Sublime Platform
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing, utilizing Message Query Language (MQL) for behavior description.
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing, utilizing Message Query Language (MQL) for behavior description.
Checked October 2026.
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, and collaborate with the community. Sublime uses Message Query Language (MQL), a domain-specific language purpose-built for describing behavior in email.
MQL is email provider agnostic, enabling defenders to write, run, and share Detections-as-Code. Open-source detection rules and links to community feeds are maintained in the sublime-rules repository. Learn more about MQL: Introduction to Message Query Language. Setup instructions, Docker Quickstart, other deployment methods, documentation, API, release log, and more are available.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Sublime Platform: features, pricing and alternatives.
Sublime Platform is a product in the Detection Engineering category. It covers Open Source.
Sublime Platform is free. Download and setup instructions are at https://github.com/sublime-security/sublime-platform/.
Alternatives to Sublime Platform listed on CybersecTools:
Compare all Sublime Platform alternatives at https://cybersectools.com/alternatives/sublime-platform
Sublime Platform is available as cloud or on-premises (hybrid). It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Open source Suricata-based NDR system with threat detection and analysis
A tool for deep analysis of malicious files using ClamAV and YARA rules, with features like scoring suspect files, building visual tree graphs, and extracting specific patterns.
A strings statistics calculator for YARA rules to aid malware research.
Open-source detection rules for email attacks like BEC, phishing, and malware
SALO is a framework that generates synthetic log events for security testing and research without requiring actual infrastructure or triggering real events.
A Sysmon configuration file template with detailed explanations and tutorial-like features.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
