Feeds And Open Rule Ecosystem

Operator imports rules from the public sublime-security/sublime-rules GitHub feed and enables all of them in active/blocking mode on day one.

Import community feed rules into a passive state first, observe each rule's hit/false-positive profile against this org's mail, then selectively promote high-precision ones to active. The open feed is broad coverage, not a pre-tuned blocklist for your tenant. Pin the imported version for reproducib…

Operator edits an imported feed rule in place to add a local exclusion. The next feed sync conflicts with the local edit.

Keep local customizations separable from upstream feed rules (a layered exclusion or a clearly-forked copy) so a feed update does not clobber local tuning and a local edit does not block upstream improvements. Treat it like managing a fork: rebase intentionally, do not hand-merge silently.

Operator imported the feed six months ago and has not synced since. New attacker techniques disclosed in the feed are not covered.

Sync feed updates on a regular cadence so newly-added community rules and improvements land, re-running the passive→active observation for genuinely new rules. Diff incoming changes rather than blind-overwriting local tuning. Detection content is perishable. [REQUIRES-VERIFICATION] for the supporte…