---
title: "Analyze a raw message"
method: POST
path: "/v0/messages/analyze"
tags: ["Messages"]
---

# Analyze a raw message

`POST /v0/messages/analyze`

Analyze a raw message with provided rules and/or active rules in your Sublime organization. Note: All messages will be treated as inbound.

## Request body

- AnalyzeMessageInput
  - `queries` HandlerTypesQuerySimple[] — Queries to analyze
    - `name` string, nullable — Query name
    - `severity` string, nullable — Severity associated with the query
    - `source` string, nullable, required — The MQL source to run against the message
  - `raw_message` string, byte, required — The full base64 encoded raw eml message
  - `rules` HandlerTypesRuleSimple[] — Rules to analyze
    - `active` boolean — Whether the rule is active
    - `feed_id` string, nullable — Feed ID associated with the rule
    - `name` string, nullable — Rule name
    - `severity` string, nullable — Severity associated with the rule
    - `source` string, required — The MQL source to run against the message
  - `run_active_detection_rules` boolean — Whether to analyze the message with all active detection rules in your organization
  - `run_all_detection_rules` boolean — Whether to analyze with all detection rules from all Feeds, including uninstalled + inactive Feed rules, as well as any active detection rules you’ve created that are not part of a Feed.
  - `run_all_insights` boolean — Whether to analyze with all insights

## Response `200`

OK

- HandlerTypesAnalyzeRawMessageResponse
  - `query_results` HandlerTypesAnalyzeResponseQuery[] — Query result details
    - `error` string, nullable — Error message, if success == false
    - `execution_time` number, double, nullable, required — Execution time in seconds
    - `external_errors` string[] — External errors that occurred during evaluation
    - `query` HandlerTypesQuerySimpleMeta — Metadata about the query evaluated against the message
      - `name` string, nullable — Query name
      - `severity` string, nullable — Severity associated with the query
      - `source` string, nullable — Query source
    - `result` unknown
    - `success` boolean, required — Whether execution was successful or errored
  - `rule_results` HandlerTypesAnalyzeResponseRule[] — Analyze result details
    - `error` string, nullable — Error message, if success == false
    - `execution_time` number, double, nullable, required — Execution time in seconds
    - `external_errors` string[] — External errors that occurred during evaluation
    - `matched` boolean, nullable, required — Whether the rule matched the provided message
    - `rule` HandlerTypesRuleSimplePublicID — Metadata for the rule compared against the message
      - `id` string, nullable — Rule ID
      - `name` string, nullable — Rule name
      - `severity` string, nullable — Severity associated with the rule
      - `source` string, required — The MQL source for the rule
    - `success` boolean, required — Whether execution was successful or errored

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/versions/d5df82850357/schema)