SUsublime
Messages

Analyze a raw message

Changed on

Analyze a raw message with provided, active, or Feed rules in your Sublime organization. Raw messages are treated as inbound unless message_type specifies outbound or internal.

post/v0/messages/analyze

Request

  • Base URL
    https://platform.sublime.security
  • URL
    https://platform.sublime.security/v0/messages/analyze
  • Auth
    HTTP bearer

Request body

raw_messagestring byte required

The full base64 encoded raw eml message

run_active_detection_rulesboolean

Whether to analyze the message with all active detection rules in your organization

run_active_dlp_rulesboolean

Whether to analyze the message with all active DLP rules in your organization. Requires read_dlp_rules, and the message being analyzed must be outbound or internal (sent).

run_all_detection_rulesboolean

Whether to analyze with all detection rules from all Feeds, including uninstalled + inactive Feed rules, as well as any active detection rules you’ve created that are not part of a Feed.

run_all_dlp_rulesboolean

Whether to analyze with all DLP rules from all Feeds, including uninstalled + inactive Feed rules, as well as any active DLP rules you've created that are not part of a Feed. Requires read_dlp_rules, and the message being analyzed must be outbound or internal (sent).

run_all_insightsboolean

Whether to analyze with all insights

Response

OK

Changes

  • 081203bd7147Revision changes
    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property