Files
securityonion/salt/sensoroni/files/analyzers/sublime
Mike Reeves 625bfb3ba7 Rebuild analyzer source-packages wheels for Python 3.14
The so-soc Dockerfile base image moved to python:3.14.3-slim but
analyzer source-packages still contained cp313 wheels for pyyaml and
charset_normalizer, causing pip install failures at container startup.

Replace all cp313 wheels with cp314 builds (pyyaml 6.0.3,
charset_normalizer 3.4.6) across all 14 analyzers and update the
CI python-test workflow to match.
2026-03-16 18:58:23 -04:00
..
2023-12-05 18:31:50 +00:00
2026-03-05 11:05:19 -05:00
2023-12-05 18:31:50 +00:00
2023-12-05 19:55:23 +00:00
2023-12-05 18:36:25 +00:00
2023-12-06 17:37:07 +00:00
2023-12-05 19:55:23 +00:00

Sublime

Description

Submit a base64-encoded EML file to Sublime Platform for analysis.

Configuration Requirements

In SOC, navigate to Administration, toggle Show all configurable settings, including advanced settings., and navigate to sensoroni -> analyzers -> sublime_platform.

image

The following configuration options are available for:

api_key - API key used for communication with the Sublime Platform API (Required)

base_url - URL used for communication with Sublime Platform. If no value is supplied, the default of https://api.platform.sublimesecurity.com will be used.

The following options relate to Live Flow analysis only:

live_flow - Determines if live flow analysis should be used. Defaults to False.

mailbox_email_address - The mailbox address to use for during live flow analysis. (Required for live flow analysis)

message_source_id - The ID of the message source to use during live flow analysis. (Required for live flow analysis)