Highly recommend Sublime. No connectors or MX changes required, sits at mailbox level through API connection. Has the ability to scan back and find potential malicious emails that got past your gateway. Not a black box product either, so you can create your own detection rules with MQL, or use community created ones.