SUsublime
Rules

Validate rule

Changed on

Validate a rule (MQL, YAML fields, etc). When run against the Sublime Sandbox or the EML Analyzer, no auth is needed but custom lists etc will not be available.

post/v0/rules/validate

Request

  • Base URL
    https://platform.sublime.security
  • URL
    https://platform.sublime.security/v0/rules/validate
  • Auth
    HTTP bearer

Request body

action_idsstring[]

IDs of actions to run when the rule is triggered

activeboolean

Activate the rule immediately

attack_typesstring[]

Rule attack types

auto_review_auto_shareboolean

Whether auto-reviewed messages will be shared

auto_review_classificationstring nullable

The classification auto-reviewed messages will have, when an auto-review action is associated with the rule

data_categoriesstring[]

DLP data categories

descriptionstring

Description of rule

detection_methodsstring[]

Rule detection technologies

false_positivesstring[]

Descriptions of known false positives that could occur

internal_typestring nullable

For core feed only

labelstring nullable

Rule label

maturitystring nullable

Rule maturity

namestring required

Rule name

referencesstring[]

URL references

run_triage_on_excluded_messagesboolean nullable

For Triage rules only, whether this rule will run even if the message matched a global exclusion.

severitystring nullable

Rule severity

sourcestring required

Source

tactics_and_techniquesstring[]

Rule tactics and techniques

tagsstring[]

Tags

triage_abuse_reportsboolean nullable

For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.

triage_classification_changesboolean nullable

For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.

triage_delivery_blockedboolean nullable

For Triage rules only, whether this rule will run for messages that had delivery blocked. For triage rules, one triage_ field must be true.

triage_dlp_rule_matchedboolean nullable

For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.

triage_flagged_messagesboolean nullable

For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.

type'detection' | 'dlp' | 'triage'

Type of the rule

user_provided_tagsstring[]

User-provided tags

Response

OK

functionsstring[]

Function names found in the rule

is_org_dependentboolean

Whether the rule uses org-specific fields, lists, or functions

liststring[]

List names found in the rule

validation_errorstring

Validation error message if the rule is invalid

Changes

  • 081203bd7147Revision changes
    • info

      added the new optional request property

    • info

      added the new optional request property