Attack Surface Reduction And Hunting

After IOC disclosure (a sender domain + a subject pattern), an analyst runs an ad-hoc MQL query across stored historical messages to find prior delivery of the same campaign.

Express the hunt as an MQL query over the message store, scoped to a time window, combining the IOC domain with a structural signal so the hunt is precise. Export matches for remediation rather than eyeballing. Treat the hunt query as reusable — promote a high-value one to a standing rule. [REQUIRE…

A single confirmed phishing detection reveals a sending IP and a payload URL host. Analyst wants to find every related message across the org.

Pivot on the strong, attacker-costly indicators (sending infrastructure, payload host, distinctive headers) rather than the easily-changed ones (display name, subject). Run the pivot as a hunt and feed confirmed clusters into a remediation batch. Capture the pivot as a saved query for the next wave.

Leadership asks 'how much credential-phishing targeting finance did we see this quarter, and what got through?' Analyst needs an aggregate, not per-message triage.

Use Sublime's aggregate insights/reporting over the detection corpus, grouped by attack type and recipient population and outcome (detected vs delivered vs remediated), to answer exposure questions. Distinguish 'detected' from 'remediated' from 'delivered un-actioned' — they are different risk stat…