Message Ingestion And Eml Analysis

Operator submits a raw .eml file (RFC 5322 message) to Sublime for analysis to see which rules match and what signals fire, outside the live mailbox flow.

Submit the full raw .eml (headers + MIME parts) so Sublime parses the complete message data model — truncating to body-only loses headers, auth results, and attachments that detections depend on. Read back the structured analysis (matched rules, parsed attributes, signals) rather than re-parsing th…

A message is ingested and evaluated, but a link's detonation verdict only becomes available seconds later. Operator's rule logic assumes all enrichment is present at first evaluation.

Account for enrichment that resolves asynchronously: design so a message can be (re)evaluated when a late signal (detonation verdict, sandbox result) arrives, or so the action is taken post-delivery when the verdict lands. Do not assume every signal is synchronously available at ingest. [REQUIRES-V…

A message has a multipart/alternative body (text + HTML) plus a message/rfc822 attachment that itself contains a malicious link in its HTML part. Operator's rule only inspects the top-level HTML body.

Rely on Sublime's recursive MIME parsing so nested message/rfc822 parts, alternative bodies, and inline content are all represented in the data model, and write rules that consider attached messages and all body alternatives — not just the top-level HTML. Attackers nest payloads in forwarded/attach…