Sublime Security

No entries match these filters. Clear filters

1. Platform v1.90.133 (Attack Score Flash) (2026-10-27) Oct 27, 2026 · issue 123

   Attack Score Flash is now generally available, adding ML-based threat detection to all inbound mail with Malicious, Suspicious, Spam, and Graymail verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Attack Score Flash to all inbound mail, providing Attack Score-like detections that catch messages existing rules may miss, with high-precision Malicious, Suspicious, Spam, and Graymail verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Promotes Potentially Malicious and Spam detections into the core feed, removing the need for custom rules to use them.
   • Existing automations triggered on Attack Score verdicts now also act on messages flagged by Attack Score Flash, increasing automated flagged message volume.
   • Autonomous Security Analyst (ASA) automatically reviews Attack Score Flash Suspicious verdicts via the existing Send suspicious messages to ASA automation.
   • Potentially Malicious detection is available on Sublime Enterprise only; Attack Score Flash is available on both Sublime-managed cloud and self-hosted deployments.
   • Adds Attack Score Flash to all inbound mail, providing Attack Score-like detections that catch messages existing rules may miss, with high-precision Malicious, Suspicious, Spam, and Graymail verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Potentially Malicious detection is available on Sublime Enterprise only; Attack Score Flash is available on both Sublime-managed cloud and self-hosted deployments.

   3 more in Everything

2. Platform v1.90.101 (Prompt Injection Detection - Public Beta) (2026-10-21) Oct 21, 2026 · issue 116

   New Prompt Injection Detection (public beta) uses an ML model and MQLMQLA query language created by Microsoft for hunting across telemetry in Microsoft 365 Defender, letting cyber tools express complex behavioral detections in a structured, readable syntax. function beta.prompt_injection_detection() to detect and block hidden AI-agent instructions in inbound email, with ASA-confirmed attempts tagged Email prompt injection and available for review in the Message List View. Requires Enterprise plan with ASA.

   • New detectionAdds beta.prompt_injection_detection() MQL function callable from detection rules to score inbound email for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. attempts.
   • Extends the existing Send suspicious messages to ASA automation to route prompt injection detection matches to the Autonomous Security Analyst (ASA) for confirmation and remediation.
   • Applies the Email prompt injection tag to ASA-confirmed prompt injection attempts, enabling filtering in the Message List View by that tag.

   3 details in Everything

3. Platform v1.90.8 (Flexible Threat Log Views) (2026-10-19) Oct 19, 2026 · issue 114

   Threat Log views gain adjustable State and Verdict filters plus a count badge on Needs Review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Review all auto-remediated messages without leaving the Needs Remediation view by switching the State filter.
   📍In the Dashboard, go to Threat Log › Needs Remediation, then open the State filter and select auto-remediated.
   Inspect Malicious-verdict messages directly from the Needs Review view by changing the Verdict filter.
   📍In the Dashboard, go to Threat Log › Needs Review, then open the Verdict filter and select Malicious.
   • Adds a message count badge to the Needs Review Threat Log view so unreviewed messages are always visible at a glance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Makes the State filter in Needs Remediation adjustable, letting analysts switch to states like auto-remediated or mixed without leaving the view.
   • Makes the Verdict filter in Needs Review adjustable, letting analysts find messages with any verdict inside the same view.
   • Updates default filters: Needs Remediation opens on unreviewed Malicious messages with no remediation actions applied; Needs Review opens on Spam, Unknown, and Suspicious messages.
   • Adds a message count badge to the Needs Review Threat Log view so unreviewed messages are always visible at a glance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

4. Platform v1.90.79 (Attack Score Flash - Public Beta) (2026-10-19) Oct 19, 2026 · issue 114

   Attack Score Flash (public beta) adds beta.attack_score_flash() to all inbound mail, integrating verdicts into the existing Attack Score and ASA pipeline.

   • New detectionUpdated detectionAdds beta.attack_score_flash() MQLMQLA query language created by Microsoft for hunting across telemetry in Microsoft 365 Defender, letting cyber tools express complex behavioral detections in a structured, readable syntax. function (Enterprise-only for malicious/potentially_malicious verdict; all tiers for spam) to evaluate all inbound mail and return verdicts of malicious, potentially_malicious, spam, or graymail — enabling detections that can catch messages Attack Score alone may miss.
   • Integrates Attack Score Flash verdicts into the existing Attack Score pipeline — potentially_malicious flags produce Suspicious or Malicious Attack Score verdicts, spam flags produce Spam verdicts, and graymail flags produce Graymail verdicts, with ASA automatically reviewing Suspicious messages.

   2 details in Everything

5. Platform v1.90.45 (Shared & Delegated Calendar Protection) (2026-10-14) Oct 14, 2026 · issue 109

   Google Workspace admins must grant https://www.googleapis.com/auth/calendar.calendarlist.readonly; Microsoft 365 requires no action for expanded calendar protection.

   • Updated detection Shared and Delegated Calendar Protection
   └──▷ BREAKING ON UPGRADE

   • !Google Workspace customers must have a super admin grant the new https://www.googleapis.com/auth/calendar.calendarlist.readonly scope; without it, expanded shared/delegated calendar protection will not activate.
6. generated Oct 11, 2026 · issue 102

   API surface changed: +4 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +4 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /v0/dlp/release-requests
   • + GET /v0/dlp/release-requests/{id}
   • + POST /v0/dlp/release-requests/{id}/approve
   • + POST /v0/dlp/release-requests/{id}/deny
   • New endpoint GET /v0/dlp/release-requests⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /v0/dlp/release-requests/{id}
   • New endpoint POST /v0/dlp/release-requests/{id}/approve
   • New endpoint POST /v0/dlp/release-requests/{id}/deny

   4 details in Everything

7. Platform v1.90 (Tailored Phishing Simulations and Training) (2026-10-06) Oct 6, 2026 · issue 096

   Sublime Security adds Tailored Phishing Simulations and Training, turning real detected attacks into employee simulations with immediate contextual training.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds Tailored Phishing Simulations and Training, converting attacks detected in your environment into phishing simulations with immediate, context-aware training when employees click.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Integrates phishing simulation and training directly into the existing Sublime platform, eliminating the need for a separate tool to run employee security awareness programs.

   2 details in Everything

8. Platform v1.89 (Data Loss Prevention) (2026-09-30) Sep 30, 2026 · issue 090

   Sublime Security launches Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. with AI-powered triage, pre-delivery blocking, and Purview sensitivity label support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds Email DLP (Data Loss Prevention) as a new capability that inspects every outbound message before delivery, with a Sublime-maintained detection feed covering personal, payment, and healthcare data, credentials, and country- and regulation-specific data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Block Delivery enforcement mode that holds violating outbound messages before they reach the recipient, with senders receiving a plain-language explanation and a one-click unblock request.
   • Adds ASA (Autonomous Security Analyst) triage for flagged outbound messages, automatically blocking real violations and releasing legitimate mail without manual review.
   • Adds support for Microsoft Purview sensitivity labels in DLP detections for Microsoft 365 tenants.
   • Unifies inbound and outbound email security under a single console, with all DLP blocks traceable to readable, adjustable detection logic.

   5 details in Everything

9. Platform v1.88.278 (Expanded Link Exclusions) (2026-09-24) Sep 24, 2026 · issue 085

   Link Exclusions now match on path, query params, display text, scheme, or subdomain — not just domain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Skip analysis of unsubscribe links from a specific domain so they never trigger link-inspection rules.
   📍In the Sublime Security console, go to Exclusions › Create, set Scope to Link, and enter the expression: strings.icontains(href_url.path, "/unsubscribe") and href.url.domain.root_domain == acme.com
   • Adds Link Exclusion scope via Exclusions > Create with Scope set to Link, supporting expressions like strings.icontains(href_url.path, "/unsubscribe") and href.url.domain.root_domain == "acme.com".⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

10. Platform v1.88.228 (Microsoft365 Junk Report Ingestion) (2026-09-15) Sep 15, 2026 · issue 076

    Sublime Security can now ingest Microsoft 365 Junk reports as user-reported phishing signal without changing end-user workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    • Adds a new opt-in setting under Admin > Account > Abuse Mailbox to ingest Outlook Junk reports as user reports for Microsoft 365 message sources, capturing phishing signal without requiring end-users to use the Report Phishing button.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

11. generated Sep 13, 2026 · issue 073

    API surface changed: 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • ~ GET /v0/message-groups: param verdict__is_not (query) added
    • ~ GET /v0/messages/{id}/message_data_model: response schema changed
    • ~ POST /v0/enrichment/link_analysis/evaluate: response schema changed
    • ~ POST /v0/messages/create: response schema changed
    • GET /v0/message-groups: param verdict__is_not (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

12. generated Sep 10, 2026 · issue 070

    API surface changed: 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • ~ GET /v0/message-groups: param verdict__is_not (query) added
    • ~ GET /v0/messages/{id}/message_data_model: response schema changed
    • ~ POST /v0/messages/create: response schema changed
    • GET /v0/message-groups: param verdict__is_not (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

13. generated Sep 7, 2026 · issue 067

    API surface changed: 1 modified

    API change

    API surface changed: 1 modified

    • ~ GET /v0/binexplode/scan/{id}: response schema changed
    • GET /v0/binexplode/scan/{id}: response schema changed

    1 detail in Everything

14. generated Sep 4, 2026 · issue 064

    API surface changed: 1 modified

    API change

    API surface changed: 1 modified

    • ~ GET /v0/binexplode/scan/{id}: response schema changed
    • GET /v0/binexplode/scan/{id}: response schema changed

    1 detail in Everything

15. generated Aug 28, 2026 · issue 058

    API surface changed: +5 endpoints, 8 modified

    API change

    API surface changed: +5 endpoints, 8 modified

    • + DELETE /v0/messages/export/{id}
    • + GET /v0/messages/export
    • + GET /v0/messages/export/dashboard/{dashboard_type}/estimate
    • + GET /v0/messages/export/{id}
    • + POST /v0/messages/export/dashboard/{dashboard_type}
    • ~ GET /v0/binexplode/scan/{id}: response schema changed
    • ~ GET /v0/message-groups/siem-summary: response schema changed
    • ~ GET /v0/messages/{id}/message_data_model: response schema changed
    • ~ POST /v0/enrichment/link_analysis/evaluate: response schema changed
    • ~ POST /v0/message-groups/{id}/share-with-sublime: request body changed
    • ~ POST /v0/messages/analyze: request body changed
    • ~ POST /v0/messages/create: response schema changed
    • ~ POST /v0/messages/{id}/analyze: request body changed
    • New endpoint DELETE /v0/messages/export/{id}
    • New endpoint GET /v0/messages/export
    • New endpoint GET /v0/messages/export/dashboard/{dashboard_type}/estimate
    • New endpoint GET /v0/messages/export/{id}
    • New endpoint POST /v0/messages/export/dashboard/{dashboard_type}

    +8 more show less

    • GET /v0/binexplode/scan/{id}: response schema changed
    • GET /v0/message-groups/siem-summary: response schema changed
    • GET /v0/messages/{id}/message_data_model: response schema changed
    • POST /v0/enrichment/link_analysis/evaluate: response schema changed
    • POST /v0/message-groups/{id}/share-with-sublime: request body changed
    • POST /v0/messages/analyze: request body changed
    • POST /v0/messages/create: response schema changed
    • POST /v0/messages/{id}/analyze: request body changed

    13 details in Everything

16. Platform v1.88.110 (New classification: Violation) (2026-08-20) Aug 20, 2026 · release notes

    Sublime Platform v1.88.110 adds violation classification for inbound and internal messages

    • Enables the violation classification option for all message groups (inbound, internal, and outbound) during reviews, expanding on the previous outbound-only DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. limitation.

    1 detail in Everything

17. generated Aug 14, 2026 · issue 045

    API surface changed: +1 endpoint, 7 modified

    API change

    API surface changed: +1 endpoint, 7 modified

    • + POST /v0/message-groups/move-to-spam
    • ~ GET /v0/audit-log/events: response schema changed
    • ~ GET /v0/audit-log/events/{id}: response schema changed
    • ~ GET /v0/message-groups: param last_created_at__gte (query) added; param last_created_at__lt (query) added
    • ~ GET /v0/messages/{id}/message_data_model: response schema changed
    • ~ POST /v0/enrichment/link_analysis/evaluate: response schema changed
    • ~ POST /v0/message-groups/review: request body changed
    • ~ POST /v0/messages/create: response schema changed
    • New endpoint POST /v0/message-groups/move-to-spam
    • GET /v0/audit-log/events: response schema changed
    • GET /v0/audit-log/events/{id}: response schema changed
    • GET /v0/message-groups: param last_created_at__gte (query) added; param last_created_at__lt (query) added
    • GET /v0/messages/{id}/message_data_model: response schema changed

    +3 more show less

    • POST /v0/enrichment/link_analysis/evaluate: response schema changed
    • POST /v0/message-groups/review: request body changed
    • POST /v0/messages/create: response schema changed

    8 details in Everything

18. api Aug 5, 2026 · issue 036

    API surface changed: 2 deprecated

    API change

    API surface changed: 2 deprecated

    • ⚠ GET /v0/message-groups/hunt/{id}
    • ⚠ POST /v0/message-groups/hunt
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint GET /v0/message-groups/hunt/{id} (still works)
    • !Deprecated endpoint POST /v0/message-groups/hunt (still works)
19. Platform v.1.88 (Tailored Phishing Simulations - Beta) (2026-08-03) Aug 3, 2026 · issue 046

    Sublime adds Tailored Phishing Simulations (Beta): environment-prioritized campaigns with staggered delivery and cross-campaign tracking.

    ⤢
    • New Tailored Phishing Simulations (Beta) lets you run phishing campaigns prioritized by the attack patterns Sublime is already detecting in your environment.
    • Supports sending multiple templates per campaign with staggered delivery schedules.
    • Tracks click rates, report rates, and repeat clickers in a cross-campaign dashboard with recipient-level detail per campaign.
    • Available to all customers during Beta; will move to a paid Sublime Tailored Phishing Simulations and Training add-on at GA — enable by contacting Sublime Support.

    4 details in Everything

20. Platform v.1.88 Tailored Phishing Simulations (Beta) (2026-08-03) Aug 3, 2026 · issue 035

    Sublime adds Tailored Phishing Simulations (Beta): run campaigns prioritized by attacks already detected in your environment.

    ⤢
    • New Tailored Phishing Simulations (Beta) lets you run phishing simulation campaigns prioritized by attack patterns Sublime is already detecting in your environment.
    • Supports multiple templates per campaign with staggered delivery across recipients.
    • Tracks click rates, report rates, and repeat clickers in a cross-campaign dashboard with recipient-level detail per campaign.

    3 details in Everything

21. Platform v1.87.25 (CrowdStrike Falcon Next-Gen SIEM and Fusion SOAR integrations) (2026-07-31) Jul 31, 2026 · issue 032

    Sublime email events now stream into CrowdStrike Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., and Sublime Actions run natively in Falcon Fusion SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks.

    ⤢ ⤢
    • Streams Sublime email security events (flagged message groups, user-reported messages) into CrowdStrike Falcon Next-Gen SIEM alongside endpoint, identity, and threat intelligence telemetry.
    • Surfaces per-message triage context in Falcon Next-Gen SIEM: matched Sublime coverage, source IPs, URLs, attachment hashes, link-click activity, and ASA (Autonomous Security Analyst) verdict.
    • Adds Sublime Actions as native steps in Falcon Fusion SOAR playbooks, enabling message investigation and enrichment, hunt result retrieval, Rule and List management, and remediation without leaving Falcon.
    • Returns typed output from every Sublime Action in Fusion, allowing downstream playbook steps to branch on results without manual JSON parsing.

    4 details in Everything

22. Platform v1.87.1 (Customer Account Access) (2026-07-28) Jul 28, 2026 · issue 029

    Sublime adds Customer Account Access controls so admins can govern, audit, and time-limit support sessions in their tenant.

    └──▷ HOW TO FIND IT
    Review the audit log of all Sublime support sessions in your tenant to verify what was accessed and when.
    📍In the Sublime console, navigate to Settings › Customer Account Access to view and export the session audit log.
    • New single admin setting to enable or disable Sublime support access to a customer environment at any time.
    • Every support session is written to an audit log that admins can view and export for full accountability.
    • Live banner displayed to Sublime employees working inside a customer tenant, showing the account, role, and active session.
    • Support sessions auto-expire with a renewal prompt at 10 minutes, limiting unattended access.

    4 details in Everything

23. Platform v1.87 (Advanced Graymail Protection - GA) (2026-07-28) Jul 28, 2026 · issue 029

    Sublime Security's Advanced Graymail Protection is now GA, with automated remediation, fuzzy detection, and per-user preference learning.

    ⤢
    └──▷ HOW TO FIND IT
    Enable user preference learning so Sublime automatically tailors graymail routing per sender based on individual user behavior.
    📍In the console, go to Admin → Account and enable Graymail User Preferences.
    • Adds Advanced Graymail Protection (GA) to identify and manage marketing emails, newsletters, and subscription content across Microsoft 365 and Google Workspace.
    • New Remediate graymail flagged messages Automation routes detected graymail to Promotions automatically.
    • New Rule Fuzzy Attack Score: Advanced Graymail Detection extends graymail detection coverage, designed to pair with the included Automation.
    • New Graymail User Preferences feature (Admin → Account) learns from users moving messages into or out of Promotions or Junk/Spam and applies sender-level preferences to future messages.

    4 details in Everything

24. Platform v1.86 (Advanced Graymail Protection - Beta) (2026-07-16) Jul 16, 2026 · issue 018

    Sublime Security adds Advanced Graymail Protection (Beta) with ML-based detection, user preference learning, and automated remediation for M365 and Google Workspace.

    ⤢
    └──▷ HOW TO FIND IT
    Enable graymail user preference learning so Sublime personalizes bulk-mail handling per user based on their folder moves.
    📍In the console, go to Admin → Account and enable User Preferences.
    Activate automated graymail remediation to automatically route and manage detected graymail without manual triage.
    📍In the console, activate the Rule Fuzzy Attack Score: Advanced Graymail Detection and the Automation Remediate graymail flagged messages.
    • New dedicated Graymail view separates high-volume non-malicious mail (marketing, newsletters, subscriptions) from other detections across Microsoft 365 and Google Workspace.
    • Adds bi-directional User Preferences: Sublime learns per-user sender preferences when users move messages into or out of Promotions or Junk/Spam and applies them to future messages.
    • Introduces Fuzzy Attack Score, a new ML model that identifies unwanted bulk mail without relying on rigid signatures or sender-specific rules.
    • New Graymail Automation enables automatic routing, triaging, and management of detected graymail via the included Remediate graymail flagged messages automation.
    • New built-in detection rule Fuzzy Attack Score: Advanced Graymail Detection is included and auto-activated for orgs with Automatically Activate New Rules enabled.

    +1 more show less

    • Revamped navigation replaces the Flagged view with Needs Remediation (closest equivalent) and adds Any Rule Match to review all messages matching rules and filters.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Flagged view has been replaced; Needs Remediation is its closest equivalent for reviewing messages awaiting action.
25. Platform v1.85.57 (Multi-Tenant Provisioning APIs) (2026-07-16) Jul 16, 2026 · issue 018

    Sublime Security adds four REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints to create, list, and manage child organizations and their licenses at scale.

    • New GET /v0/organizations/mine/child-organizations endpoint lists all child organizations with license and usage data, supporting status filtering, name search, pagination, and depth traversal.
    • New POST /v0/organizations/mine/child-organizations endpoint creates child organizations and optionally assigns licenses in a single API call.
    • New PUT /v0/organizations/mine/child-organizations/{id}/licensing endpoint updates the license on an individual child organization.
    • New bulk licensing endpoint applies license transitions to up to 200 child organizations at once, enabling automated renewals, upgrades, and offboarding.

    4 details in Everything

26. Platform v1.85.38 (CrowdStrike Falcon Sandbox Integration) (2026-07-13) Jul 13, 2026 · issue 015

    Sublime Security adds CrowdStrike Falcon Sandbox detonation for suspicious emails directly from the message detail view.

    ⤢
    └──▷ HOW TO FIND IT
    Connect your existing CrowdStrike Falcon Sandbox subscription so analysts can detonate suspicious emails without leaving Sublime.
    📍In the Sublime console, go to Account → Sandbox Integrations and enter your CrowdStrike Falcon Sandbox API key to enable the integration.
    Detonate a suspicious message and review the full Falcon verdict without downloading or manually handling the email file.
    📍Open the suspicious message in the Message Detail View, click Send to CrowdStrike Sandbox, then view the verdict and behavioral report in the Sandbox Analysis section once detonation completes.
    • Adds one-click email detonation via CrowdStrike Falcon Sandbox from the message detail view — no manual file handling required.
    • New in-platform Sandbox Analysis section displays verdict (Malicious / Suspicious / Benign) and detonation environment, updating live without a page refresh.
    • One-click pivot opens the full Falcon detonation report — including behavioral indicators, network activity, dropped files, and IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. — in a new tab.
    • Smart deduplication returns existing Falcon analysis results instantly for previously seen samples, preserving sandbox quota.
    • Supports bring-your-own CrowdStrike Falcon Sandbox subscription; admins connect it once under Account → Sandbox Integrations.

    5 details in Everything

27. Platform v1.85 (ASA Context in User Report Auto-Replies) (2026-07-01) Jul 1, 2026 · issue 014

    Sublime Security Platform v1.85 adds AI-generated explanation variable for user report auto-reply templates.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Automatically tell reporters why a message was flagged, in plain language, by adding the ASA summary to your existing auto-reply template.
    📍In the console, go to Actions › Send User Report Result (or Automations › Close the loop with reporter), open your reply template, and insert {{asa_simple_summary}} where you want the AI explanation to appear.
    • Adds {{asa_simple_summary}} template variable that injects a plain-language AI (ASA) classification explanation into user report auto-reply messages.

    1 detail in Everything

28. Platform v1.84.93 (Configure retention for message metadata) (2026-05-26) May 26, 2026 · release notes

    Adds configurable metadata retention (Admin > Account > Full Message Retention) defaulting to 2 years.

    └──▷ HOW TO FIND IT
    Set the global metadata retention to a specific duration via the admin console.
    📍Navigate to Admin › Account › Full Message Retention and set the desired value.
    • Admins can set a retention length for message metadata via Admin > Account > Full Message Retention
    • Message metadata older than the configured value is automatically removed starting June 8, 2026
    • Metadata for flagged and user-reported messages follows their EML retention period instead of the general setting

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !After June 8, 2026, message metadata older than your configured value in Admin > Account > Full Message Retention will be removed
29. Platform v1.84.54 (OpenCTI Connector) (2026-05-15) May 15, 2026 · release notes

    New OpenCTI connector generally available for automatic email threat intel export via STIX2

30. Platform v1.84 (Quarantine Digests) (2026-05-07) May 7, 2026 · release notes

    New Quarantine Digests feature enables visibility into quarantined messages and user release requests.

    • Manage → Quarantine Digests allows configuration of digest delivery frequency (daily or weekly) and recipients (all active mailboxes or specific Lists)
    • Release Requests → Quarantine Digests provides a new area to review and manage user requests
    • Granular access permissions for Quarantine Digests are now available via RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.

    3 details in Everything

31. Platform v1.83.6 (Persistent System Alerts) (2026-05-07) May 7, 2026 · release notes

    Platform v1.83.6 introduces persistent system alerts with Mark all as read management for audit trails.

    └──▷ HOW TO FIND IT
    Bulk-clear the visual notification state of System Alerts while preserving them for later auditing.
    📍In the UI, click Mark all as read in the System Alerts panel.
    • Added Mark all as read button to manage alert status without altering history

    1 detail in Everything

32. Platform v1.83.55 (One-Click Sender Blocklisting) (2026-05-06) May 6, 2026 · release notes

    Platform v1.83.55 introduces one-click sender blocklisting via UI, creating a new blocklisted_senders List and associated Rule for immediate quarantine.

    └──▷ HOW TO FIND IT
    Quarantine a specific sender's future messages immediately from an open investigation without navigating to global settings.
    📍Open the message in Investigation View and click the Block button next to the sender's email address under Message Content
    • Adds a Block button in the investigation view to instantly add or remove senders from the new blocklisted_senders List and trigger the new Blocklisted Senders Rule.

    1 detail in Everything

33. Platform v1.83.31 (Retrieve ASA verdict via API) (2026-04-29) Apr 29, 2026 · release notes

    New GET /v0/:message_id/asa_verdict endpoint allows retrieving ASA verdicts without justification payload

34. Platform v1.83 (Enhanced Reporting and Analytics - General Availability) (2026-04-14) Apr 14, 2026 · release notes

    Sublime Security v1.83 GA release of redesigned reporting with Attack Insights and User Reports Overview exports.

    └──▷ HOW TO FIND IT
    Export raw threat data from Attack Insights for external analysis.
    📍Navigate to Attack Insights › Export › CSV
    Share a polished stakeholder report on user reporting behavior.
    📍Navigate to User Reports Overview › Export › PDF
    • Adds Attack Insights view showing malicious verdicts by Attack Type and tactics
    • Adds User Reports Overview showing user reporting accuracy and automatic remediation stats
    • Enables CSV export for raw data analysis in the new reports
    • Enables PDF export for stakeholder sharing in the new reports

    4 details in Everything