Sublime

Reference for the Tracecat Sublime integration: registered actions, required secrets, expected inputs, and example workflow usage.

Activate rule

Action ID: tools.sublime.activate_rule

Activate a Sublime rule.

Reference: https://docs.sublime.security/reference/activaterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Add list entry

Action ID: tools.sublime.add_list_entry

Add an entry to a Sublime list.

Reference: https://docs.sublime.security/reference/addlistentry-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Analyze EML

Action ID: tools.sublime.analyze_eml

Analyze an EML message against active detection rules and ML attack score in Sublime.

Reference: https://docs.sublime.security/reference/analyzemessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

eml_base64 · string · required

Base64-encoded EML file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Analyze EML with the free analyzer

Action ID: tools.sublime.eml_analyze

Analyze a raw message with the free, unauthenticated Sublime EML Analyzer API.

Reference: https://docs.sublime.security/reference/analysis-api-introduction

Input fields

payload · object · required

API-native analyze request containing raw_message and optional rules or queries.

base_url · string

Base URL of the Sublime EML Analyzer API.

Default: "https://analyzer.sublime.security".

Analyze message by ID

Action ID: tools.sublime.analyze_message_by_id

Analyze an existing Sublime message with API-native rules or queries.

Reference: https://docs.sublime.security/reference/analyzemessagebyid

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Analyze URL

Action ID: tools.sublime.analyze_url

Analyze a URL with ML link analysis in Sublime.

Reference: https://docs.sublime.security/docs/enrichment-functions#mllink_analysis

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

url · string · required

URL to analyze.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Attack score for message

Action ID: tools.sublime.attack_score_for_message

Evaluate the attack score of an existing Sublime message.

Reference: https://docs.sublime.security/reference/attackscoreformessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Attack score for raw message

Action ID: tools.sublime.score_eml

Evaluate the Sublime attack score for a base64-encoded raw EML message.

Reference: https://docs.sublime.security/reference/attackscoreforrawmessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

eml_base64 · string · required

Base64-encoded EML file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

BinExplode file

Action ID: tools.sublime.binexplode

Submit a base64-encoded file to Sublime BinExplode and return the task response.

Reference: https://docs.sublime.security/reference/postscan-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

file_contents · string · required

Base64-encoded raw file contents.

file_name · string · required

Name of the submitted file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create email bomb

Action ID: tools.sublime.create_email_bomb

Declare a mailbox time range as a Sublime email bomb.

Reference: https://docs.sublime.security/reference/createemailbomb

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create list

Action ID: tools.sublime.create_list

Create a Sublime list.

Reference: https://docs.sublime.security/reference/createlist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create message

Action ID: tools.sublime.create_message

Create a Sublime message data model from a raw message.

Reference: https://docs.sublime.security/reference/createmessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Create rule

Action ID: tools.sublime.create_rule

Create a Sublime detection, DLP, or triage rule.

Reference: https://docs.sublime.security/reference/createrule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Deactivate rule

Action ID: tools.sublime.deactivate_rule

Deactivate a Sublime rule.

Reference: https://docs.sublime.security/reference/deactivaterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Delete list

Action ID: tools.sublime.delete_list

Delete a Sublime list.

Reference: https://docs.sublime.security/reference/deletelist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Delete list entry

Action ID: tools.sublime.delete_list_entry

Delete an entry from a Sublime list.

Reference: https://docs.sublime.security/reference/deletelistentry-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Delete rule

Action ID: tools.sublime.delete_rule

Delete a Sublime rule.

Reference: https://docs.sublime.security/reference/deleterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Dismiss email bomb

Action ID: tools.sublime.dismiss_email_bomb

Dismiss a Sublime email-bomb incident.

Reference: https://docs.sublime.security/reference/dismissemailbomb

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Email bomb ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Dismiss message group

Action ID: tools.sublime.dismiss_message_canonical_group

Dismiss a Sublime message group and its future messages.

Reference: https://docs.sublime.security/reference/dismissmessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Dismiss multiple message groups

Action ID: tools.sublime.dismiss_multiple_message_groups

Dismiss multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/dismissmultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get BinExplode scan

Action ID: tools.sublime.get_binexplode_scan

Retrieve the current status and results of a Sublime BinExplode task.

Reference: https://docs.sublime.security/reference/getscan-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

BinExplode task ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get email bomb

Action ID: tools.sublime.get_email_bomb

Retrieve a Sublime email-bomb incident.

Reference: https://docs.sublime.security/reference/getemailbomb

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Email bomb ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get hunt job

Action ID: tools.sublime.get_hunt_job

Retrieve the current state and summary of a Sublime hunt job.

Reference: https://docs.sublime.security/reference/gethuntjob

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Hunt job ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get hunt job results

Action ID: tools.sublime.get_hunt_job_results

Retrieve detailed results for a Sublime hunt job.

Reference: https://docs.sublime.security/reference/gethuntjobresults

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Hunt job ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get list

Action ID: tools.sublime.get_list

Retrieve a Sublime list.

Reference: https://docs.sublime.security/reference/getlist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get list entries

Action ID: tools.sublime.get_list_entries

Retrieve all entries in a Sublime list.

Reference: https://docs.sublime.security/reference/getlistentries-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get list entry

Action ID: tools.sublime.get_list_entry

Check for and retrieve an entry in a Sublime list.

Reference: https://docs.sublime.security/reference/getlistentry-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get lists

Action ID: tools.sublime.get_lists

Retrieve Sublime lists using API-native filters.

Reference: https://docs.sublime.security/reference/getlists-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get message

Action ID: tools.sublime.get_message

Retrieve a Sublime message.

Reference: https://docs.sublime.security/reference/getmessage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get message attachment image

Action ID: tools.sublime.get_message_attachment_image

Retrieve rendered images for a PDF attachment by MD5 hash.

Reference: https://docs.sublime.security/reference/getmessageattachmentimage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

hash · string · required

MD5 hash of the attachment.

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get message data model

Action ID: tools.sublime.get_message_data_model

Retrieve the Message Data Model for a Sublime message.

Reference: https://docs.sublime.security/reference/getmessagedatamodel-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get message EML

Action ID: tools.sublime.get_message_eml

Retrieve the raw EML for a Sublime message.

Reference: https://docs.sublime.security/reference/getmessageeml

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get message group

Action ID: tools.sublime.get_message_group

Retrieve a Sublime message group.

Reference: https://docs.sublime.security/reference/getmessagegroup

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get message group action state

Action ID: tools.sublime.get_message_canonical_group_action_state

Retrieve manual action state for a canonical message group.

Reference: https://docs.sublime.security/reference/getmessagecanonicalgroupactionstate

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get message group SIEM summary

Action ID: tools.sublime.get_message_group_siem_summary

Retrieve the reduced-field SIEM summary of flagged message groups.

Reference: https://docs.sublime.security/reference/getmessagegroupsiemsummary

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get message image

Action ID: tools.sublime.get_message_image

Retrieve rendered images for a Sublime message.

Reference: https://docs.sublime.security/reference/getmessageimage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get message image link

Action ID: tools.sublime.get_message_image_link

Retrieve a temporary link to a rendered Sublime message image.

Reference: https://docs.sublime.security/reference/getmessageimagelink-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get rule

Action ID: tools.sublime.get_rule

Retrieve a Sublime rule.

Reference: https://docs.sublime.security/reference/getrule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Get rule history

Action ID: tools.sublime.get_rule_history

Retrieve history for a Sublime rule.

Reference: https://docs.sublime.security/reference/getrulehistory

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Get task

Action ID: tools.sublime.get_task

Retrieve the current status of a Sublime task.

Reference: https://docs.sublime.security/reference/gettask-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime task ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Graymail multiple message groups

Action ID: tools.sublime.graymail_multiple_message_groups

Move multiple Sublime message groups to Graymail.

Reference: https://docs.sublime.security/reference/graymailmultiplemessagegroups

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

List email bombs

Action ID: tools.sublime.list_email_bombs

List Sublime email-bomb incidents using API-native filters.

Reference: https://docs.sublime.security/reference/listemailbombs

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

List mailboxes

Action ID: tools.sublime.list_mailboxes

List Sublime mailboxes using API-native filters.

Reference: https://docs.sublime.security/reference/listmailboxes

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

List message groups

Action ID: tools.sublime.list_message_groups

List Sublime message groups using API-native filters.

Reference: https://docs.sublime.security/reference/listmessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

List rule history

Action ID: tools.sublime.list_rule_history

List history across Sublime rules using API-native filters.

Reference: https://docs.sublime.security/reference/listrulehistory

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

List rules

Action ID: tools.sublime.list_rules

List Sublime rules using API-native filters.

Reference: https://docs.sublime.security/reference/listrules-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

List user reports

Action ID: tools.sublime.list_user_reports

List Sublime user-reported messages using API-native filters.

Reference: https://docs.sublime.security/reference/listuserreports

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Patch list

Action ID: tools.sublime.patch_list

Update a Sublime list with an API-native patch body.

Reference: https://docs.sublime.security/reference/patchlist-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Perform message actions

Action ID: tools.sublime.action_message

Perform API-native actions on an individual Sublime message.

Reference: https://docs.sublime.security/reference/actionmessage

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Quarantine message group

Action ID: tools.sublime.quarantine_message_canonical_group

Quarantine a Sublime message group and its future messages.

Reference: https://docs.sublime.security/reference/quarantinemessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Quarantine multiple message groups

Action ID: tools.sublime.quarantine_multiple_message_groups

Quarantine multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/quarantinemultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Render attachment image

Action ID: tools.sublime.get_message_attachment_image_raw

Render images from a base64-encoded raw attachment.

Reference: https://docs.sublime.security/reference/getmessageattachmentimageraw-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Restore message

Action ID: tools.sublime.restore_message

Restore a previously remediated Sublime message.

Reference: https://docs.sublime.security/reference/restoremessage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Restore message group

Action ID: tools.sublime.restore_message_canonical_group

Restore a Sublime message group and disable future remediation.

Reference: https://docs.sublime.security/reference/restoremessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Restore multiple message groups

Action ID: tools.sublime.restore_multiple_message_groups

Restore multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/restoremultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Retrieve ASA report

Action ID: tools.sublime.retrieve_asa_report

Retrieve the Autonomous Security Analyst report for a message.

Reference: https://docs.sublime.security/reference/retrieveasareport

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Retrieve ASA verdict

Action ID: tools.sublime.retrieve_asa_verdict

Retrieve the Autonomous Security Analyst verdict for a message.

Reference: https://docs.sublime.security/reference/retrieveasaverdict

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Review message groups

Action ID: tools.sublime.review_message_groups

Review, classify, and take actions on Sublime message groups.

Reference: https://docs.sublime.security/reference/reviewmessagegroups

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Scan file with BinExplode

Action ID: tools.sublime.scan_file

Scan a file with BinExplode and return the completed scan results.

Reference: https://docs.sublime.security/reference/postscan-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

file_base64 · string · required

Base64-encoded file.

file_name · string · required

Name of the file.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Search message groups

Action ID: tools.sublime.search_message_groups

Search Sublime message groups using API-native query parameters.

Reference: https://docs.sublime.security/reference/searchmessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

base_url · string | null

Base URL of the Sublime API.

Default: null.

params · object | null

API-native query parameters.

Default: null.

Set list entries

Action ID: tools.sublime.set_list_entries

Replace all entries in a Sublime list.

Reference: https://docs.sublime.security/reference/setlistentries-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

List ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Set message access justification

Action ID: tools.sublime.set_message_access_justification

Set the message-content access justification for the API user.

Reference: https://docs.sublime.security/reference/setmessageaccessjustification-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Share message group with Sublime

Action ID: tools.sublime.share_with_sublime_public

Share a message group with the Sublime team.

Reference: https://docs.sublime.security/reference/sharewithsublimepublic-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Start hunt job

Action ID: tools.sublime.start_hunt_job

Start an asynchronous Sublime hunt job.

Reference: https://docs.sublime.security/reference/starthuntjob

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Trash message

Action ID: tools.sublime.trash_message

Trash an individual Sublime message.

Reference: https://docs.sublime.security/reference/trashmessage-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime message ID.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Trash message group

Action ID: tools.sublime.trash_message_canonical_group

Trash a Sublime message group and its future messages.

Reference: https://docs.sublime.security/reference/trashmessagecanonicalgroup-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Message group canonical ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Trash multiple message groups

Action ID: tools.sublime.trash_multiple_message_groups

Trash multiple Sublime message groups.

Reference: https://docs.sublime.security/reference/trashmultiplemessagegroups-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Update rule

Action ID: tools.sublime.update_rule

Replace a Sublime rule definition.

Reference: https://docs.sublime.security/reference/updaterule-1

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

id · string · required

Sublime rule ID.

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.

Validate rule

Action ID: tools.sublime.validate_rule

Validate an API-native Sublime rule definition.

Reference: https://docs.sublime.security/reference/validaterule

Secrets

Required secrets:

• sublime: required values SUBLIME_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Base URL of the Sublime API.

Default: null.