european_health_insurance"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fi_european_health_insurance"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fi_european_health_insurance"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French bank account numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing French bank account numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fr_bank_account'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fr_bank_account'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fr_bank_account'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fr_bank_account'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fr_bank_account"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fr_bank_account"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fr_bank_account"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fr_bank_account"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing French driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fr_driver_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fr_driver_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fr_driver_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fr_driver_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fr_driver_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fr_driver_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fr_driver_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fr_driver_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France National ID (CNI)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French national identity card numbers (CNI).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_cni" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_cni" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_cni" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_cni" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing French national identity card numbers (CNI).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fr_cni'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fr_cni'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fr_cni'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fr_cni'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fr_cni"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fr_cni"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fr_cni"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fr_cni"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing French passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fr_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fr_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fr_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fr_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fr_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fr_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fr_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fr_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Social Security Number (INSEE)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French social security numbers (INSEE).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_insee" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_insee" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_insee" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_insee" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing French social security numbers (INSEE).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fr_insee'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fr_insee'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fr_insee'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fr_insee'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fr_insee"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fr_insee"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fr_insee"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fr_insee"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French VAT numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing French VAT numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'fr_vat'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'fr_vat'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'fr_vat'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'fr_vat'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "fr_vat"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "fr_vat"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "fr_vat"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "fr_vat"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany Identity Card (Personalausweis)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German national identity card numbers (Personalausweis).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_personalausweis" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_personalausweis" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_personalausweis" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_personalausweis" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing German national identity card numbers (Personalausweis).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'de_personalausweis'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'de_personalausweis'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'de_personalausweis'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'de_personalausweis'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "de_personalausweis"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "de_personalausweis"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "de_personalausweis"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "de_personalausweis"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing German passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'de_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'de_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'de_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'de_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "de_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "de_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "de_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "de_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany Tax ID (Steueridentifikationsnummer)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German tax identification numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_tax_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_tax_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_tax_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_tax_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing German tax identification numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'de_tax_id'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'de_tax_id'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'de_tax_id'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'de_tax_id'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "de_tax_id"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "de_tax_id"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "de_tax_id"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "de_tax_id"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German VAT numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing German VAT numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'de_vat'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'de_vat'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'de_vat'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'de_vat'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "de_vat"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "de_vat"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "de_vat"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "de_vat"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: GitHub Token

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing GitHub tokens.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "github_token" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "github_token" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "github_token" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "github_token" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing GitHub tokens.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'github_token'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'github_token'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'github_token'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'github_token'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "github_token"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "github_token"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "github_token"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "github_token"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Google / GCP API Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Google or GCP API keys.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Secrets & Credentials

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "google_api_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "google_api_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "google_api_key" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "google_api_key" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Google or GCP API keys.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'google_api_key'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'google_api_key'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'google_api_key'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'google_api_key'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "google_api_key"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "google_api_key"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "google_api_key"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "google_api_key"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Hungary TAJ

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Hungarian social security (TAJ) numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "hu_taj" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "hu_taj" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "hu_taj" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "hu_taj" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Hungarian social security (TAJ) numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'hu_taj'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'hu_taj'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'hu_taj'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'hu_taj'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "hu_taj"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "hu_taj"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "hu_taj"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "hu_taj"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Hungary VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Hungarian VAT numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "hu_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "hu_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "hu_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "hu_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Hungarian VAT numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'hu_vat'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'hu_vat'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'hu_vat'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'hu_vat'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "hu_vat"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "hu_vat"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "hu_vat"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "hu_vat"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: IBAN Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing IBAN codes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "iban_code" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "iban_code" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "iban_code" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "iban_code" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing IBAN codes.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'iban_code'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'iban_code'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'iban_code'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'iban_code'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "iban_code"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "iban_code"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "iban_code"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "iban_code"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: ICD-10 Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing ICD-10 medical diagnosis codes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_icd10" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_icd10" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_icd10" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_icd10" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing ICD-10 medical diagnosis codes.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_icd10'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_icd10'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_icd10'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_icd10'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_icd10"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_icd10"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_icd10"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_icd10"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: ICD-9 Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing ICD-9 medical diagnosis codes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_icd9" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_icd9" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_icd9" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_icd9" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing ICD-9 medical diagnosis codes.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_icd9'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_icd9'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_icd9'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_icd9'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_icd9"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_icd9"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_icd9"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_icd9"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Japan Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Japanese driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jp_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jp_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jp_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jp_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Japanese driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'jp_driver_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'jp_driver_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'jp_driver_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'jp_driver_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "jp_driver_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "jp_driver_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "jp_driver_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "jp_driver_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Japan MyNumber ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Japanese My Number (Individual Number) identifiers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jp_my_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jp_my_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jp_my_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jp_my_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Japanese My Number (Individual Number) identifiers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'jp_my_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'jp_my_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'jp_my_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'jp_my_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "jp_my_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "jp_my_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "jp_my_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "jp_my_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Japan Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Japanese passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jp_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jp_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jp_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jp_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Japanese passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'jp_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'jp_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'jp_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'jp_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "jp_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "jp_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "jp_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "jp_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: JSON Web Token (JWT)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing JSON Web Tokens (JWT).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Secrets & Credentials

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jwt" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jwt" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jwt" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jwt" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing JSON Web Tokens (JWT).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'jwt'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'jwt'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'jwt'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'jwt'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "jwt"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "jwt"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "jwt"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "jwt"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Luxembourg Non-Natural ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Luxembourg non-natural person identification numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Luxembourg non-natural person identification numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'luxembourg_nonnatural_id'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'luxembourg_nonnatural_id'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'luxembourg_nonnatural_id'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'luxembourg_nonnatural_id'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "luxembourg_nonnatural_id"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "luxembourg_nonnatural_id"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "luxembourg_nonnatural_id"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "luxembourg_nonnatural_id"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: MAC Address

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing MAC addresses.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Network Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "mac_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "mac_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "mac_address" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "mac_address" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing MAC addresses.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'mac_address'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'mac_address'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'mac_address'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'mac_address'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "mac_address"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "mac_address"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "mac_address"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "mac_address"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Medical Condition

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing medical condition information.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "medical_condition" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "medical_condition" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "medical_condition" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "medical_condition" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing medical condition information.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'medical_condition'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'medical_condition'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'medical_condition'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'medical_condition'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`medical_condition`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`medical_condition`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`medical_condition`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`medical_condition`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "medical_condition"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "medical_condition"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "medical_condition"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "medical_condition"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Medical Specialty

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing medical specialty information.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "medical_specialty" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "medical_specialty" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "medical_specialty" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "medical_specialty" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing medical specialty information.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'medical_specialty'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'medical_specialty'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'medical_specialty'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'medical_specialty'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`medical_specialty`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`medical_specialty`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`medical_specialty`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`medical_specialty`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "medical_specialty"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "medical_specialty"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "medical_specialty"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "medical_specialty"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: National Provider Identifier (NPI)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US National Provider Identifier (NPI) numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_npi" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_npi" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_npi" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_npi" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing US National Provider Identifier (NPI) numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_npi'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_npi'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_npi'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_npi'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_npi"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_npi"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_npi"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_npi"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Netherlands BSN / Tax ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Dutch Burger Service Numbers (BSN) or tax identification numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nl_bsn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nl_bsn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nl_bsn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nl_bsn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Dutch Burger Service Numbers (BSN) or tax identification numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'nl_bsn'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'nl_bsn'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'nl_bsn'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'nl_bsn'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "nl_bsn"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "nl_bsn"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "nl_bsn"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "nl_bsn"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Netherlands VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Netherlands VAT numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nl_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nl_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nl_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nl_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Netherlands VAT numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'nl_vat'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'nl_vat'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'nl_vat'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'nl_vat'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "nl_vat"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "nl_vat"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "nl_vat"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "nl_vat"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: New Zealand Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing New Zealand bank account numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nz_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nz_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nz_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nz_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing New Zealand bank account numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'nz_bank_account'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'nz_bank_account'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'nz_bank_account'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'nz_bank_account'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "nz_bank_account"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "nz_bank_account"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "nz_bank_account"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "nz_bank_account"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: New Zealand MOH

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing New Zealand Ministry of Health numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nz_moh" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nz_moh" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nz_moh" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nz_moh" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing New Zealand Ministry of Health numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'nz_moh'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'nz_moh'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'nz_moh'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'nz_moh'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "nz_moh"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "nz_moh"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "nz_moh"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "nz_moh"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: NHS Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK NHS numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nhs_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nhs_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "nhs_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "nhs_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK NHS numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'nhs_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'nhs_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'nhs_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'nhs_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "nhs_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "nhs_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "nhs_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "nhs_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: OAuth Client Secret

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing OAuth client secrets.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "oauth_client_secret" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "oauth_client_secret" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "oauth_client_secret" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "oauth_client_secret" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing OAuth client secrets.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'oauth_client_secret'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'oauth_client_secret'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'oauth_client_secret'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'oauth_client_secret'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "oauth_client_secret"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "oauth_client_secret"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "oauth_client_secret"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "oauth_client_secret"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Outbound references an email address outside recipient domains

Severity: low
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound messages where an email address extracted from the subject, body, or attachments resolves to a domain different from every recipient's domain and not one of the sender's own domains. Catches email redirection patterns where content points to a third party not in the recipient list.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Data Redirection

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
recipients
recipients.bcc
recipients.cc
recipients.to
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "email_address"
    and .confidence in ("medium", "high")
    and strings.parse_email(.text).domain.valid
    and strings.parse_email(.text).domain.root_domain not in $org_domains
    and all(recipients.to, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
    and all(recipients.cc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
    and all(recipients.bcc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "email_address"
    and .confidence in ("medium", "high")
    and strings.parse_email(.text).domain.valid
    and strings.parse_email(.text).domain.root_domain not in $org_domains
    and all(recipients.to, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
    and all(recipients.cc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
    and all(recipients.bcc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
  )
  or any(attachments,
    any(file.explode(.),
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "email_address"
        and .confidence in ("medium", "high")
        and strings.parse_email(.text).domain.valid
        and strings.parse_email(.text).domain.root_domain not in $org_domains
        and all(recipients.to, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
        and all(recipients.cc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
        and all(recipients.bcc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "email_address"
        and .confidence in ("medium", "high")
        and strings.parse_email(.text).domain.valid
        and strings.parse_email(.text).domain.root_domain not in $org_domains
        and all(recipients.to, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
        and all(recipients.cc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
        and all(recipients.bcc, .email.domain.root_domain != strings.parse_email(..text).domain.root_domain)
      )
    )
  )
)
and not any(recipients.to, .email.domain.root_domain in $org_domains)

Detection logic

Scope: outbound message.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'email_address'
  - .confidence in ('medium', 'high')
  - strings.parse_email(.text).domain.valid
  - strings.parse_email(.text).domain.root_domain not in $org_domains
  - all of recipients.to where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
  - all of recipients.cc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
  - all of recipients.bcc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'email_address'
  - .confidence in ('medium', 'high')
  - strings.parse_email(.text).domain.valid
  - strings.parse_email(.text).domain.root_domain not in $org_domains
  - all of recipients.to where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
  - all of recipients.cc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
  - all of recipients.bcc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'email_address'
    .confidence in ('medium', 'high')
    strings.parse_email(.text).domain.valid
    strings.parse_email(.text).domain.root_domain not in $org_domains
    all of recipients.to where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
    all of recipients.cc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
    all of recipients.bcc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'email_address'
    .confidence in ('medium', 'high')
    strings.parse_email(.text).domain.valid
    strings.parse_email(.text).domain.root_domain not in $org_domains
    all of recipients.to where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
    all of recipients.cc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
    all of recipients.bcc where:
    
    .email.domain.root_domain is not strings.parse_email(.text).domain.root_domain
not:
- any of recipients.to where:
  - .email.domain.root_domain in $org_domains

Inspects: body.current_thread.text, recipients.bcc, recipients.bcc[].email.domain.root_domain, recipients.cc, recipients.cc[].email.domain.root_domain, recipients.to, recipients.to[].email.domain.root_domain, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode, strings.parse_email. Reference lists: $org_domains.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`email_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`email_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`email_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`email_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "email_address"
              strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].text).domain.root_domain not in org_domains"
              strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].text).domain.valid"
               macro "all(recipients.bcc)"
               macro "all(recipients.cc)"
               macro "all(recipients.to)"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "email_address"
              strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].text).domain.root_domain not in org_domains"
              strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].text).domain.valid"
               macro "all(recipients.bcc)"
               macro "all(recipients.cc)"
               macro "all(recipients.to)"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "email_address"
        strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(body.current_thread.text).elements[].text).domain.root_domain not in org_domains"
        strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(body.current_thread.text).elements[].text).domain.valid"
         macro "all(recipients.bcc)"
         macro "all(recipients.cc)"
         macro "all(recipients.to)"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "email_address"
        strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(subject.subject).elements[].text).domain.root_domain not in org_domains"
        strings.parse_email func_call "strings.parse_email(beta.ml_extract_sensitive_information(subject.subject).elements[].text).domain.valid"
         macro "all(recipients.bcc)"
         macro "all(recipients.cc)"
         macro "all(recipients.to)"
  not
    any(recipients.to)
       macro "recipients.to[].email.domain.root_domain in org_domains"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`recipients.to`	array_any	(no value, null check)	`excludes:recipients.to`

beta.DLP: PCI US Credit Card Number (Any Network)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing credit card numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "credit_card_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "credit_card_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "credit_card_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "credit_card_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing credit card numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'credit_card_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'credit_card_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'credit_card_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'credit_card_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "credit_card_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "credit_card_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "credit_card_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "credit_card_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Poland REGON

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Polish REGON business registration numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "pl_regon" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "pl_regon" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "pl_regon" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "pl_regon" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Polish REGON business registration numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'pl_regon'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'pl_regon'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'pl_regon'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'pl_regon'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "pl_regon"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "pl_regon"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "pl_regon"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "pl_regon"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Private Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing private keys.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "private_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "private_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "private_key" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "private_key" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing private keys.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'private_key'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'private_key'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'private_key'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'private_key'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "private_key"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "private_key"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "private_key"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "private_key"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Singapore NRIC

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Singapore National Registration Identity Card (NRIC) numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "sg_nric" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "sg_nric" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "sg_nric" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "sg_nric" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Singapore National Registration Identity Card (NRIC) numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'sg_nric'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'sg_nric'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'sg_nric'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'sg_nric'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "sg_nric"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "sg_nric"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "sg_nric"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "sg_nric"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Singapore UEN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Singapore Unique Entity Numbers (UEN).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "sg_uen" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "sg_uen" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "sg_uen" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "sg_uen" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Singapore Unique Entity Numbers (UEN).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'sg_uen'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'sg_uen'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'sg_uen'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'sg_uen'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "sg_uen"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "sg_uen"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "sg_uen"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "sg_uen"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Slack Access Token

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Slack access tokens.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Secrets & Credentials

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "slack_access_token" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "slack_access_token" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "slack_access_token" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "slack_access_token" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Slack access tokens.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'slack_access_token'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'slack_access_token'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'slack_access_token'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'slack_access_token'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "slack_access_token"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "slack_access_token"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "slack_access_token"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "slack_access_token"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: South Korea Resident Registration Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing South Korean Resident Registration Numbers (RRN).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "kr_rrn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "kr_rrn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "kr_rrn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "kr_rrn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing South Korean Resident Registration Numbers (RRN).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'kr_rrn'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'kr_rrn'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'kr_rrn'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'kr_rrn'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "kr_rrn"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "kr_rrn"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "kr_rrn"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "kr_rrn"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Spain Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Spanish bank account numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "es_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "es_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "es_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "es_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Spanish bank account numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'es_bank_account'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'es_bank_account'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'es_bank_account'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'es_bank_account'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "es_bank_account"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "es_bank_account"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "es_bank_account"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "es_bank_account"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Spain DNI/NIE / Passport / SSN / Tax ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Spanish national identity, passport, social security, or tax identification numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Spanish national identity, passport, social security, or tax identification numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'es_dni_nie_nif'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'es_dni_nie_nif'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'es_dni_nie_nif'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'es_dni_nie_nif'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "es_dni_nie_nif"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "es_dni_nie_nif"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "es_dni_nie_nif"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "es_dni_nie_nif"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: SSL/TLS Certificate

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing SSL/TLS certificates.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure, DLP: Infrastructure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ssl_certificate" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ssl_certificate" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "ssl_certificate" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "ssl_certificate" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing SSL/TLS certificates.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'ssl_certificate'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'ssl_certificate'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'ssl_certificate'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'ssl_certificate'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "ssl_certificate"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "ssl_certificate"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "ssl_certificate"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "ssl_certificate"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Surgical Procedure

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing surgical procedure information.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "surgical_procedure" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "surgical_procedure" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "surgical_procedure" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "surgical_procedure" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing surgical procedure information.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'surgical_procedure'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'surgical_procedure'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'surgical_procedure'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'surgical_procedure'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`surgical_procedure`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`surgical_procedure`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`surgical_procedure`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`surgical_procedure`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "surgical_procedure"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "surgical_procedure"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "surgical_procedure"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "surgical_procedure"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Sweden Personnummer / Tax ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Swedish personal identity numbers (personnummer) or tax identification numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "se_personnummer" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "se_personnummer" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "se_personnummer" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "se_personnummer" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Swedish personal identity numbers (personnummer) or tax identification numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'se_personnummer'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'se_personnummer'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'se_personnummer'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'se_personnummer'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "se_personnummer"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "se_personnummer"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "se_personnummer"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "se_personnummer"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: SWIFT/BIC Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound messages containing SWIFT/BIC codes. SWIFT codes are used to identify banks and financial institutions globally and may indicate financial account details being shared externally.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "swift_bic" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "swift_bic" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "swift_bic" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "swift_bic" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects outbound messages containing SWIFT/BIC codes. SWIFT codes are used to identify banks and financial institutions globally and may indicate financial account details being shared externally.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'swift_bic'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'swift_bic'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'swift_bic'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'swift_bic'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "swift_bic"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "swift_bic"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "swift_bic"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "swift_bic"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_drivers_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_drivers_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_drivers_license" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_drivers_license" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_drivers_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_drivers_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_drivers_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_drivers_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_drivers_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_drivers_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_drivers_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_drivers_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Electoral Roll

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK electoral roll information.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_electoral_roll" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_electoral_roll" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_electoral_roll" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_electoral_roll" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK electoral roll information.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_electoral_roll'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_electoral_roll'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_electoral_roll'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_electoral_roll'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_electoral_roll`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_electoral_roll"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_electoral_roll"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_electoral_roll"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_electoral_roll"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK National Insurance Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK National Insurance numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_nino" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_nino" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "uk_nino" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "uk_nino" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing UK National Insurance numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_nino'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_nino'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_nino'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_nino'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_nino"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_nino"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_nino"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_nino"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Passport

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_passport_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_passport_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK UTR (Tax)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK Unique Taxpayer Reference numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: GDPR

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_utr" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_utr" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_utr" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_utr" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing UK Unique Taxpayer Reference numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'uk_utr'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'uk_utr'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'uk_utr'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'uk_utr'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "uk_utr"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "uk_utr"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "uk_utr"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "uk_utr"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US ABA Routing Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US ABA routing numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_aba_routing_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_aba_routing_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_aba_routing_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_aba_routing_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing US ABA routing numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_aba_routing_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_aba_routing_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_aba_routing_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_aba_routing_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_aba_routing_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_aba_routing_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_aba_routing_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_aba_routing_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Bank Account Number

Severity: medium
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US bank account numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_bank_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_bank_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_bank_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_bank_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US bank account numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_bank_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_bank_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_bank_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_bank_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_bank_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_bank_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_bank_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_bank_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US driver's license numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_driver_license" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_driver_license" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US driver's license numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_driver_license'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_driver_license'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_driver_license'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_driver_license'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_driver_license"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_driver_license"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_driver_license"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_driver_license"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Individual Taxpayer Identification Number (ITIN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Individual Taxpayer Identification Numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_itin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_itin" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_itin" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_itin" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US Individual Taxpayer Identification Numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_itin'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_itin'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_itin'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_itin'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_itin"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_itin"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_itin"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_itin"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Medicare Beneficiary ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Medicare Beneficiary Identification numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing US Medicare Beneficiary Identification numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_medicare_beneficiary_id'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_medicare_beneficiary_id'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_medicare_beneficiary_id'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_medicare_beneficiary_id'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_medicare_beneficiary_id"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_medicare_beneficiary_id"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_medicare_beneficiary_id"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_medicare_beneficiary_id"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US passport numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_passport_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_passport_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US passport numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'us_passport_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'us_passport_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'us_passport_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'us_passport_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "us_passport_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "us_passport_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "us_passport_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "us_passport_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Social Security Number (SSN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Social Security Numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: HIPAA

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "social_security_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "social_security_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "social_security_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "social_security_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection logic

Scope: outbound message.

Detects messages containing US Social Security Numbers.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'social_security_number'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'social_security_number'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'social_security_number'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'social_security_number'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "social_security_number"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "social_security_number"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "social_security_number"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "social_security_number"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Vehicle VIN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Vehicle Identification Numbers (VIN).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Asset Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
subject
type

Rule body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "vehicle_vin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "vehicle_vin" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "vehicle_vin" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "vehicle_vin" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection logic

Scope: outbound message.

Detects messages containing Vehicle Identification Numbers (VIN).

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type is 'vehicle_vin'
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type is 'vehicle_vin'
  - .confidence in ('medium', 'high')
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type is 'vehicle_vin'
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type is 'vehicle_vin'
    .confidence in ('medium', 'high')

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type eq "vehicle_vin"
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type eq "vehicle_vin"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type eq "vehicle_vin"
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type eq "vehicle_vin"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

DLP - Clear-Text Credentials Outbound

Severity: critical
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound emails containing clear-text credentials in the body, subject, or attachments using ML extraction. Covers private keys, AWS access keys, GitHub tokens, HTTP Basic auth headers, and OAuth client secrets. Attachment content is scanned via ml_extract on both raw text and OCR surfaces, catching credentials embedded in images or binary document formats. Note: GCP API keys, Slack tokens, JWTs, and database connection strings are not covered by ml_extract and are intentionally omitted to avoid regex FPs.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.current_thread
subject
type

Rule body

type.outbound
and (
    // ── ML extraction: body ────────────────────────────────────────────────

    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── ML extraction: subject ─────────────────────────────────────────────

    or any(beta.ml_extract_sensitive_information(subject.subject).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── Credential-bearing file types by extension and name ────────────────

    or any(attachments,
        .file_extension in~ ("env", "pem", "key", "p12", "pfx", "jks", "keystore", "ovpn")
        or strings.icontains(.file_name, "credential")
        or strings.icontains(.file_name, "secret")
        or strings.icontains(.file_name, "password")
    )

    // ── ML extraction: attachments (raw text + OCR) ────────────────────────

    or any(attachments,
        any(file.explode(.),
            any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
            or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
        )
    )
)

Detection logic

Scope: outbound message.

outbound message
any of:
- any of beta.ml_extract_sensitive_information(body.current_thread.text).elements where all hold:
  - .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
  - .confidence in ('medium', 'high')
- any of beta.ml_extract_sensitive_information(subject.subject).elements where all hold:
  - .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
  - .confidence in ('medium', 'high')
- any of attachments where any holds:
  - .file_extension in ('env', 'pem', 'key', 'p12', 'pfx', 'jks', 'keystore', 'ovpn')
  - .file_name contains 'credential'
  - .file_name contains 'secret'
  - .file_name contains 'password'
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    any of beta.ml_extract_sensitive_information(.scan.strings.raw).elements where all hold:
    
    .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
    .confidence in ('medium', 'high')
    any of beta.ml_extract_sensitive_information(.scan.ocr.raw).elements where all hold:
    
    .type in ('private_key', 'aws_access_key', 'github_token', 'http_authorization_header', 'oauth_client_secret')
    .confidence in ('medium', 'high')

Inspects: attachments[].file_extension, attachments[].file_name, body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode, strings.icontains.

Indicators matched (39)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`oauth_client_secret`

27 more

`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`attachments[].file_extension`	member	`env`
`attachments[].file_extension`	member	`pem`
`attachments[].file_extension`	member	`key`
`attachments[].file_extension`	member	`p12`
`attachments[].file_extension`	member	`pfx`
`attachments[].file_extension`	member	`jks`
`attachments[].file_extension`	member	`keystore`
`attachments[].file_extension`	member	`ovpn`
`strings.icontains`	substring	`credential`
`strings.icontains`	substring	`secret`
`strings.icontains`	substring	`password`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.ocr.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
          any(beta.ml_extract_sensitive_information(file.explode(attachments).scan.strings.raw).elements)
            and
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence in ["high", "medium"]
              beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
    any(attachments)
      or
        attachments.file_extension in ["env", "jks", "key", "keystore", "ovpn", "p12", "pem", "pfx"]
        attachments.file_name contains "credential"
        attachments.file_name contains "password"
        attachments.file_name contains "secret"
    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements)
      and
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(body.current_thread.text).elements.type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
    any(beta.ml_extract_sensitive_information(subject.subject).elements)
      and
        beta.ml_extract_sensitive_information(subject.subject).elements.confidence in ["high", "medium"]
        beta.ml_extract_sensitive_information(subject.subject).elements.type in ["aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret", "private_key"]
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean`	`field:"type.outbound" kind:eq value:"true"`

Sublime MQL rules: beta

beta.DLP: Australia ABN

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Bank Account

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Driver's License

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Medicare

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Passport Number

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Tax File Number

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Austria VAT

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: AWS Access Key

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (12)

Stages and Predicates

Stage 1: mql_rule

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`