Files
securityonion/salt/sensoroni/files/analyzers/sublime
weslambert 7f21bee0d4 Add README
2023-12-06 13:14:17 -05:00
..
2023-12-05 18:31:50 +00:00
2023-12-06 13:14:17 -05:00
2023-12-05 18:31:50 +00:00
2023-12-05 19:55:23 +00:00
2023-12-05 18:36:25 +00:00
2023-12-06 17:37:07 +00:00
2023-12-05 19:55:23 +00:00

Sublime

Description

Submit a base64-encoded EML file to Sublime Platform for analysis.

Configuration Requirements

In SOC, navigate to Administration, toggle Show all configurable settings, including advanced settings., and navigate to sensoroni -> analyzers -> sublime_platform.

image

The following configuration options are available for:

api_key - API key used for communication with the Sublime Platform API (Required)

base_url - URL used for communication with Sublime Platform. If no value is supplied, the default of https://api.platform.sublimesecurity.com will be used.

The following options relate to Live Flow analysis only:

live_flow - Determines if live flow analysis should be used. Defaults to False.

mailbox_email_address - The mailbox address to use for during live flow analysis. (Required for live flow analysis)

message_source_id - The ID of the message source to use during live flow analysis. (Required for live flow analysis)