Abnormal Security

category: Data Enrichment & Threat Intelligence
provider: Abnormal Security
sectionorder:
- Connect
- Collect
commonfields:
  id: Abnormal Security
  version: -1
configuration:
- defaultvalue: https://api.abnormalplatform.com/v1
  display: Server URL (e.g. https://api.abnormalplatform.com/v1)
  name: url
  required: true
  section: Connect
  type: 0
- display: API Key
  name: api_key
  required: true
  section: Connect
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  section: Connect
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  section: Connect
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  required: false
  section: Collect
  type: 8
- additionalinfo: Maximum number of incidents per fetch. The default value is 200.
  defaultvalue: '200'
  display: Maximum incidents to fetch.
  name: max_fetch
  section: Collect
  type: 0
  required: false
- display: Fetch Threats
  name: fetch_threats
  type: 8
  section: Collect
  required: false
- display: Fetch Abuse Campaigns
  name: fetch_abuse_campaigns
  type: 8
  section: Collect
  required: false
- display: Fetch Account Takeover Cases
  name: fetch_account_takeover_cases
  type: 8
  required: false
  section: Collect
- defaultvalue: 3 days
  display: First fetch time
  additionalinfo: First alert created date to fetch. e.g., "1 min ago","2 weeks ago","3 months ago"
  section: Collect
  name: first_fetch
  type: 0
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
- display: Polling Lag Time (in minutes)
  name: polling_lag
  defaultvalue: "2"
  type: 0
  required: false
  additionalinfo: Time in minutes to subtract from polling time window for data consistency
  section: Collect
- display: Maximum incidents pages to fetch
  name: max_page_number
  defaultvalue: "8"
  type: 0
  required: false
  additionalinfo: Maximum number of pages to fetch for incidents
  section: Collect
description: Abnormal Security detects the whole spectrum of email attacks, from vendor email compromise and spear-phishing to unwanted email spam and graymail. To stop these advanced attacks, Abnormal leverages the industry’s most advanced behavioral data science to baseline known good behavior and detects anomalies.
display: Abnormal Security
name: Abnormal Security
script:
  commands:
  - arguments:
    - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/threats` are `receivedTime` and `lastModifiedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ format`.
      name: filter
    - description: Filters threats based on the email subject.
      name: subject
    - description: Filters threats based on the name or email address of the sender.
      name: sender
    - description: Filters threats based on the name or email address of the recipient.
      name: recipient
    - description: 'Filters threats based on the topic of email contents  Available values : Billing Account Update, Covid-19 Related Attack, Cryptocurrency, Invoice, Invoice Inquiry.'
      name: topic
      auto: PREDEFINED
      predefined:
      - Billing Account Update
    - description: 'Filters threats based on the type of attack  Available values : Internal-to-Internal Attacks (Email Account Takeover), Spam, Reconnaissance, Scam, Social Engineering (BEC), Phishing: Credential, Invoice/Payment Fraud (BEC), Malware, Extortion, Phishing: Sensitive Data, Other.'
      name: attackType
      auto: PREDEFINED
      predefined:
      - Internal-to-Internal Attacks (Email Account Takeover)
    - auto: PREDEFINED
      description: 'Filters threats based on the attack vector  Available values : Link, Attachment, Text, Others, Attachment with Zipped File.'
      name: attackVector
      predefined:
      - Link
      - Attachment
      - Text
      - Others
      - Attachment with Zipped File
    - description: Number of threats per page. Each page will contain up to page_size threats. This has no effect if no filter is specified.
      name: page_size
    - description: 1-indexed page number to get a particular page of threats. Has no effect if filter is not specified.
      name: page_number
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Filters threats based on the source of detection.
      name: source
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Get a list of threats.
    name: abnormal-security-list-threats
    outputs:
    - contextPath: AbnormalSecurity.inline_response_200.threats.threatId
      description: An id which maps to a threat campaign. A threat campaign might be received by multiple users.
      type: String
    - contextPath: AbnormalSecurity.inline_response_200.pageNumber
      description: The current page number. Will not be be in the response if no filter query  meter is passed in via the request.
      type: Number
    - contextPath: AbnormalSecurity.inline_response_200.nextpageNumber
      description: The next page number. Will not be included in the response if there are no more pages of data or if no filter query meter is passed in via the request.
      type: Number

  - arguments:
    - description: A UUID representing a threat campaign. Full list of threat IDs can be obtained by first running the command to list a threat.
      name: threat_id
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    - description: Number of threats per page. Each page will contain up to page_size threats. This has no effect if no filter is specified.
      name: page_size
    - description: 1-indexed page number to get a particular page of threats. Has no effect if filter is not specified.
      name: page_number
    description: Get details of a threat.
    name: abnormal-security-get-threat
    outputs:
    - contextPath: AbnormalSecurity.ThreatDetails.threatId
      description: An id which maps to a threat campaign. A threat campaign might be received by multiple users.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.threatId
      description: An id which maps to a threat campaign. A threat campaign might be received by multiple users.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.abxMessageId
      description: A unique identifier for an individual message within a threat (i.e email campaign).
      type: Number
    - contextPath: AbnormalSecurity.ThreatDetails.messages.abxPortalUrl
      description: The URL at which the specific message details are viewable in Abnormal Security's Portal web interface.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.subject
      description: The email subject.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.fromAddress
      description: The email address of the sender.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.fromName
      description: The display name of the sender.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.toAddresses
      description: All the email addresses to which the message was sent, comma-se ted & truncated at 255 chars.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.recipientAddress
      description: the email address of the user who actually received the message.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.receivedTime
      description: The timestamp at which this message arrived.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.sentTime
      description: The timestamp at which this message was sent.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.internetMessageId
      description: The internet message ID, per RFC 822.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.autoRemediated
      description: Abnormal has automatically detected and remediated this message from the user's mailbox.
      type: Boolean
    - contextPath: AbnormalSecurity.ThreatDetails.messages.postRemediated
      description: Email campaigns that were remediated at a later time, after landing in user's mailbox.
      type: Boolean
    - contextPath: AbnormalSecurity.ThreatDetails.messages.attackType
      description: The type of threat the message represents.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.attackStrategy
      description: The attack strategy identified to be used by a threat campaign.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.returnPath
      description: The potential path where information is returned to the attacker.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.senderIpAddress
      description: IP address of sender.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.impersonatedParty
      description: Impersonated party, if any.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.attackVector
      description: The attack medium.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.remediationTimestamp
      description: The timestamp at which this message was remediated, or empty if it has not been remediated.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.isRead
      description: Whether an email has been read.
      type: Boolean
    - contextPath: AbnormalSecurity.ThreatDetails.messages.attackedParty
      description: The party that was targeted by an attack.
      type: String

    - contextPath: AbnormalSecurity.ThreatDetails.messages.attachmentCount
      description: The number of attachments in the message.
      type: Number
    - contextPath: AbnormalSecurity.ThreatDetails.messages.attachmentNames
      description: List of attachment names in the message.
      type: Unknown
    - contextPath: AbnormalSecurity.ThreatDetails.messages.ccEmails
      description: List of CC'd email addresses.
      type: Unknown
    - contextPath: AbnormalSecurity.ThreatDetails.messages.replyToEmails
      description: List of email addresses to reply to.
      type: Unknown
    - contextPath: AbnormalSecurity.ThreatDetails.messages.senderDomain
      description: The domain of the sender's email address.
      type: String
    - contextPath: AbnormalSecurity.ThreatDetails.messages.summaryInsights
      description: Summary insights of the message.
      type: Unknown
    - contextPath: AbnormalSecurity.ThreatDetails.messages.urlCount
      description: Count of URLs in the message.
      type: Number
    - contextPath: AbnormalSecurity.ThreatDetails.messages.urls
      description: List of URLs in the message.
      type: Unknown
    - contextPath: AbnormalSecurity.ThreatDetails.messages.remediationStatus
      description: The status of remediation for the message.
      type: String

  - arguments:
    - description: A UUID representing a threat campaign. Full list of threat IDs can be obtained by first running the command to list a threat.
      name: threat_id
      required: true
    - description: Action to perform on threat.
      name: action
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    description: Manage a Threat identified by Abnormal Security.
    name: abnormal-security-manage-threat
    outputs:
    - contextPath: AbnormalSecurity.ThreatManageResults.action_id
      description: ID of the action taken.
      type: String
    - contextPath: AbnormalSecurity.ThreatManageResults.status_url
      description: URL of the status of the action.
      type: String

  - arguments:
    - description: A UUID representing a threat campaign. Full list of threat IDs can be obtained by first running the command to list a threat.
      name: threat_id
      required: true
    - description: A UUID representing the action id for a threat. Can be obtained from payload after performing an action on the threat.
      name: action_id
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Check the status of an action requested on a threat.
    name: abnormal-security-check-threat-action-status
    outputs:
    - contextPath: AbnormalSecurity.ActionStatus.status
      description: The status of a threat after performing an action on it.
      type: String
    - contextPath: AbnormalSecurity.ActionStatus.description
      description: The description of the status.
      type: String
  - arguments:
    - description: Filter the results based on a filter key. Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. Supported keys - [`receivedTime`].
      name: filter
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Filters threats based on the source of detection.
      name: source
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Download data from Threat Log in .csv format.
    name: abnormal-security-download-threat-log-csv
  - arguments:
    - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only key that is supported for `/cases` is `lastModifiedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format.
      name: filter
    - description: Number of cases that are on each page. Each page of data will have at most page_size threats. Has no effect if filter is not specified.
      name: page_size
    - description: 1-indexed page number to get a particular page of cases. Has no effect if filter is not specified.
      name: page_number
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Get a list of Abnormal cases identified by Abnormal Security.
    name: abnormal-security-list-abnormal-cases
    outputs:
    - contextPath: AbnormalSecurity.inline_response_200_1.cases.caseId
      description: A unique identifier for this case.
      type: String
    - contextPath: AbnormalSecurity.inline_response_200_1.cases.description
      description: Description of the severity level for this case.
      type: String
    - contextPath: AbnormalSecurity.inline_response_200_1.pageNumber
      description: The current page number. Will not be be in the response if no filter query meter is passed in via the request.
      type: Number
    - contextPath: AbnormalSecurity.inline_response_200_1.nextpageNumber
      description: The next page number. Will not be included in the response if there are no more pages of data or if no filter query meter is passed in via the request.
      type: Number

  - arguments:
    - description: A string representing the email case. Can be retrieved by first running command to list cases.
      name: case_id
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Get details of an Abnormal case.
    name: abnormal-security-get-abnormal-case
    outputs:
    - contextPath: AbnormalSecurity.AbnormalCaseDetails.caseId
      description: A unique identifier for this case.
      type: String
    - contextPath: AbnormalSecurity.AbnormalCaseDetails.severity
      description: Description of the severity level for this case.
      type: String
    - contextPath: AbnormalSecurity.AbnormalCaseDetails.affectedEmployee
      description: Which employee this case pertains to.
      type: String
    - contextPath: AbnormalSecurity.AbnormalCaseDetails.firstObserved
      description: First time suspicious behavior was observed.
      type: String
    - contextPath: AbnormalSecurity.AbnormalCaseDetails.genai_summary
      description: Gen AI summary of the case.
      type: String
  - arguments:
    - description: A string representing the email case. Can be retrieved by first running command to list cases.
      name: case_id
      required: true
    - description: Action to perform on case.
      name: action
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    description: Manage an Abnormal Case.
    name: abnormal-security-manage-abnormal-case
    outputs:
    - contextPath: AbnormalSecurity.CaseManageResults.action_id
      description: ID of the action taken.
      type: String
    - contextPath: AbnormalSecurity.CaseManageResults.status_url
      description: URL of the status of the action.
      type: String
  - arguments:
    - description: A string representing the email case. Can be retrieved by first running command to list cases.
      name: case_id
      required: true
    - description: A string representing the email case. Can be retrieved from payload after performing an action on a case.
      name: action_id
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Check the status of an action requested on a case.
    name: abnormal-security-check-case-action-status
    outputs:
    - contextPath: AbnormalSecurity.ActionStatus.status
      description: Status of the case after an action is performed.
      type: String
    - contextPath: AbnormalSecurity.ActionStatus.description
      description: Detailed description of the status.
      type: String
  - arguments:
    - description: A string representing the email case. Can be retrieved by first running command to list cases.
      name: case_id
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Provides the analysis and timeline details of a case.
    name: abnormal-security-get-case-analysis-and-timeline
    outputs:
    - contextPath: AbnormalSecurity.CaseAnalysis.insights.signal
      description: Insight signal or highlight of a case.
      type: String
    - contextPath: AbnormalSecurity.CaseAnalysis.insights.description
      description: Description of insight signal or highlight.
      type: String
    - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.event_timestamp
      description: Time when event occurred.
      type: String
    - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.category
      description: Type of event.
      type: String
    - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.title
      description: Title of the event.
      type: String
    - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.ip_address
      description: IP Address where user accessed mail from.
      type: String
    - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.field_labels
      description: Analysis labels associated with the fields in the timeline event.
      type: Unknown
  - arguments:
    - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently only the key `lastReportedTime` is supported for `/abusecampaigns`. At least one of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. Do note that provided filter time is in UTC.
      name: filter
    - description: Number of abuse campaigns shown on each page. Each page of data will have at most page_size abuse campaign IDs.
      name: page_size
    - description: 1-indexed page number to get a particular page of threats. Has no effect if filter is not specified.
      name: page_number
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    - description: Filters threats based on the email subject.
      name: subject
    - description: Filters threats based on the name or email address of the sender.
      name: sender
    - description: Filters threats based on the name or email address of the recipient.
      name: recipient
    - description: Filters threats based on the reporter name or email address.
      name: reporter
    - auto: PREDEFINED
      description: Filters threats based on the type of attack.
      name: attackType
      predefined:
      - Internal-to-Internal Attacks (Email Account Takeover)
      - Spam
      - Reconnaissance
      - Scam
      - Social Engineering (BEC)
      - 'Phishing: Credential'
      - Invoice/Payment Fraud (BEC)
      - Malware
      - Extortion
      - 'Phishing: Sensitive Data'
      - Other
    - auto: PREDEFINED
      description: Filters threats based on the type of attack.
      name: threatType
      predefined:
      - All
      - Malicious
      - Safe
      - Spam
    description: Get a list of campaigns submitted to Abuse Mailbox.
    name: abnormal-security-list-abuse-mailbox-campaigns
    outputs:
    - contextPath: AbnormalSecurity.AbuseCampaign.campaigns.campaignId
      description: An id which maps to an abuse campaign.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.pageNumber
      description: The current page number.
      type: Number
    - contextPath: AbnormalSecurity.AbuseCampaign.nextPageNumber
      description: The next page number.
      type: Number
  - arguments:
    - description: A UUID representing the abuse campaign id. Can be Can be retrieved by first running command to list abuse mailbox campaigns.
      name: campaign_id
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Subtenant of the user (if applicable).
      name: subtenant
    description: Get details of an Abuse Mailbox campaign.
    name: abnormal-security-get-abuse-mailbox-campaign
    outputs:
    - contextPath: AbnormalSecurity.AbuseCampaign.campaignId
      description: An id which maps to an abuse campaign.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.firstReported
      description: Date abuse campaign was first reported.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.lastReported
      description: Date abuse campaign was last reported.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.messageId
      description: A unique identifier for the first message in the abuse campaign.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.subject
      description: Subject of the first email in the abuse campaign.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.fromName
      description: The display name of the sender.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.fromAddress
      description: The email address of the sender.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.recipientName
      description: The email address of the recipient.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.recipientAddress
      description: The email address of the recipient.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.judgementStatus
      description: Judgement status of message.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.overallStatus
      description: Overall status of message.
      type: String
    - contextPath: AbnormalSecurity.AbuseCampaign.attackType
      description: The type of threat the message represents.
      type: String

      # Employee commands
  - arguments:
    - description: Email address of the employee you want to retrieve data for.
      name: email_address
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    description: Get employee identity analysis (Genome) data.
    name: abnormal-security-get-employee-identity-analysis
    outputs:
    - contextPath: AbnormalSecurity.Employee.email
      description: Employee email.
      type: String
    - contextPath: AbnormalSecurity.Employee.histograms.key
      description: Genome key name.
      type: String
    - contextPath: AbnormalSecurity.Employee.histograms.name
      description: Genome title.
      type: String
    - contextPath: AbnormalSecurity.Employee.histograms.description
      description: Description of genome object.
      type: String
    - contextPath: AbnormalSecurity.Employee.histograms.values.value
      description: Category value.
      type: String
    - contextPath: AbnormalSecurity.Employee.histograms.values.percentage
      description: Ratio of this category relative to others.
      type: Number
    - contextPath: AbnormalSecurity.Employee.histograms.values.total_count
      description: Number of occurences for this category.
      type: Number

  - arguments:
    - description: Email address of the employee you want to retrieve data for.
      name: email_address
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    description: Get employee information.
    name: abnormal-security-get-employee-information
    outputs:
    - contextPath: AbnormalSecurity.Employee.name
      description: Name of the employee.
      type: String
    - contextPath: AbnormalSecurity.Employee.email
      description: Email of the employee.
      type: String
    - contextPath: AbnormalSecurity.Employee.title
      description: Job title of the employee.
      type: String
    - contextPath: AbnormalSecurity.Employee.manager
      description: Email address of the employee's manager.
      type: String

  - arguments:
    - description: Email address of the employee you want to retrieve data for.
      name: email_address
      required: true
    - description: Returns test data if set to `True`.
      name: mock-data
    description: Get employee login information for last 30 days in csv format.
    name: abnormal-security-get-employee-last-30-days-login-csv
  - arguments:
    - description: Returns test data if set to `True`.
      name: mock-data
    - description: Email of the reporter.
      name: reporter
      required: true
    - description: Type of misjudgement reported.
      name: report_type
      required: true
    description: Submit an Inquiry to request a report on misjudgement by Abnormal Security.
    name: abnormal-security-submit-inquiry-to-request-a-report-on-misjudgement
    outputs:
    - contextPath: AbnormalSecurity.SubmitInquiry.detail
      description: Confirmation of inquiry sent.
      type: String

  - arguments:
    - description: Email address of the sender.
      name: sender_email
      required: true
    - description: Email address of the recipient.
      name: recipient_email
      required: true
    - description: Subject of email.
      name: subject
      required: true
    description: Submit a False Negative Report.
    name: abnormal-security-submit-false-negative-report

  - arguments:
    - description: URL link of threat log in abnormal security portal.
      name: portal_link
      required: true
    description: Submit a False Positive Report.
    name: abnormal-security-submit-false-positive-report

  - arguments:
    - description: Number of vendors that should appear on each page. Each page of data will have at most this many vendors.
      name: page_size
    - description: 1-indexed page number to get a particular page of vendors.
      name: page_number
    description: Get a list of vendors.
    name: abnormal-security-list-vendors
    outputs:
    - contextPath: AbnormalSecurity.VendorsList
      description: List of vendors.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorsList.vendorDomain
      description: The domain of the vendor.
      type: String

  - arguments:
    - description: The domain name of the specific vendor for which you want to get details.
      name: vendor_domain
      required: true
    description: Get the details of a specific vendor.
    name: abnormal-security-get-vendor-details
    outputs:
    - contextPath: AbnormalSecurity.VendorDetails.vendorDomain
      description: The domain name of the vendor.
      type: String
    - contextPath: AbnormalSecurity.VendorDetails.riskLevel
      description: The risk level associated with the vendor.
      type: String
    - contextPath: AbnormalSecurity.VendorDetails.vendorContacts
      description: List of contacts related to the vendor.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorDetails.companyContacts
      description: List of contacts related to the company.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorDetails.vendorCountries
      description: List of countries associated with the vendor.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorDetails.analysis
      description: List of analyses associated with the vendor.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorDetails.vendorIpAddresses
      description: List of IP addresses associated with the vendor.
      type: Unknown

  - arguments:
    - description: Domain name for the vendor whose activity is to be retrieved.
      name: vendor_domain
      required: true
    description: Get the activity for a specific vendor.
    name: abnormal-security-get-vendor-activity
    outputs:
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline
      description: Event timeline for the vendor.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.eventTimestamp
      description: Timestamp of the event in the vendor's activity timeline.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.eventType
      description: Type of event in the vendor's activity timeline.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.suspiciousDomain
      description: Suspicious domain involved in the event.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.domainIp
      description: IP address of the suspicious domain.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.ipGeolocation
      description: Geolocation of the IP address.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.attackGoal
      description: The goal of the attack.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.actionTaken
      description: Action taken in response to the event.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.hasEngagement
      description: Indicates whether the event involved any form of engagement.
      type: Boolean
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.recipient
      description: The recipient targeted by the event, if applicable.
      type: String
    - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.threatId
      description: Unique identifier for the threat.
      type: String

  - arguments:
    - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently only the keys `firstObservedTime` and `lastModifiedTime` are supported for `/vendor-cases`. At least one of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. Do note that provided filter time is in UTC.
      name: filter
    - description: Number of vendor cases that should appear on each page. Each page of data will have at most this many vendor cases.
      name: page_size
    - description: 1-indexed page number to get a particular page of vendor cases.
      name: page_number
    description: Get a list of vendor cases.
    name: abnormal-security-list-vendor-cases
    outputs:
    - contextPath: AbnormalSecurity.VendorCases
      description: List of vendor cases.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorCases.vendorCaseId
      description: The identifier of the vendor case.
      type: Number

  - arguments:
    - description: The identifier of the vendor case to retrieve details for.
      name: case_id
      required: true
    description: Get the details of a vendor case.
    name: abnormal-security-get-vendor-case-details
    outputs:
    - contextPath: AbnormalSecurity.VendorCaseDetails.vendorCaseId
      description: The identifier of the vendor case.
      type: String
    - contextPath: AbnmoralSecurity.VendorCaseDetails.vendorDomain
      description: The vendor domain associated with the case.
      type: String
    - contextPath: AbnormalSecurity.VendorCaseDetails.firstObservedTime
      description: The time the vendor case was first observed.
      type: String
    - contextPath: AbnormalSecurity.VendorCaseDetails.lastModifiedTime
      description: The last time the vendor case was modified.
      type: String
    - contextPath: AbnormalSecurity.VendorCaseDetails.insights
      description: List of insights related to the vendor case.
      type: Unknown
    - contextPath: AbnormalSecurity.VendorCaseDetails.timeline
      description: Timeline of events related to the vendor case.
      type: Unknown

  - arguments:
    - description: The start time for retrieving the list of unanalyzed abuse mailbox campaigns.
      name: start
    - description: The end time for retrieving the list of unanalyzed abuse mailbox campaigns.
      name: end
    description: Get a list of unanalyzed abuse mailbox campaigns.
    name: abnormal-security-list-unanalyzed-abuse-mailbox-campaigns
    outputs:
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.abx_message_id
      description: An id which maps to an abuse campaign.
      type: Number
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.recipient.name
      description: The name of the recipient.
      type: String
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.recipient.email
      description: The email address of the recipient.
      type: String
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.reported_datetime
      description: The datetime the report was made.
      type: String
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.reporter.email
      description: The email address of the reporter.
      type: String
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.reporter.name
      description: The name of the reporter.
      type: String
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.subject
      description: The subject of the message.
      type: String
    - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.not_analyzed_reason
      description: The reason the message was not analyzed.
      type: String

  - arguments:
    - description: Returns test data if set to `True`.
      name: mock-data
    description: Get the latest threat intel feed.
    name: abnormal-security-get-latest-threat-intel-feed
    deprecated: true

  # SOAR Message Search and Respond Commands
  - arguments:
    - description: Message source (abnormal or quarantine).
      name: source
      required: true
      auto: PREDEFINED
      predefined:
      - abnormal
      - quarantine
    - description: Comma-separated list of tenant IDs.
      name: tenant_ids
    - description: Start time for the search in ISO 8601 format (e.g., 2024-01-01T00:00:00Z).
      name: start_time
      required: true
    - description: End time for the search in ISO 8601 format (e.g., 2024-01-31T23:59:59Z).
      name: end_time
      required: true
    - description: Filter by email subject.
      name: subject
    - description: Filter by sender email address.
      name: sender_email
    - description: Filter by sender name.
      name: sender_name
    - description: Filter by recipient email address.
      name: recipient_email
    - description: Filter by recipient name.
      name: recipient_name
    - description: Filter by attachment name.
      name: attachment_name
    - description: Filter by attachment MD5 hash.
      name: attachment_md5_hash
    - description: Filter by internet message ID.
      name: internet_message_id
    - description: Filter by body link/URL.
      name: body_link
    - description: Filter by sender IP address.
      name: sender_ip
    - description: Filter by judgement status.
      name: judgement
      auto: PREDEFINED
      predefined:
      - attack
      - borderline
      - spam
      - graymail
      - safe
    - description: Use regex for sender filtering (default false).
      name: use_sender_regex
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Use regex for recipient filtering (default false).
      name: use_recipient_regex
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Show graymail messages (default false).
      name: show_graymail
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Page number (default 1).
      name: page_number
    - description: Page size (default 100, max 1000).
      name: page_size
    description: Search for messages using filters across abnormal or quarantine sources.
    name: abnormal-security-search-messages
    outputs:
    - contextPath: AbnormalSecurity.MessageSearch.results
      description: List of messages matching the search criteria.
      type: Unknown
    - contextPath: AbnormalSecurity.MessageSearch.results.abnormal_message_id
      description: Abnormal message identifier.
      type: String
    - contextPath: AbnormalSecurity.MessageSearch.results.subject
      description: Email subject.
      type: String
    - contextPath: AbnormalSecurity.MessageSearch.results.sender
      description: Sender email address.
      type: String
    - contextPath: AbnormalSecurity.MessageSearch.results.mailbox_name
      description: Mailbox name where the message was received.
      type: String
    - contextPath: AbnormalSecurity.MessageSearch.results.received_time
      description: Time when message was received.
      type: String
    - contextPath: AbnormalSecurity.MessageSearch.results.decision_category
      description: Decision category (malicious, spam, safe, graymail).
      type: String
    - contextPath: AbnormalSecurity.MessageSearch.results.judgement
      description: Judgement status (attack, borderline, spam, graymail, safe).
      type: String
    - contextPath: AbnormalSecurity.MessageSearch.total
      description: Total number of messages found.
      type: Number
    - contextPath: AbnormalSecurity.MessageSearch.pageNumber
      description: Current page number.
      type: Number
    - contextPath: AbnormalSecurity.MessageSearch.nextPageNumber
      description: Next page number.
      type: Number

  - arguments:
    - description: Action to perform on messages.
      name: action
      required: true
      auto: PREDEFINED
      predefined:
      - delete
      - move_to_inbox
      - submit_to_d360
      - reclassify
    - description: Comma-separated list of tenant IDs.
      name: tenant_ids
    - description: Message source (abnormal or quarantine).
      name: source
      required: true
      auto: PREDEFINED
      predefined:
      - abnormal
      - quarantine
    - description: Reason for remediation.
      name: remediation_reason
      required: true
      auto: PREDEFINED
      predefined:
      - false_negative
      - misdirected
      - unsolicited
      - other
      - groups_remediation
      - quarantine_release
    - description: JSON string containing array of message objects to remediate. Required if remediate_all is false.
      name: messages
    - description: Whether to remediate all messages matching search filters (default false).
      name: remediate_all
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Target folder for move actions (e.g., "Deleted Items").
      name: target_folder
    - description: Whether to submit a Detection360 case (default false).
      name: submit_d360_case
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Start time for search filters when remediate_all is true (ISO 8601 format).
      name: start_time
    - description: End time for search filters when remediate_all is true (ISO 8601 format).
      name: end_time
    - description: Subject filter when remediate_all is true.
      name: subject
    - description: Sender email filter when remediate_all is true.
      name: sender_email
    - description: Sender name filter when remediate_all is true.
      name: sender_name
    - description: Recipient email filter when remediate_all is true.
      name: recipient_email
    - description: Recipient name filter when remediate_all is true.
      name: recipient_name
    - description: Attachment name filter when remediate_all is true.
      name: attachment_name
    - description: Attachment MD5 hash filter when remediate_all is true.
      name: attachment_md5_hash
    - description: Internet message ID filter when remediate_all is true.
      name: internet_message_id
    - description: Body link/URL filter when remediate_all is true.
      name: body_link
    - description: Sender IP address filter when remediate_all is true.
      name: sender_ip
    - description: Judgement filter when remediate_all is true.
      name: judgement
      auto: PREDEFINED
      predefined:
      - attack
      - borderline
      - spam
      - graymail
      - safe
    - description: Use regex for sender filtering when remediate_all is true (default false).
      name: use_sender_regex
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Use regex for recipient filtering when remediate_all is true (default false).
      name: use_recipient_regex
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Show graymail messages when remediate_all is true (default false).
      name: show_graymail
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Remediate messages by performing actions like delete, move, or submit to Detection360.
    name: abnormal-security-remediate-messages
    outputs:
    - contextPath: AbnormalSecurity.MessageRemediation.activity_log_id
      description: Activity log ID for tracking the remediation request.
      type: Number
    - contextPath: AbnormalSecurity.MessageRemediation.metadata
      description: Metadata about the request.
      type: Unknown

  - arguments:
    - description: Comma-separated list of tenant IDs (will be sent as query parameters).
      name: tenant_ids
    - description: Filter by action type.
      name: action
      auto: PREDEFINED
      predefined:
      - search
      - remediation
      - csv_export
    - description: Page number (default 1).
      name: page_number
    - description: Page size (default 100, max 1000).
      name: page_size
    description: Get a list of activity logs for message search and remediation operations.
    name: abnormal-security-list-activities
    outputs:
    - contextPath: AbnormalSecurity.Activities.activities
      description: List of activity logs.
      type: Unknown
    - contextPath: AbnormalSecurity.Activities.activities.activity_id
      description: Activity log ID.
      type: Number
    - contextPath: AbnormalSecurity.Activities.activities.action
      description: Action type (search, remediate, csv_export).
      type: String
    - contextPath: AbnormalSecurity.Activities.activities.status
      description: Activity status.
      type: String
    - contextPath: AbnormalSecurity.Activities.activities.performed_by
      description: User who performed the action.
      type: String
    - contextPath: AbnormalSecurity.Activities.activities.timestamp
      description: Timestamp of the activity.
      type: String
    - contextPath: AbnormalSecurity.Activities.activities.result_count
      description: Number of results from the activity.
      type: Number
    - contextPath: AbnormalSecurity.Activities.total
      description: Total number of activities.
      type: Number
    - contextPath: AbnormalSecurity.Activities.page
      description: Current page number.
      type: Number
    - contextPath: AbnormalSecurity.Activities.size
      description: Page size.
      type: Number

  - arguments:
    - description: Activity log ID to get status for.
      name: activity_log_id
      required: true
    - description: Page number (default 1).
      name: page
    - description: Page size (default 100, max 1000).
      name: size
    description: Get the status and details of a specific activity log entry.
    name: abnormal-security-get-activity-status
    outputs:
    - contextPath: AbnormalSecurity.ActivityStatus.activity_id
      description: Activity log ID.
      type: Number
    - contextPath: AbnormalSecurity.ActivityStatus.action
      description: Action type.
      type: String
    - contextPath: AbnormalSecurity.ActivityStatus.status
      description: Activity status.
      type: String
    - contextPath: AbnormalSecurity.ActivityStatus.performed_by
      description: User who performed the action.
      type: String
    - contextPath: AbnormalSecurity.ActivityStatus.timestamp
      description: Timestamp of the activity.
      type: String
    - contextPath: AbnormalSecurity.ActivityStatus.result_count
      description: Number of results.
      type: Number
    - contextPath: AbnormalSecurity.ActivityStatus.remediation_details
      description: Detailed remediation information for each message.
      type: Unknown
    - contextPath: AbnormalSecurity.ActivityStatus.total
      description: Total number of remediation details.
      type: Number

  - arguments:
    - description: Abnormal message ID (can be negative). Obtained from message search results.
      name: message_id
      required: true
    - description: Name of the attachment to download. Obtained from message search results attachments field.
      name: attachment_name
      required: true
    - description: Tenant ID for the message. Obtained from message search results.
      name: tenant_id
      required: true
    - description: Cloud provider message ID (O365/GSuite). Obtained from message search results as raw_message_id.
      name: raw_message_id
      required: true
    - description: Cloud provider user ID. Obtained from message search results as native_user_id.
      name: native_user_id
      required: true
    - description: Mailbox email address. Obtained from message search results as mailbox_name.
      name: recipient_mailbox
      required: true
    description: Download an attachment from a message found in search results. All required parameters can be obtained from the abnormal-security-search-messages command output.
    name: abnormal-security-download-message-attachment

  - arguments:
    - description: The cloud_message_id from search results (format abx:CloudMessage:...). Use the cloud_message_id field from message search results.
      name: cloud_message_id
      required: true
    - description: Quarantine identifier (required only for quarantine messages). Obtained from quarantine_info.identity field in search results.
      name: quarantine_identity
    - description: Recipient email address (required only for quarantine messages). Obtained from mailbox_name field in search results.
      name: recipient_mailbox
    description: Download a message in RFC822 EML format for forensic analysis. For quarantine messages, both quarantine_identity and recipient_mailbox parameters are required.
    name: abnormal-security-download-message-eml

  dockerimage: demisto/python3:3.12.13.10116658
  script: ""
  subtype: python3
  type: python
  isfetch: true
  runonce: false
fromversion: 6.0.0
tests:
- No tests (auto formatted)