https://cybertoolchain.io/tools/sublime-security New releases and features in Sublime Security, tracked by The Cyber Toolchain. en Tue, 27 Oct 2026 17:07:56 GMT https://new.sublime.security/platform-v1-90-133-(attack-score-flash)-349685 https://new.sublime.security/platform-v1-90-133-(attack-score-flash)-349685 Tue, 27 Oct 2026 17:07:56 GMT Attack Score Flash is now generally available, adding ML-based threat detection to all inbound mail with Malicious, Suspicious, Spam, and Graymail verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Attack Score Flash to all inbound mail, providing Attack Score-like detections that catch messages existing rules may miss, with high-precision Malicious, Suspicious, Spam, and Graymail verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Promotes 'Potentially Malicious' and 'Spam' detections into the core feed, removing the need for custom rules to use them. • Existing automations triggered on Attack Score verdicts now also act on messages flagged by Attack Score Flash, increasing automated flagged message volume. • Autonomous Security Analyst (ASA) automatically reviews Attack Score Flash 'Suspicious' verdicts via the existing 'Send suspicious messages to ASA' automation. • 'Potentially Malicious' detection is available on Sublime Enterprise only; Attack Score Flash is available on both Sublime-managed cloud and self-hosted deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-90-101-(prompt-injection-detection-public-beta)-349145 https://new.sublime.security/platform-v1-90-101-(prompt-injection-detection-public-beta)-349145 Wed, 21 Oct 2026 18:24:05 GMT Sublime Security adds Prompt Injection Detection (public beta) to catch hidden AI-agent instructions in inbound email.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds beta.prompt_injection_detection() MQL function callable from detection rules to score inbound email for prompt injection attempts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a machine learning model that detects potential prompt injection content hidden in inbound email targeting AI agents such as Copilot and Gemini. • Adds Core feed detection rules covering known prompt injection evasion techniques, including hidden text and obfuscated instructions. • Extends the existing 'Send suspicious messages to ASA' automation to route prompt injection detection matches to the Autonomous Security Analyst (ASA) for confirmation and remediation. • Applies the `Email prompt injection` tag to ASA-confirmed prompt injection attempts, enabling filtering in the Message List View by that tag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-90-8-(flexible-threat-log-views)-348910 https://new.sublime.security/platform-v1-90-8-(flexible-threat-log-views)-348910 Mon, 19 Oct 2026 21:07:55 GMT Threat Log views gain adjustable State and Verdict filters plus a count badge on Needs Review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a message count badge to the 'Needs Review' Threat Log view so unreviewed messages are always visible at a glance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Makes the 'State' filter in 'Needs Remediation' adjustable, letting analysts switch to states like auto-remediated or mixed without leaving the view. • Makes the 'Verdict' filter in 'Needs Review' adjustable, letting analysts find messages with any verdict inside the same view. • Updates default filters: 'Needs Remediation' opens on unreviewed Malicious messages with no remediation actions applied; 'Needs Review' opens on Spam, Unknown, and Suspicious messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-90-79-(attack-score-flash-public-beta)-348908 https://new.sublime.security/platform-v1-90-79-(attack-score-flash-public-beta)-348908 Mon, 19 Oct 2026 20:33:31 GMT Attack Score Flash (public beta) adds beta.attack_score_flash() ML detections to all inbound mail with high-precision verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds beta.attack_score_flash() MQL function (Enterprise-only for malicious/potentially_malicious verdict; all tiers for spam) to evaluate all inbound mail and return verdicts of `malicious`, `potentially_malicious`, `spam`, or `graymail` — enabling detections that can catch messages Attack Score alone may miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables Attack Score Flash beta via custom Detection Rules: use type.inbound and beta.attack_score_flash().verdict in ("malicious", "potentially_malicious") for the Potentially Malicious rule (Enterprise) and `type.inbound and beta.attack_score_flash().verdict == "spam"` for the Spam rule. • Integrates Attack Score Flash verdicts into the existing Attack Score pipeline — `potentially_malicious` flags produce Suspicious or Malicious Attack Score verdicts, `spam` flags produce Spam verdicts, and `graymail` flags produce Graymail verdicts, with ASA automatically reviewing Suspicious messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-90-45-(shared-delegated-calendar-protection)-348567 https://new.sublime.security/platform-v1-90-45-(shared-delegated-calendar-protection)-348567 Wed, 14 Oct 2026 16:49:39 GMT Sublime now detects and removes malicious events from shared and delegated calendars, not just primary mailbox calendars.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `Delete Calendar Events` Action to search all calendars a mailbox has access to, including shared and delegated calendars — not just the primary calendar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Requires Google Workspace customers to grant the additional read-only OAuth scope `https://www.googleapis.com/auth/calendar.calendarlist.readonly` so Sublime can enumerate accessible calendars; Microsoft 365 requires no action. • Automatically applies `Delete Calendar Events` whenever a `Quarantine`, `Trash`, or `Move to Spam` Action is triggered, covering shared and delegated calendar events in the same pass. Breaking changes: • Google Workspace customers must have a super admin grant the new `https://www.googleapis.com/auth/calendar.calendarlist.readonly` scope; without it, expanded shared/delegated calendar protection will not activate. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Sun, 11 Oct 2026 10:01:48 GMT API surface changed: +4 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /v0/dlp/release-requests⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /v0/dlp/release-requests/{id} • New endpoint POST /v0/dlp/release-requests/{id}/approve • New endpoint POST /v0/dlp/release-requests/{id}/deny Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-90-(tailored-phishing-simulations-and-training)-347693 https://new.sublime.security/platform-v1-90-(tailored-phishing-simulations-and-training)-347693 Tue, 06 Oct 2026 12:07:31 GMT Sublime Security adds Tailored Phishing Simulations and Training, turning real detected attacks into employee simulations with immediate contextual training.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Tailored Phishing Simulations and Training, converting attacks detected in your environment into phishing simulations with immediate, context-aware training when employees click.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Integrates phishing simulation and training directly into the existing Sublime platform, eliminating the need for a separate tool to run employee security awareness programs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-89-(data-loss-prevention)-347315 https://new.sublime.security/platform-v1-89-(data-loss-prevention)-347315 Wed, 30 Sep 2026 12:18:08 GMT Sublime Security launches Email DLP with AI-powered triage, pre-delivery blocking, and Purview sensitivity label support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Email DLP (Data Loss Prevention) as a new capability that inspects every outbound message before delivery, with a Sublime-maintained detection feed covering personal, payment, and healthcare data, credentials, and country- and regulation-specific data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Block Delivery` enforcement mode that holds violating outbound messages before they reach the recipient, with senders receiving a plain-language explanation and a one-click unblock request. • Adds ASA (Autonomous Security Analyst) triage for flagged outbound messages, automatically blocking real violations and releasing legitimate mail without manual review. • Adds support for Microsoft Purview sensitivity labels in DLP detections for Microsoft 365 tenants. • Unifies inbound and outbound email security under a single console, with all DLP blocks traceable to readable, adjustable detection logic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-88-278-(expanded-link-exclusions)-346955 https://new.sublime.security/platform-v1-88-278-(expanded-link-exclusions)-346955 Thu, 24 Sep 2026 16:55:28 GMT Link Exclusions now match on path, query params, display text, scheme, or subdomain — not just domain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Link Exclusion scope via `Exclusions > Create` with `Scope` set to `Link`, supporting expressions like `strings.icontains(href_url.path, "/unsubscribe") and href.url.domain.root_domain == "acme.com"`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-88-228-(microsoft365-junk-report-ingestion)-346288 https://new.sublime.security/platform-v1-88-228-(microsoft365-junk-report-ingestion)-346288 Tue, 15 Sep 2026 18:42:27 GMT Sublime Security can now ingest Microsoft 365 Junk reports as user-reported phishing signal without changing end-user workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new opt-in setting under Admin > Account > Abuse Mailbox to ingest Outlook 'Junk' reports as user reports for Microsoft 365 message sources, capturing phishing signal without requiring end-users to use the Report Phishing button.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Sun, 13 Sep 2026 14:46:55 GMT API surface changed: 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /v0/message-groups: param verdict__is_not (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Thu, 10 Sep 2026 14:45:48 GMT API surface changed: 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /v0/message-groups: param verdict__is_not (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Mon, 07 Sep 2026 13:47:15 GMT API surface changed: 1 modified • GET /v0/binexplode/scan/{id}: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Fri, 04 Sep 2026 07:47:53 GMT API surface changed: 1 modified • GET /v0/binexplode/scan/{id}: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Fri, 28 Aug 2026 19:44:18 GMT API surface changed: +5 endpoints, 8 modified • New endpoint DELETE /v0/messages/export/{id} • New endpoint GET /v0/messages/export • New endpoint GET /v0/messages/export/dashboard/{dashboard_type}/estimate • New endpoint GET /v0/messages/export/{id} • New endpoint POST /v0/messages/export/dashboard/{dashboard_type} • GET /v0/binexplode/scan/{id}: response schema changed • GET /v0/message-groups/siem-summary: response schema changed • GET /v0/messages/{id}/message_data_model: response schema changed • POST /v0/enrichment/link_analysis/evaluate: response schema changed • POST /v0/message-groups/{id}/share-with-sublime: request body changed • POST /v0/messages/analyze: request body changed • POST /v0/messages/create: response schema changed • POST /v0/messages/{id}/analyze: request body changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Fri, 14 Aug 2026 09:47:52 GMT API surface changed: +1 endpoint, 7 modified • New endpoint POST /v0/message-groups/move-to-spam • GET /v0/audit-log/events: response schema changed • GET /v0/audit-log/events/{id}: response schema changed • GET /v0/message-groups: param last_created_at__gte (query) added; param last_created_at__lt (query) added • GET /v0/messages/{id}/message_data_model: response schema changed • POST /v0/enrichment/link_analysis/evaluate: response schema changed • POST /v0/message-groups/review: request body changed • POST /v0/messages/create: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://docs.sublime.security/openapi/sublime-platform-api.json https://docs.sublime.security/openapi/sublime-platform-api.json Wed, 05 Aug 2026 00:47:34 GMT API surface changed: 2 deprecated Breaking changes: • Deprecated endpoint GET /v0/message-groups/hunt/{id} (still works) • Deprecated endpoint POST /v0/message-groups/hunt (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v-1-88-(tailored-phishing-simulations-beta)-343413 https://new.sublime.security/platform-v-1-88-(tailored-phishing-simulations-beta)-343413 Mon, 03 Aug 2026 20:09:29 GMT Sublime adds Tailored Phishing Simulations (Beta): environment-prioritized campaigns with staggered delivery and cross-campaign tracking. • New Tailored Phishing Simulations (Beta) lets you run phishing campaigns prioritized by the attack patterns Sublime is already detecting in your environment. • Supports sending multiple templates per campaign with staggered delivery schedules. • Tracks click rates, report rates, and repeat clickers in a cross-campaign dashboard with recipient-level detail per campaign. • Available to all customers during Beta; will move to a paid Sublime Tailored Phishing Simulations and Training add-on at GA — enable by contacting Sublime Support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v-1-88-tailored-phishing-simulations-(beta)-343413 https://new.sublime.security/platform-v-1-88-tailored-phishing-simulations-(beta)-343413 Mon, 03 Aug 2026 20:09:29 GMT Sublime adds Tailored Phishing Simulations (Beta): run campaigns prioritized by attacks already detected in your environment. • New Tailored Phishing Simulations (Beta) lets you run phishing simulation campaigns prioritized by attack patterns Sublime is already detecting in your environment. • Supports multiple templates per campaign with staggered delivery across recipients. • Tracks click rates, report rates, and repeat clickers in a cross-campaign dashboard with recipient-level detail per campaign. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-87-25-(crowdstrike-falcon-next-gen-siem-and-fusion-soar-integrations)-343309 https://new.sublime.security/platform-v1-87-25-(crowdstrike-falcon-next-gen-siem-and-fusion-soar-integrations)-343309 Fri, 31 Jul 2026 20:36:43 GMT Sublime email events now stream into CrowdStrike Falcon Next-Gen SIEM, and Sublime Actions run natively in Falcon Fusion SOAR playbooks. • Streams Sublime email security events (flagged message groups, user-reported messages) into CrowdStrike Falcon Next-Gen SIEM alongside endpoint, identity, and threat intelligence telemetry. • Surfaces per-message triage context in Falcon Next-Gen SIEM: matched Sublime coverage, source IPs, URLs, attachment hashes, link-click activity, and ASA (Autonomous Security Analyst) verdict. • Adds Sublime Actions as native steps in Falcon Fusion SOAR playbooks, enabling message investigation and enrichment, hunt result retrieval, Rule and List management, and remediation without leaving Falcon. • Returns typed output from every Sublime Action in Fusion, allowing downstream playbook steps to branch on results without manual JSON parsing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-87-1-(customer-account-access)-343064 https://new.sublime.security/platform-v1-87-1-(customer-account-access)-343064 Tue, 28 Jul 2026 23:17:03 GMT Sublime adds Customer Account Access controls so admins can govern, audit, and time-limit support sessions in their tenant. • New single admin setting to enable or disable Sublime support access to a customer environment at any time. • Every support session is written to an audit log that admins can view and export for full accountability. • Live banner displayed to Sublime employees working inside a customer tenant, showing the account, role, and active session. • Support sessions auto-expire with a renewal prompt at 10 minutes, limiting unattended access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-87-(advanced-graymail-protection-ga)-343055 https://new.sublime.security/platform-v1-87-(advanced-graymail-protection-ga)-343055 Tue, 28 Jul 2026 19:56:09 GMT Sublime Security's Advanced Graymail Protection is now GA, with automated remediation, fuzzy detection, and per-user preference learning. • Adds Advanced Graymail Protection (GA) to identify and manage marketing emails, newsletters, and subscription content across Microsoft 365 and Google Workspace. • New 'Remediate graymail flagged messages' Automation routes detected graymail to Promotions automatically. • New Rule 'Fuzzy Attack Score: Advanced Graymail Detection' extends graymail detection coverage, designed to pair with the included Automation. • New Graymail User Preferences feature (Admin → Account) learns from users moving messages into or out of Promotions or Junk/Spam and applies sender-level preferences to future messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-86-(advanced-graymail-protection-beta)-342304 https://new.sublime.security/platform-v1-86-(advanced-graymail-protection-beta)-342304 Thu, 16 Jul 2026 20:04:30 GMT Sublime Security adds Advanced Graymail Protection (Beta) with ML-based detection, user preference learning, and automated remediation for M365 and Google Workspace. • New dedicated Graymail view separates high-volume non-malicious mail (marketing, newsletters, subscriptions) from other detections across Microsoft 365 and Google Workspace. • Adds bi-directional User Preferences: Sublime learns per-user sender preferences when users move messages into or out of Promotions or Junk/Spam and applies them to future messages. • Introduces Fuzzy Attack Score, a new ML model that identifies unwanted bulk mail without relying on rigid signatures or sender-specific rules. • New Graymail Automation enables automatic routing, triaging, and management of detected graymail via the included 'Remediate graymail flagged messages' automation. • New built-in detection rule 'Fuzzy Attack Score: Advanced Graymail Detection' is included and auto-activated for orgs with 'Automatically Activate New Rules' enabled. • Revamped navigation replaces the 'Flagged' view with 'Needs Remediation' (closest equivalent) and adds 'Any Rule Match' to review all messages matching rules and filters. Breaking changes: • The 'Flagged' view has been replaced; 'Needs Remediation' is its closest equivalent for reviewing messages awaiting action. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-85-57-(multi-tenant-provisioning-apis)-342294 https://new.sublime.security/platform-v1-85-57-(multi-tenant-provisioning-apis)-342294 Thu, 16 Jul 2026 17:47:31 GMT Sublime Security adds four REST API endpoints to create, list, and manage child organizations and their licenses at scale. • New `GET /v0/organizations/mine/child-organizations` endpoint lists all child organizations with license and usage data, supporting status filtering, name search, pagination, and depth traversal. • New `POST /v0/organizations/mine/child-organizations` endpoint creates child organizations and optionally assigns licenses in a single API call. • New `PUT /v0/organizations/mine/child-organizations/{id}/licensing` endpoint updates the license on an individual child organization. • New bulk licensing endpoint applies license transitions to up to 200 child organizations at once, enabling automated renewals, upgrades, and offboarding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-85-38-(crowdstrike-falcon-sandbox-integration)-341986 https://new.sublime.security/platform-v1-85-38-(crowdstrike-falcon-sandbox-integration)-341986 Mon, 13 Jul 2026 20:00:00 GMT Sublime Security adds CrowdStrike Falcon Sandbox detonation for suspicious emails directly from the message detail view. • Adds one-click email detonation via CrowdStrike Falcon Sandbox from the message detail view — no manual file handling required. • New in-platform Sandbox Analysis section displays verdict (Malicious / Suspicious / Benign) and detonation environment, updating live without a page refresh. • One-click pivot opens the full Falcon detonation report — including behavioral indicators, network activity, dropped files, and IOCs — in a new tab. • Smart deduplication returns existing Falcon analysis results instantly for previously seen samples, preserving sandbox quota. • Supports bring-your-own CrowdStrike Falcon Sandbox subscription; admins connect it once under Account → Sandbox Integrations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-85-(asa-context-in-user-report-auto-replies)-341169 https://new.sublime.security/platform-v1-85-(asa-context-in-user-report-auto-replies)-341169 Wed, 01 Jul 2026 19:55:55 GMT Sublime Security Platform v1.85 adds AI-generated explanation variable for user report auto-reply templates. • Adds `{{asa_simple_summary}}` template variable that injects a plain-language AI (ASA) classification explanation into user report auto-reply messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-84-93-(configure-retention-for-message-metadata)-338576 https://new.sublime.security/platform-v1-84-93-(configure-retention-for-message-metadata)-338576 Tue, 26 May 2026 22:56:43 GMT Adds configurable metadata retention (Admin > Account > Full Message Retention) defaulting to 2 years. • Admins can set a retention length for message metadata via Admin > Account > Full Message Retention • Message metadata older than the configured value is automatically removed starting June 8, 2026 • Metadata for flagged and user-reported messages follows their EML retention period instead of the general setting Breaking changes: • After June 8, 2026, message metadata older than your configured value in 'Admin > Account > Full Message Retention' will be removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-84-54-(opencti-connector)-337859 https://new.sublime.security/platform-v1-84-54-(opencti-connector)-337859 Fri, 15 May 2026 17:14:29 GMT New OpenCTI connector generally available for automatic email threat intel export via STIX2 • `Sublime Security` OpenCTI Connector is generally available, sending flagged detections as STIX2 incident/case objects to correlate email threats with broader telemetry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-84-(quarantine-digests)-337231 https://new.sublime.security/platform-v1-84-(quarantine-digests)-337231 Thu, 07 May 2026 22:56:21 GMT New Quarantine Digests feature enables visibility into quarantined messages and user release requests. • `Manage → Quarantine Digests` allows configuration of digest delivery frequency (daily or weekly) and recipients (all active mailboxes or specific Lists) • `Release Requests → Quarantine Digests` provides a new area to review and manage user requests • Granular access permissions for Quarantine Digests are now available via RBAC Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-83-6-(persistent-system-alerts)-337221 https://new.sublime.security/platform-v1-83-6-(persistent-system-alerts)-337221 Thu, 07 May 2026 20:22:48 GMT Platform v1.83.6 introduces persistent system alerts with 'Mark all as read' management for audit trails. • Added `Mark all as read` button to manage alert status without altering history Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-83-55-(one-click-sender-blocklisting)-337113 https://new.sublime.security/platform-v1-83-55-(one-click-sender-blocklisting)-337113 Wed, 06 May 2026 17:24:27 GMT Platform v1.83.55 introduces one-click sender blocklisting via UI, creating a new 'blocklisted_senders' List and associated Rule for immediate quarantine. • Adds a `Block` button in the investigation view to instantly add or remove senders from the new `blocklisted_senders` List and trigger the new Blocklisted Senders Rule. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-83-31-(retrieve-asa-verdict-via-api)-336694 https://new.sublime.security/platform-v1-83-31-(retrieve-asa-verdict-via-api)-336694 Wed, 29 Apr 2026 15:30:59 GMT New GET /v0/:message_id/asa_verdict endpoint allows retrieving ASA verdicts without justification payload • Adds `GET /v0/:message_id/asa_verdict` API endpoint to retrieve ASA verdicts without requiring justification in the request payload Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security https://new.sublime.security/platform-v1-83-(enhanced-reporting-and-analytics-general-availability)-335777 https://new.sublime.security/platform-v1-83-(enhanced-reporting-and-analytics-general-availability)-335777 Tue, 14 Apr 2026 17:37:03 GMT Sublime Security v1.83 GA release of redesigned reporting with Attack Insights and User Reports Overview exports. • Adds `Attack Insights` view showing malicious verdicts by Attack Type and tactics • Adds `User Reports Overview` showing user reporting accuracy and automatic remediation stats • Enables CSV export for raw data analysis in the new reports • Enables PDF export for stakeholder sharing in the new reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sublime-security