# Sublime Platform

Sublime Platform is a Detection Engineering product. It runs in the cloud or on-premises (hybrid). Pricing is free.

A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing, utilizing Message Query Language (MQL) for behavior description.

Checked October 2026.

## What is Sublime Platform?

A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, and collaborate with the community. Sublime uses Message Query Language (MQL), a domain-specific language purpose-built for describing behavior in email. MQL is email provider agnostic, enabling defenders to write, run, and share Detections-as-Code. Open-source detection rules and links to community feeds are maintained in the sublime-rules repository. Learn more about MQL: Introduction to Message Query Language. Setup instructions, Docker Quickstart, other deployment methods, documentation, API, release log, and more are available.

Tags: Open Source

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Detection Engineering](https://cybersectools.com/categories/detection-engineering)
- Deployment: Hybrid
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 250
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## Sublime Platform FAQ

### What is Sublime Platform?

Sublime Platform is a product in the Detection Engineering category. It covers Open Source.

### What is the pricing for Sublime Platform?

Sublime Platform is free. Download and setup instructions are at https://github.com/sublime-security/sublime-platform/.

### What are alternatives to Sublime Platform?

Alternatives to Sublime Platform listed on CybersecTools:

1. [Sublime Security Sublime Rules](https://cybersectools.com/tools/sublime-security-sublime-rules) - Open-source detection rules for email attacks like BEC, phishing, and malware (Free)
2. [Stamus Clear NDR Community](https://cybersectools.com/tools/stamus-clear-ndr-community) - Open source Suricata-based NDR system with threat detection and analysis (Free)
3. [Anvilogic AI SOC](https://cybersectools.com/tools/anvilogic-ai-soc) - AI-powered SOC platform for detection engineering across SIEMs & data lakes (Commercial)
4. [Google Security Operations](https://cybersectools.com/tools/google-security-operations) - Cloud-native SIEM, SOAR, and threat intel platform for SecOps teams (Commercial)
5. [Binary Defense Threat Hunting](https://cybersectools.com/tools/binary-defense-threat-hunting) - A managed security service that uses hypothesis-based threat hunting to proactively discover hidden threats, create new detection rules, and improve overall security posture. (Commercial)

Compare all Sublime Platform alternatives at [https://cybersectools.com/alternatives/sublime-platform](https://cybersectools.com/alternatives/sublime-platform)

### What deployment and organization size does Sublime Platform fit?

Sublime Platform is available as cloud or on-premises (hybrid). It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare Sublime Platform with similar solutions

- [Sublime Platform vs Sublime Security Sublime Rules](https://cybersectools.com/compare/sublime-platform-vs-sublime-security-sublime-rules)
- [Sublime Platform vs Stamus Clear NDR Community](https://cybersectools.com/compare/stamus-clear-ndr-community-vs-sublime-platform)
- [Sublime Platform vs Anvilogic AI SOC](https://cybersectools.com/compare/anvilogic-ai-soc-vs-sublime-platform)

All alternatives to Sublime Platform: [/alternatives/sublime-platform](https://cybersectools.com/alternatives/sublime-platform)

---

Source: https://cybersectools.com/tools/sublime-platform

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Sublime Platform: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md