How do I whitelist in Sublime Security?

Overview

Sublime detects and quarantines Right-Hand phishing simulations before they reach users. This Global Exclusion - evaluated before all Detection Rules and Automations - delivers your simulations untouched while real threats are still inspected.

It matches two signals together: your tenant-unique X-RHS-TID header (the anti-spoof anchor) and a known Right-Hand sending domain.

Prerequisites

An administrator account, or any role granted permission to create and edit Exclusions and Lists in Sublime Security.
A connected Microsoft 365 or Google Workspace message source.
Your tenant's X-RHS-TID header.
You can ask for the custom header, which is associated with your company tenant in the Right-Hand portal, from your customer success manager. Alternatively, you can mail [email protected] to get the same. It has the format X-RHS-TID<unique hash>.

Step-by-Step Instructions

Step 1: Create reusable Lists for your Right-Hand values

Storing your domains and IPs in named Lists keeps the Exclusion readable and easy to update later.

1.1 Log in to your Sublime Security instance. Go to Lists (left sidebar → Manage → Lists).

1.2 Select Create New List, name it righthand_sim_domains, and add each Right-Hand sending domain as an entry.

For the updated list of all our phishing simulation sending domains, please refer to our Whitelisting best practices article.

Note: The screenshot below is a point-in-time snapshot. For the authoritative, up-to-date list of domains, always check the Whitelisting best practices article - not the screenshot.

Click Create.

1.3 (Optional, for the IP hardening layer) Create a second List named righthand_sim_ips and add Right-Hand's sending IP addresses.

For the updated list of all our phishing simulation sending IP addresses, please refer to our Whitelisting best practices article.

Add 52.76.252.34 only if your organization sends Right-Hand mail through its own SMTP relay. If you're unsure whether this applies to you, check with your customer success manager.

Expected result: Your Lists appear on the Lists page and can be referenced in MQL as $righthand_sim_domains and $righthand_sim_ips.

Step 2: Create the Exclusion

2.1 Go to Exclusions (left sidebar → Manage → Exclusions).

2.2 Select New Exclusion (top right).

2.3 on the Exclusion Details form, in the Name field, enter Right-Hand phishing simulation. Set Scope to Global.

Expected result: The Exclusion Details form is open, with Name, Scope, Description, and an MQL editor below.

Step 3: Add the matching logic

Clear out the existing message in the editor window and paste the following MQL into the editor. Replace <your tenant hash> with your tenant's X-RHS-TID value (from your Customer Success Manager):

type.inbound
and any(headers.hops,
    any(.fields,
        .name =~ "x-rhs-tid"
        and .value == "<your tenant hash>"
    )
)
and sender.email.domain.root_domain in $righthand_sim_domains

Optional enhancements

IP hardening

To also require that the message came from a Right-Hand sending IP, add this condition. It uses the variadic form of strings.contains, which checks the header value against every IP in your list:

and any(headers.hops,
    any(.fields,
        .name == "Received"
        and strings.contains(.value, $righthand_sim_ips)
    )
)

Step 4: Save and activate

4.1 Click Save.

4.2 After the Exclusion is saved, toggle the Active button in the top right corner to activate it.

4.3 Confirm the Status column shows Active on the Exclusions list.

Expected result: From this point on, messages that match all conditions bypass every Detection Rule and Automation.

Validation

Test before your next campaign: Find Threats → EML Analyzer, download a real sim .eml from your inbox and upload it, then Send EML to Rule Editor and run your MQL.

A real Right-Hand sim should match.
A Right-Hand-domain message with no X-RHS-TID header should not match.

Testing note: If the rule editor / EML Analyzer shows "Message did not flag," it's because custom Lists aren't loaded in the sandbox - $righthand_sim_domains evaluates as empty. To test, use this version with the domains inline:

type.inbound and any(headers.hops, any(.fields, .name =~ "x-rhs-tid" and .value == "<your tenant hash>")) and sender.email.domain.root_domain in ("right-hand.ai", "linktosso.com", "resetlogin.com", "account-protect.me", "micrrosotf.com", "linktologin.com", "grnaill.com", "mailboxaccess.com", "linkdinapp.com", "micosot.com", "login-sso.com")

Then save the Exclusion with $righthand_sim_domains - it resolves normally in production.

Troubleshooting & rollback

Issue	Fix
Sim still quarantined	Test in the rule editor and check which condition fails.
Rejected on save	Remove any enrichment function; they aren't allowed in Exclusions.
Legit mail excluded	Ensure both conditions are ANDed - the header must be required with the domain.

Rollback: on the Exclusions list, select it → Manage → Deactivate (or Delete). Restore any wrongly-quarantined mail from its message details page.

Best practices

Always pair the header with the domain - never allowlist a Right-Hand domain alone.
Limit Exclusion and List management to admins; recheck Right-Hand's domains and IPs periodically.