# Sublime Security Sublime Rules

Sublime Security Sublime Rules is a Detection Engineering product by Sublime Security. It runs on-premises. Pricing is free.

Open-source detection rules for email attacks like BEC, phishing, and malware

Checked October 2026.

## What is Sublime Security Sublime Rules?

Sublime Rules is an open-source repository containing detection rules for the Sublime Security platform. The repository provides rules designed to identify and prevent various email-based attacks including business email compromise (BEC), credential phishing, and malware delivery.

The repository is organized into multiple categories including detection rules, discovery rules, DLP discovery rules, automations, insights, and YARA rules. It includes specific detection capabilities for HTML smuggling, VIP and executive impersonation, malicious OneNote files, malicious LNK files, and encrypted zip attachments.

The rules are written using Message Query Language (MQL), a query language specific to the Sublime platform for analyzing email messages. The repository contains over 3,000 commits and has contributions from 71 contributors, indicating active development and community involvement.

The project is released under the MIT license, making it freely available for use and modification. The repository includes sample email files (EMLs), tutorial files, and scripts to support rule development and testing. Community members have also created additional rule feeds that complement the main repository.

Tags: Detection Rules, Open Source, YARA

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Detection Engineering](https://cybersectools.com/categories/detection-engineering)
- Vendor: [Sublime Security](https://cybersectools.com/companies/sublime-security)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- Features: 10 listed
- Website: github.com

The full feature and integration lists are on the page for signed-in visitors.

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## Sublime Security Sublime Rules FAQ

### What is Sublime Security Sublime Rules?

Sublime Security Sublime Rules is a product by Sublime Security in the Detection Engineering category. It covers Detection Rules, Open Source and YARA.

### What is the pricing for Sublime Security Sublime Rules?

Sublime Security Sublime Rules is free. Download and setup instructions are at https://github.com/sublime-security/sublime-rules/.

### What are alternatives to Sublime Security Sublime Rules?

Alternatives to Sublime Security Sublime Rules listed on CybersecTools:

1. [Anvilogic AI SOC](https://cybersectools.com/tools/anvilogic-ai-soc) - AI-powered SOC platform for detection engineering across SIEMs & data lakes (Commercial)
2. [Google Security Operations](https://cybersectools.com/tools/google-security-operations) - Cloud-native SIEM, SOAR, and threat intel platform for SecOps teams (Commercial)
3. [LogCraft Detection Engineering](https://cybersectools.com/tools/logcraft-detection-engineering) - Detection-as-code platform for managing detection rules across SIEM/EDR/XDR (Commercial)
4. [SOC Prime Threat Detection Marketplace](https://cybersectools.com/tools/soc-prime-threat-detection-marketplace) - Threat detection marketplace with Sigma rules for SIEM and shift-left detection (Commercial)
5. [Red Canary Threat Intelligence](https://cybersectools.com/tools/red-canary-threat-intelligence) - Threat intelligence service providing threat profiles and analytics for MDR (Commercial)

Compare all Sublime Security Sublime Rules alternatives at [https://cybersectools.com/alternatives/sublime-security-sublime-rules](https://cybersectools.com/alternatives/sublime-security-sublime-rules)

### What deployment and organization size does Sublime Security Sublime Rules fit?

Sublime Security Sublime Rules is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare Sublime Security Sublime Rules with similar solutions

- [Sublime Security Sublime Rules vs Anvilogic AI SOC](https://cybersectools.com/compare/anvilogic-ai-soc-vs-sublime-security-sublime-rules)
- [Sublime Security Sublime Rules vs Google Security Operations](https://cybersectools.com/compare/google-security-operations-vs-sublime-security-sublime-rules)
- [Sublime Security Sublime Rules vs LogCraft Detection Engineering](https://cybersectools.com/compare/logcraft-detection-engineering-vs-sublime-security-sublime-rules)

All alternatives to Sublime Security Sublime Rules: [/alternatives/sublime-security-sublime-rules](https://cybersectools.com/alternatives/sublime-security-sublime-rules)

---

Source: https://cybersectools.com/tools/sublime-security-sublime-rules

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Sublime Security Sublime Rules and Sublime Security: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md