Abnormal Security

The Abnormal Security connector enables automated interaction with the Abnormal Security platform, facilitating threat detection, case management, and incident analysis.

Abnormal Security offers a cutting-edge email security platform that leverages behavioral data science to identify and block modern email attacks. This connector enables Swimlane Turbine users to automate the retrieval and management of threat intelligence, case details, and email security incidents directly within the Swimlane ecosystem. By integrating with Abnormal Security, users can streamline their security operations, enhance incident response, and leverage detailed threat insights to protect against sophisticated email-based threats.

Limitations

None to date.

Supported Versions

This Abnormal Security Connector uses the latest Version API.

Prerequisites

Before utilizing the Abnormal Security connector for Swimlane Turbine, ensure you have the following prerequisites:

HTTP Bearer Authentication with the following parameters:

URL: Endpoint for the Abnormal Security API

Authentication Token: Secure token used for authenticating API requests

Authentication Methods

The Abnormal Security HTTP Bearer Authentication connector uses the HTTP Bearer Authentication method to connect to the Abnormal Security API.

The following are required to set up the asset:

Token: The Token generated from Abnormal Security HTTP Bearer Authentication.

URL: The URL endpoint for the Abnormal Security HTTP Bearer Authentication API.

Capabilities

Abuse Campaigns List

Campaign Details

Case Action Status

Case Analysis

Case Details

Case Management

Detection 360 Reports

Download a Message in EML Format

Download the Attachment in an Email as a File

Employee Genome Analysis

Employee Information

Get Attachment

Get Details of the Remediation History

List Vendors

Non-analyzed Messages ... and so on

Action Setup

Get Threats

Note: The input parameter Filter is an OData based filter which only supports two values: attackType and attackedParty.

To filter threats to only those with extortion intent use attackType+eq+'Extortion'

To filter threats to only received by VIPs in your organization use attackedParty+eq+'VIP'

See the following for more information:

OData Based Filters

Abnormal Security Swagger API Documentation

Notes

Product version tested against: 1.10.0

Additional Documentation

Abnormal Security Connector Documentation

Abnormal Security API Documentation

Abnormal Security Authentication Guide

Configurations

Abnormal Security HTTP Bearer Authentication

Authenticates using bearer token.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API Token	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Download a Message in EML Format

Retrieve an email message in EML format from Abnormal Security using the specified message ID.

Endpoint

URL: /messages/{{message_id}}/download

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.message_id	number	Required	The ABX Message ID of a message.

Input Example

{"path_parameters":{"message_id":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachments
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"file":{"file":"string","file_name":"Example Name"}}

Download the Attachment in an Email as a File

Downloads a specified attachment from an email in Abnormal Security using the message ID and attachment name.

Endpoint

URL: /messages/{{message_id}}/attachment/{{attachment_name}}/download

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.message_id	number	Required	The ABX Message ID of a message.
path_parameters.attachment_name	string	Required	The attachment name of an attachment belonging to an email message.
headers	object	Optional	HTTP headers for the request
headers.mock-data	string	Optional	Returns test data if set to True.

Input Example

{"path_parameters":{"message_id":123,"attachment_name":"Example Name"},"headers":{"mock-data":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachments
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"file":{"file":"string","file_name":"Example Name"}}

Campaign Details

Retrieve detailed information about an Abuse Mailbox campaign by its unique ID in Abnormal Security.

Endpoint

URL: /v1/abusecampaigns/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Campaign Details action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"id":"id"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
campaignId	string	Unique identifier
firstReported	string	Output field: firstReported
lastReported	string	Output field: lastReported
messageId	string	Unique identifier
subject	string	Output field: subject
fromName	string	Name of the resource
fromAddress	string	Output field: fromAddress
recipientName	string	Name of the resource
recipientAddress	string	Output field: recipientAddress
judgementStatus	string	Status value
overallStatus	string	Status value
attackType	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"campaignId":"fff51768-c446-34e1-97a8-9802c29c3ebd","firstReported":"2020-11-11T13:11:40-08:00","lastR...

Abuse Campaigns List

Retrieve a list of reported campaigns from the Abuse Mailbox in Abnormal Security.

Endpoint

URL: /v1/abusecampaigns

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Parameters for the Abuse Campaigns List action
parameters.sender	string	Optional	Parameters for the Abuse Campaigns List action
parameters.recipient	string	Optional	Parameters for the Abuse Campaigns List action
parameters.subject	string	Optional	Parameters for the Abuse Campaigns List action
parameters.reporter	string	Optional	Parameters for the Abuse Campaigns List action
parameters.attackType	string	Optional	Parameters for the Abuse Campaigns List action
parameters.threatType	string	Optional	Parameters for the Abuse Campaigns List action
parameters.pageSize	number	Optional	Parameters for the Abuse Campaigns List action
parameters.pageNumber	number	Optional	Parameters for the Abuse Campaigns List action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"parameters":{"filter":"lastReportedTime gte 2020-01-01T00:00:00Z lte 2021-12-01T00:00:00Z","sender":"sender","recipient":"recipient","subject":"subject","reporter":"reporter","attackType":"attackType","threatType":"threatType","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
campaigns	array	Output field: campaigns
campaigns.campaignID	string	Unique identifier
pageNumber	number	Output field: pageNumber
nextPageNumber	number	Output field: nextPageNumber

Output Example

Get Attachment in an Email Message

Retrieves the details of a specified attachment from an email message in Abnormal Security using the message ID and attachment name.

Endpoint

URL: /messages/{{message_id}}/attachment/{{attachment_name}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.message_id	number	Required	The ABX Message ID of a message.
path_parameters.attachment_name	string	Required	The attachment name of an attachment belonging to an email message.
headers	object	Optional	HTTP headers for the request
headers.mock-data	string	Optional	Returns test data if set to True.

Input Example

{"path_parameters":{"message_id":123,"attachment_name":"Example Name"},"headers":{"mock-data":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
attachmentName	string	Name of the resource
type	string	Type of the resource
details	array	Output field: details
md5	string	Output field: md5
sha1	string	Output field: sha1
sha256	string	Output field: sha256
size	string	Output field: size
createdOn	string	Output field: createdOn
lastUpdated	string	Output field: lastUpdated
url	array	URL endpoint for the request
keyPhrases	array	Output field: keyPhrases

Output Example

{"attachmentName":"Example Name","type":"string","details":["string"],"md5":"string","sha1":"string","sha256":"string","size":"string","createdOn":"string","lastUpdated":"string","url":["string"],"keyPhrases":["string"]}

Case Details

Retrieve detailed case information from Abnormal Security using a specific case ID.

Endpoint

URL: /v1/cases/{{caseId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Case Details action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"caseId":"caseId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
caseId	string	Unique identifier
severity	string	Output field: severity
affectedEmployee	string	Output field: affectedEmployee
firstObserved	string	Output field: firstObserved
threatIds	array	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"caseId":"1234","severity":"Potential Account Takeover","affectedEmployee":"FirstName LastName","first...

Case Action Status

Check the status of a specific action on a case using the case ID and action ID in Abnormal Security.

Endpoint

URL: /v1/cases/{{caseId}}/actions/{{actionId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Case Action Status action
path_parameters.actionId	string	Required	Parameters for the Case Action Status action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"caseId":"caseId","actionId":"actionId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
description	string	Output field: description

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"status":"acknowledged","description":"The request was completed successfully"}}

Case Analysis

Retrieve a detailed analysis and timeline for a specific case in Abnormal Security using the unique case ID.

Endpoint

URL: /v1/cases/{{caseId}}/analysis

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Case Analysis action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"caseId":"caseId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
insights	array	Output field: insights
insights.signal	string	Output field: insights.signal
insights.description	string	Output field: insights.description
eventTimeline	array	Output field: eventTimeline
eventTimeline.event_timestamp	string	Output field: eventTimeline.event_timestamp
eventTimeline.category	string	Output field: eventTimeline.category
eventTimeline.title	string	Output field: eventTimeline.title
eventTimeline.field_labels	object	Output field: eventTimeline.field_labels
eventTimeline.ip_address	string	Output field: eventTimeline.ip_address
eventTimeline.location	object	Output field: eventTimeline.location
eventTimeline.location.city	string	Output field: eventTimeline.location.city
eventTimeline.location.state	string	Output field: eventTimeline.location.state
eventTimeline.location.country	string	Output field: eventTimeline.location.country
eventTimeline.prev_location	object	Output field: eventTimeline.prev_location
eventTimeline.prev_location.city	string	Output field: eventTimeline.prev_location.city
eventTimeline.prev_location.state	string	Output field: eventTimeline.prev_location.state
eventTimeline.prev_location.country	string	Output field: eventTimeline.prev_location.country
eventTimeline.description	string	Output field: eventTimeline.description
eventTimeline.isp	string	Output field: eventTimeline.isp
eventTimeline.browser	string	Output field: eventTimeline.browser
eventTimeline.operating_system	string	Output field: eventTimeline.operating_system
eventTimeline.device_trust_type	string	Type of the resource
eventTimeline.protocol	string	Output field: eventTimeline.protocol

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"insights":[{}],"eventTimeline":[{"event_timestamp":"2020-05-19T17:47:30Z","category":"Risk Event","ti...

Retrieve Cases

Obtain an overview of detected security incidents by listing cases identified by Abnormal Security.

Endpoint

URL: /v1/cases

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Parameters for the Retrieve Cases action
parameters.pageSize	number	Optional	Parameters for the Retrieve Cases action
parameters.pageNumber	number	Optional	Parameters for the Retrieve Cases action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"parameters":{"filter":"lastModifiedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cases	array	Output field: cases
cases.caseId	string	Unique identifier
cases.severity	string	Output field: cases.severity
pageNumber	number	Output field: pageNumber
nextPageNumber	number	Output field: nextPageNumber

Output Example

Get Details of the Remediation History

Retrieve the remediation history details for a specific threat log message using its message ID in Abnormal Security.

Endpoint

URL: /messages/{{message_id}}/remediation_history

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.message_id	number	Required	The ABX Message ID of a message.

Input Example

{"path_parameters":{"message_id":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
remediation_history	string	Output field: remediation_history
folder_locations	array	Output field: folder_locations

Output Example

{"status_code":200,"reason":"OK","json_body":{"remediation_history":"\"Auto-Remediated\": \"2023-04-11T20:54:56.244716+00:00\"","folder_locations":["Junk"]}}

Detection 360 Reports

Retrieve Missed Attack or False Positive reports from Abnormal Security's Detection 360° by specifying the inquiry type.

Endpoint

URL: /v1/detection360/reports

Method: GET

Input

Argument Name	Type	Required	Description
parameters.inquiry_type	string	Required	Specifies the type of inquiry for the report. Available values are MISSED_ATTACK and FALSE_POSITIVE.
parameters.start	string	Optional	Parameters for the Detection 360 Reports action
parameters.end	string	Optional	Parameters for the Detection 360 Reports action
parameters.status	string	Optional	Defines the current status of the detection report. Available values are UNREVIEWED, CONTAINING_ATTACK, IMPROVING_PLATFORM, RESOLVED, and CORRECTING_JUDGEMENT.

Input Example

{"parameters":{"inquiry_type":"MISSED_ATTACK","start":"2022-01-01T00:00:00Z","end":"2022-01-07T23:59:59Z","status":"UNREVIEWED","reporter":"reporter","attackType":"attackType","threatType":"threatType","pageSize":100,"pageNumber":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":[{"id":0,"inquiry_type":"MISSED_ATTACK","messages":{},"report":{},"status":"UNREVIEWED","submission_dat...

Employee Information

Retrieve detailed information for an employee by using their email address as a unique identifier in Abnormal Security.

Endpoint

URL: /v1/employee/{{emailAddress}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.emailAddress	string	Required	Parameters for the Employee Information action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"emailAddress":"emailAddress"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
email	string	Output field: email
title	string	Output field: title
manager	string	Output field: manager

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"name":"Tom","email":"[email protected]","title":"General Manager","manager":"manager_email@example....

Employee Genome Analysis

Retrieve identity analysis data for a specified employee from Abnormal Security using their email address.

Endpoint

URL: /v1/employee/{{emailAddress}}/identity

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.emailAddress	string	Required	Parameters for the Employee Genome Analysis action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"emailAddress":"emailAddress"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.key	string	Response data
data.name	string	Response data
data.description	string	Response data
data.values	array	Response data
data.values.value	string	Response data
data.values.percentage	number	Response data
data.values.total_count	number	Response data

Output Example

Non-analyzed Messages

Retrieve messages from the Abuse Mailbox in Abnormal Security that are pending analysis.

Endpoint

URL: /v1/abuse_mailbox/not_analyzed

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start	string	Optional	Parameters for the Non-analyzed Messages action
parameters.end	string	Optional	Parameters for the Non-analyzed Messages action

Input Example

{"parameters":{"start":"2022-01-01T00:00:00Z","end":"2022-01-01T00:00:00Z"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	object	Result of the operation
results.abx_message_id	number	Unique identifier
results.recipient	object	Result of the operation
results.recipient.name	string	Name of the resource
results.recipient.email	string	Result of the operation
results.reported_datetime	string	Result of the operation
results.reporter	object	Result of the operation
results.reporter.name	string	Name of the resource
results.reporter.email	string	Result of the operation
results.subject	string	Result of the operation
results.not_analyzed_reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"results":{"abx_message_id":0,"recipient":{},"reported_datetime":"2024-05-17T06:19:57.145Z","reporter"...

Threat Details

Retrieve detailed information for a specified threat in Abnormal Security using the unique threat ID provided.

Endpoint

URL: /v1/threats/{{threatId}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageSize	number	Optional	Parameters for the Threat Details action
parameters.pageNumber	number	Optional	Parameters for the Threat Details action
path_parameters.threatId	string	Required	Parameters for the Threat Details action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"parameters":{"pageSize":100,"pageNumber":1},"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
threatId	string	Unique identifier
messages	array	Response message
messages.threatId	string	Unique identifier
messages.abxMessageId	number	Unique identifier
messages.abxPortalUrl	string	URL endpoint for the request
messages.subject	string	Response message
messages.fromAddress	string	Response message
messages.fromName	string	Name of the resource
messages.senderDomain	string	Response message
messages.toAddresses	string	Response message
messages.recipientAddress	string	Response message
messages.receivedTime	string	Response message
messages.sentTime	string	Response message
messages.internetMessageId	string	Unique identifier
messages.remediationStatus	string	Status value
messages.attackType	string	Type of the resource
messages.attackStrategy	string	Response message
messages.returnPath	string	Response message
messages.replyToEmails	array	Response message
messages.ccEmails	array	Response message
messages.senderIpAddress	string	Response message
messages.impersonatedParty	string	Response message
messages.attackVector	string	Response message

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"threatId":"184712ab-6d8b-47b3-89d3-a314efef79e2","messages":[{}],"pageNumber":1,"nextPageNumber":2}}

Threat Action Status

Check the status of a requested action on a threat within Abnormal Security using threatId and actionId.

Endpoint

URL: /v1/threats/{{threatId}}/actions/{{actionId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threatId	string	Required	Parameters for the Threat Action Status action
path_parameters.actionId	string	Required	Parameters for the Threat Action Status action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"threatId":"threatId","actionId":"actionId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
description	string	Output field: description

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"status":"acknowledged","description":"The request was completed successfully"}}

Threat Attachment Details

Retrieve detailed attachment information for a given threat ID in Abnormal Security.

Endpoint

URL: /v1/threats/{{threatId}}/attachments

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threatId	string	Required	Parameters for the Threat Attachment Details action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
threats	array	Output field: threats
threats.abxMessageId	number	Unique identifier
threats.attachmentName	string	Name of the resource

Output Example

Threat Link Info

Retrieve detailed link information for a given threat ID from Abnormal Security, requiring the threatId as a path parameter.

Endpoint

URL: /v1/threats/{{threatId}}/links

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threatId	string	Required	Parameters for the Threat Link Info action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
threats	array	Output field: threats
threats.abxMessageId	number	Unique identifier
threats.domainLink	string	Output field: threats.domainLink
threats.linkType	string	Type of the resource
threats.source	string	Output field: threats.source
threats.displayText	string	Output field: threats.displayText
threats.linkUrl	string	URL endpoint for the request

Output Example

Threat Retrieval

Obtain a detailed list of threats identified by Abnormal Security, providing insights into potential security incidents.

Endpoint

URL: /v1/threats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Parameters for the Threat Retrieval action
parameters.sender	string	Optional	Parameters for the Threat Retrieval action
parameters.source	string	Optional	Parameters for the Threat Retrieval action
parameters.recipient	string	Optional	Parameters for the Threat Retrieval action
parameters.subject	string	Optional	Parameters for the Threat Retrieval action
parameters.topic	string	Optional	Parameters for the Threat Retrieval action
parameters.attackStrategy	string	Optional	Parameters for the Threat Retrieval action
parameters.impersonatedParty	string	Optional	Parameters for the Threat Retrieval action
parameters.attackType	string	Optional	Parameters for the Threat Retrieval action
parameters.threatType	string	Optional	Parameters for the Threat Retrieval action
parameters.pageSize	number	Optional	Parameters for the Threat Retrieval action
parameters.pageNumber	number	Optional	Parameters for the Threat Retrieval action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"parameters":{"filter":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","sender":"sender","source":"source","recipient":"recipient","subject":"subject","topic":"topic","attackStrategy":"attackStrategy","impersonatedParty":"impersonatedParty","attackType":"attackType","threatType":"threatType","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
threats	array	Output field: threats
threats.threatId	string	Unique identifier
pageNumber	number	Output field: pageNumber
nextPageNumber	number	Output field: nextPageNumber

Output Example

Vendor Details

Retrieve details for a specified vendor domain from Abnormal Security, requiring the vendorDomain as a path parameter.

Endpoint

URL: /v1/vendors/{{vendorDomain}}/details

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.vendorDomain	string	Required	Parameters for the Vendor Details action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"vendorDomain":"vendorDomain"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
vendorDomain	string	Output field: vendorDomain
riskLevel	string	Output field: riskLevel
vendorContacts	array	Output field: vendorContacts
companyContacts	array	Output field: companyContacts
vendorCountries	array	Output field: vendorCountries
analysis	array	Output field: analysis
vendorIpAddress	array	Output field: vendorIpAddress

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"vendorDomain":"vendor.com","riskLevel":"High","vendorContacts":["[email protected]"],"companyContacts"...

Vendor Activity

Retrieve interaction activity for a specified vendor domain in Abnormal Security, requiring the vendorDomain path parameter.

Endpoint

URL: /v1/vendors/{{vendorDomain}}/activity

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.vendorDomain	string	Required	Parameters for the Vendor Activity action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"vendorDomain":"vendorDomain"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
eventTimeline	array	Output field: eventTimeline
eventTimeline.eventTimestamp	string	Output field: eventTimeline.eventTimestamp
eventTimeline.eventType	string	Type of the resource
eventTimeline.suspiciousDomain	string	Output field: eventTimeline.suspiciousDomain
eventTimeline.domainIp	string	Output field: eventTimeline.domainIp
eventTimeline.ipGeolocation	string	Output field: eventTimeline.ipGeolocation
eventTimeline.attackGoal	string	Output field: eventTimeline.attackGoal
eventTimeline.actionTaken	string	Output field: eventTimeline.actionTaken
eventTimeline.hasEngagement	boolean	Output field: eventTimeline.hasEngagement
eventTimeline.recipient	string	Output field: eventTimeline.recipient
eventTimeline.threatId	string	Unique identifier

Output Example

Vendor Case Details

Retrieve detailed information for a specific vendor case in Abnormal Security using the unique case ID.

Endpoint

URL: /v1/vendor-cases/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Vendor Case Details action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"path_parameters":{"id":"id"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
vendorCaseId	number	Unique identifier
firstObservedTime	string	Time value
lastModifiedTime	string	Time value
vendorDomain	string	Output field: vendorDomain
insights	array	Output field: insights
insights.highlight	string	Output field: insights.highlight
insights.description	string	Output field: insights.description
timeline	array	Output field: timeline
timeline.eventTimestamp	string	Output field: timeline.eventTimestamp
timeline.senderAddress	string	Output field: timeline.senderAddress
timeline.recipientAddress	string	Output field: timeline.recipientAddress
timeline.subject	string	Output field: timeline.subject
timeline.markedAs	string	Output field: timeline.markedAs
timeline.threatId	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 22:40:36 GMT","Content-Type":"application/json","Content-Length":"1757","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"3aa7103c-84d3-474a-97dd-64b9870d59d6","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"vendorCaseId":0,"firstObservedTime":"2020-06-09T17:42:59Z","lastModifiedTime":"2020-06-09T17:42:59Z"...

Vendor Cases List

Retrieve an overview of potential security incidents by listing vendor cases from Abnormal Security.

Endpoint

URL: /v1/vendor-cases

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Parameters for the Vendor Cases List action
parameters.pageSize	number	Optional	Parameters for the Vendor Cases List action
parameters.pageNumber	number	Optional	Parameters for the Vendor Cases List action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"parameters":{"filter":"firstObservedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
vendorCases	array	Output field: vendorCases
vendorCases.vendorCaseId	number	Unique identifier
pageNumber	number	Output field: pageNumber
nextPageNumber	number	Output field: nextPageNumber

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 22:40:35 GMT","Content-Type":"application/json","Content-Length":"109","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"9c0e0956-c50b-4c78-bd66-cb4b522d5fd6","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"vendorCases":[{}],"pageNumber":1,"nextPageNumber":2}}

List Vendors

Retrieve a list of vendors your organization has interacted with via Abnormal Security.

Endpoint

URL: /v1/vendors

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageSize	number	Optional	Parameters for the List Vendors action
parameters.pageNumber	number	Optional	Parameters for the List Vendors action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data

Input Example

{"parameters":{"pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
vendors	array	Output field: vendors
vendors.vendorDomain	string	Output field: vendors.vendorDomain
pageNumber	number	Output field: pageNumber
nextPageNumber	number	Output field: nextPageNumber

Output Example

Case Management

Update or retrieve details for a specific Abnormal Security case using the provided case ID.

Endpoint

URL: /v1/cases/{{caseId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Case Management action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data
action	string	Optional	Parameter for Case Management

Input Example

{"json_body":{"action":"action_required"},"path_parameters":{"caseId":"caseId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
action	string	Output field: action

Output Example

Threat Management

Manage a specific threat in Abnormal Security by utilizing the provided threatId.

Endpoint

URL: /v1/threats/{{threatId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.threatId	string	Required	Parameters for the Threat Management action
headers	object	Optional	HTTP headers for the request
headers.mock-data	boolean	Optional	Response data
action	string	Optional	Parameter for Threat Management

Input Example

{"json_body":{"action":"remediate"},"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
actionId	string	Unique identifier
statusUrl	string	URL endpoint for the request

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"actionId":"a33a212a-89ff-461f-be34-ea52aff44a73","statusUrl":"https://api.abnormalplatform.com/v1/thr...

Report Misjudgement

Report a missed attack or false positive to Abnormal Security, enhancing future detection accuracy. A JSON body input is required.

Endpoint

URL: /v1/detection360/reports

Method: POST

Input

Argument Name	Type	Required	Description
report_type	string	Optional	Type of the resource
received_date	string	Optional	Date value
description	string	Optional	Parameter for Report Misjudgement
portal_link	string	Optional	Parameter for Report Misjudgement

Input Example

{"json_body":{"report_type":"false-positive","received_date":"2020/02/01","description":"Alice reported this email was missing from their inbox.","portal_link":"https://portal.abnormalsecurity.com/home/threat-center/remediation-history/1234567890"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Response Headers

Header	Description	Example
Allow	HTTP response header: Allow	GET, OPTIONS
Connection	HTTP response header: Connection	keep-alive
Content-Length	The length of the response body in bytes	144
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT
Referrer-Policy	HTTP response header: Referrer-Policy	same-origin
Server	Information about the software used by the origin server	nginx
Vary	HTTP response header: Vary	Accept
X-Abnormal-Trace-Id	HTTP response header: X-Abnormal-Trace-Id	9c0e0956-c50b-4c78-bd66-cb4b522d5fd6
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	DENY