TLDR Tech / InfoSec
How We Built High Speed Threat Hunting For Email Security
Sublime Security utilizes a domain-specific language called Message Query Language (MQL) to enable both historical threat hunting and detection backtesting in its email security platform. Sublime splits hunts into a candidate selection phase and an evaluation phase so that cheap MQL operations can be run first, and only after results are pruned are expensive operations run. The article shows how a hunt progresses using a sample query searching for all unsolicited messages with PayPal invoices attached in October 2025.
Read the full story