Sublime Security medium experimental mql

New sender domain (<=10d) from untrusted sender

Detects inbound emails where the sender domain is less than 10 days old from untrusted senders.

View Source

Detection Logic

type.inbound
and network.whois(sender.email.domain).days_old <= 10
and not profile.by_sender().solicited

Field Validations

Loading…

Comments (0)

Loading comments...