category: Data Enrichment & Threat Intelligence provider: Abnormal Security sectionorder: - Connect - Collect commonfields: id: Abnormal Security version: -1 configuration: - defaultvalue: https://api.abnormalplatform.com/v1 display: Server URL (e.g. https://api.abnormalplatform.com/v1) name: url required: true section: Connect type: 0 - display: API Key name: api_key required: true section: Connect type: 4 - display: Trust any certificate (not secure) name: insecure section: Connect type: 8 required: false - display: Use system proxy settings name: proxy section: Connect type: 8 required: false - display: Fetch incidents name: isFetch required: false section: Collect type: 8 - additionalinfo: Maximum number of incidents per fetch. The default value is 200. defaultvalue: '200' display: Maximum incidents to fetch. name: max_fetch section: Collect type: 0 required: false - display: Fetch Threats name: fetch_threats type: 8 section: Collect required: false - display: Fetch Abuse Campaigns name: fetch_abuse_campaigns type: 8 section: Collect required: false - display: Fetch Account Takeover Cases name: fetch_account_takeover_cases type: 8 required: false section: Collect - defaultvalue: 3 days display: First fetch time additionalinfo: First alert created date to fetch. e.g., "1 min ago","2 weeks ago","3 months ago" section: Collect name: first_fetch type: 0 required: false - display: Incident type name: incidentType type: 13 required: false section: Collect - defaultvalue: '1' display: Incidents Fetch Interval name: incidentFetchInterval required: false type: 19 section: Collect - display: Polling Lag Time (in minutes) name: polling_lag defaultvalue: "2" type: 0 required: false additionalinfo: Time in minutes to subtract from polling time window for data consistency section: Collect - display: Maximum incidents pages to fetch name: max_page_number defaultvalue: "8" type: 0 required: false additionalinfo: Maximum number of pages to fetch for incidents section: Collect description: Abnormal Security detects the whole spectrum of email attacks, from vendor email compromise and spear-phishing to unwanted email spam and graymail. To stop these advanced attacks, Abnormal leverages the industry’s most advanced behavioral data science to baseline known good behavior and detects anomalies. display: Abnormal Security name: Abnormal Security script: commands: - arguments: - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/threats` are `receivedTime` and `lastModifiedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ format`. name: filter - description: Filters threats based on the email subject. name: subject - description: Filters threats based on the name or email address of the sender. name: sender - description: Filters threats based on the name or email address of the recipient. name: recipient - description: 'Filters threats based on the topic of email contents Available values : Billing Account Update, Covid-19 Related Attack, Cryptocurrency, Invoice, Invoice Inquiry.' name: topic auto: PREDEFINED predefined: - Billing Account Update - description: 'Filters threats based on the type of attack Available values : Internal-to-Internal Attacks (Email Account Takeover), Spam, Reconnaissance, Scam, Social Engineering (BEC), Phishing: Credential, Invoice/Payment Fraud (BEC), Malware, Extortion, Phishing: Sensitive Data, Other.' name: attackType auto: PREDEFINED predefined: - Internal-to-Internal Attacks (Email Account Takeover) - auto: PREDEFINED description: 'Filters threats based on the attack vector Available values : Link, Attachment, Text, Others, Attachment with Zipped File.' name: attackVector predefined: - Link - Attachment - Text - Others - Attachment with Zipped File - description: Number of threats per page. Each page will contain up to page_size threats. This has no effect if no filter is specified. name: page_size - description: 1-indexed page number to get a particular page of threats. Has no effect if filter is not specified. name: page_number - description: Returns test data if set to `True`. name: mock-data - description: Filters threats based on the source of detection. name: source - description: Subtenant of the user (if applicable). name: subtenant description: Get a list of threats. name: abnormal-security-list-threats outputs: - contextPath: AbnormalSecurity.inline_response_200.threats.threatId description: An id which maps to a threat campaign. A threat campaign might be received by multiple users. type: String - contextPath: AbnormalSecurity.inline_response_200.pageNumber description: The current page number. Will not be be in the response if no filter query meter is passed in via the request. type: Number - contextPath: AbnormalSecurity.inline_response_200.nextpageNumber description: The next page number. Will not be included in the response if there are no more pages of data or if no filter query meter is passed in via the request. type: Number - arguments: - description: A UUID representing a threat campaign. Full list of threat IDs can be obtained by first running the command to list a threat. name: threat_id required: true - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant - description: Number of threats per page. Each page will contain up to page_size threats. This has no effect if no filter is specified. name: page_size - description: 1-indexed page number to get a particular page of threats. Has no effect if filter is not specified. name: page_number description: Get details of a threat. name: abnormal-security-get-threat outputs: - contextPath: AbnormalSecurity.ThreatDetails.threatId description: An id which maps to a threat campaign. A threat campaign might be received by multiple users. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.threatId description: An id which maps to a threat campaign. A threat campaign might be received by multiple users. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.abxMessageId description: A unique identifier for an individual message within a threat (i.e email campaign). type: Number - contextPath: AbnormalSecurity.ThreatDetails.messages.abxPortalUrl description: The URL at which the specific message details are viewable in Abnormal Security's Portal web interface. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.subject description: The email subject. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.fromAddress description: The email address of the sender. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.fromName description: The display name of the sender. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.toAddresses description: All the email addresses to which the message was sent, comma-se ted & truncated at 255 chars. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.recipientAddress description: the email address of the user who actually received the message. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.receivedTime description: The timestamp at which this message arrived. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.sentTime description: The timestamp at which this message was sent. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.internetMessageId description: The internet message ID, per RFC 822. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.autoRemediated description: Abnormal has automatically detected and remediated this message from the user's mailbox. type: Boolean - contextPath: AbnormalSecurity.ThreatDetails.messages.postRemediated description: Email campaigns that were remediated at a later time, after landing in user's mailbox. type: Boolean - contextPath: AbnormalSecurity.ThreatDetails.messages.attackType description: The type of threat the message represents. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.attackStrategy description: The attack strategy identified to be used by a threat campaign. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.returnPath description: The potential path where information is returned to the attacker. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.senderIpAddress description: IP address of sender. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.impersonatedParty description: Impersonated party, if any. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.attackVector description: The attack medium. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.remediationTimestamp description: The timestamp at which this message was remediated, or empty if it has not been remediated. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.isRead description: Whether an email has been read. type: Boolean - contextPath: AbnormalSecurity.ThreatDetails.messages.attackedParty description: The party that was targeted by an attack. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.attachmentCount description: The number of attachments in the message. type: Number - contextPath: AbnormalSecurity.ThreatDetails.messages.attachmentNames description: List of attachment names in the message. type: Unknown - contextPath: AbnormalSecurity.ThreatDetails.messages.ccEmails description: List of CC'd email addresses. type: Unknown - contextPath: AbnormalSecurity.ThreatDetails.messages.replyToEmails description: List of email addresses to reply to. type: Unknown - contextPath: AbnormalSecurity.ThreatDetails.messages.senderDomain description: The domain of the sender's email address. type: String - contextPath: AbnormalSecurity.ThreatDetails.messages.summaryInsights description: Summary insights of the message. type: Unknown - contextPath: AbnormalSecurity.ThreatDetails.messages.urlCount description: Count of URLs in the message. type: Number - contextPath: AbnormalSecurity.ThreatDetails.messages.urls description: List of URLs in the message. type: Unknown - contextPath: AbnormalSecurity.ThreatDetails.messages.remediationStatus description: The status of remediation for the message. type: String - arguments: - description: A UUID representing a threat campaign. Full list of threat IDs can be obtained by first running the command to list a threat. name: threat_id required: true - description: Action to perform on threat. name: action required: true - description: Returns test data if set to `True`. name: mock-data description: Manage a Threat identified by Abnormal Security. name: abnormal-security-manage-threat outputs: - contextPath: AbnormalSecurity.ThreatManageResults.action_id description: ID of the action taken. type: String - contextPath: AbnormalSecurity.ThreatManageResults.status_url description: URL of the status of the action. type: String - arguments: - description: A UUID representing a threat campaign. Full list of threat IDs can be obtained by first running the command to list a threat. name: threat_id required: true - description: A UUID representing the action id for a threat. Can be obtained from payload after performing an action on the threat. name: action_id required: true - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant description: Check the status of an action requested on a threat. name: abnormal-security-check-threat-action-status outputs: - contextPath: AbnormalSecurity.ActionStatus.status description: The status of a threat after performing an action on it. type: String - contextPath: AbnormalSecurity.ActionStatus.description description: The description of the status. type: String - arguments: - description: Filter the results based on a filter key. Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. Supported keys - [`receivedTime`]. name: filter - description: Returns test data if set to `True`. name: mock-data - description: Filters threats based on the source of detection. name: source - description: Subtenant of the user (if applicable). name: subtenant description: Download data from Threat Log in .csv format. name: abnormal-security-download-threat-log-csv - arguments: - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only key that is supported for `/cases` is `lastModifiedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. name: filter - description: Number of cases that are on each page. Each page of data will have at most page_size threats. Has no effect if filter is not specified. name: page_size - description: 1-indexed page number to get a particular page of cases. Has no effect if filter is not specified. name: page_number - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant description: Get a list of Abnormal cases identified by Abnormal Security. name: abnormal-security-list-abnormal-cases outputs: - contextPath: AbnormalSecurity.inline_response_200_1.cases.caseId description: A unique identifier for this case. type: String - contextPath: AbnormalSecurity.inline_response_200_1.cases.description description: Description of the severity level for this case. type: String - contextPath: AbnormalSecurity.inline_response_200_1.pageNumber description: The current page number. Will not be be in the response if no filter query meter is passed in via the request. type: Number - contextPath: AbnormalSecurity.inline_response_200_1.nextpageNumber description: The next page number. Will not be included in the response if there are no more pages of data or if no filter query meter is passed in via the request. type: Number - arguments: - description: A string representing the email case. Can be retrieved by first running command to list cases. name: case_id required: true - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant description: Get details of an Abnormal case. name: abnormal-security-get-abnormal-case outputs: - contextPath: AbnormalSecurity.AbnormalCaseDetails.caseId description: A unique identifier for this case. type: String - contextPath: AbnormalSecurity.AbnormalCaseDetails.severity description: Description of the severity level for this case. type: String - contextPath: AbnormalSecurity.AbnormalCaseDetails.affectedEmployee description: Which employee this case pertains to. type: String - contextPath: AbnormalSecurity.AbnormalCaseDetails.firstObserved description: First time suspicious behavior was observed. type: String - contextPath: AbnormalSecurity.AbnormalCaseDetails.genai_summary description: Gen AI summary of the case. type: String - arguments: - description: A string representing the email case. Can be retrieved by first running command to list cases. name: case_id required: true - description: Action to perform on case. name: action required: true - description: Returns test data if set to `True`. name: mock-data description: Manage an Abnormal Case. name: abnormal-security-manage-abnormal-case outputs: - contextPath: AbnormalSecurity.CaseManageResults.action_id description: ID of the action taken. type: String - contextPath: AbnormalSecurity.CaseManageResults.status_url description: URL of the status of the action. type: String - arguments: - description: A string representing the email case. Can be retrieved by first running command to list cases. name: case_id required: true - description: A string representing the email case. Can be retrieved from payload after performing an action on a case. name: action_id required: true - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant description: Check the status of an action requested on a case. name: abnormal-security-check-case-action-status outputs: - contextPath: AbnormalSecurity.ActionStatus.status description: Status of the case after an action is performed. type: String - contextPath: AbnormalSecurity.ActionStatus.description description: Detailed description of the status. type: String - arguments: - description: A string representing the email case. Can be retrieved by first running command to list cases. name: case_id required: true - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant description: Provides the analysis and timeline details of a case. name: abnormal-security-get-case-analysis-and-timeline outputs: - contextPath: AbnormalSecurity.CaseAnalysis.insights.signal description: Insight signal or highlight of a case. type: String - contextPath: AbnormalSecurity.CaseAnalysis.insights.description description: Description of insight signal or highlight. type: String - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.event_timestamp description: Time when event occurred. type: String - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.category description: Type of event. type: String - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.title description: Title of the event. type: String - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.ip_address description: IP Address where user accessed mail from. type: String - contextPath: AbnormalSecurity.CaseAnalysis.eventTimeline.field_labels description: Analysis labels associated with the fields in the timeline event. type: Unknown - arguments: - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently only the key `lastReportedTime` is supported for `/abusecampaigns`. At least one of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. Do note that provided filter time is in UTC. name: filter - description: Number of abuse campaigns shown on each page. Each page of data will have at most page_size abuse campaign IDs. name: page_size - description: 1-indexed page number to get a particular page of threats. Has no effect if filter is not specified. name: page_number - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant - description: Filters threats based on the email subject. name: subject - description: Filters threats based on the name or email address of the sender. name: sender - description: Filters threats based on the name or email address of the recipient. name: recipient - description: Filters threats based on the reporter name or email address. name: reporter - auto: PREDEFINED description: Filters threats based on the type of attack. name: attackType predefined: - Internal-to-Internal Attacks (Email Account Takeover) - Spam - Reconnaissance - Scam - Social Engineering (BEC) - 'Phishing: Credential' - Invoice/Payment Fraud (BEC) - Malware - Extortion - 'Phishing: Sensitive Data' - Other - auto: PREDEFINED description: Filters threats based on the type of attack. name: threatType predefined: - All - Malicious - Safe - Spam description: Get a list of campaigns submitted to Abuse Mailbox. name: abnormal-security-list-abuse-mailbox-campaigns outputs: - contextPath: AbnormalSecurity.AbuseCampaign.campaigns.campaignId description: An id which maps to an abuse campaign. type: String - contextPath: AbnormalSecurity.AbuseCampaign.pageNumber description: The current page number. type: Number - contextPath: AbnormalSecurity.AbuseCampaign.nextPageNumber description: The next page number. type: Number - arguments: - description: A UUID representing the abuse campaign id. Can be Can be retrieved by first running command to list abuse mailbox campaigns. name: campaign_id required: true - description: Returns test data if set to `True`. name: mock-data - description: Subtenant of the user (if applicable). name: subtenant description: Get details of an Abuse Mailbox campaign. name: abnormal-security-get-abuse-mailbox-campaign outputs: - contextPath: AbnormalSecurity.AbuseCampaign.campaignId description: An id which maps to an abuse campaign. type: String - contextPath: AbnormalSecurity.AbuseCampaign.firstReported description: Date abuse campaign was first reported. type: String - contextPath: AbnormalSecurity.AbuseCampaign.lastReported description: Date abuse campaign was last reported. type: String - contextPath: AbnormalSecurity.AbuseCampaign.messageId description: A unique identifier for the first message in the abuse campaign. type: String - contextPath: AbnormalSecurity.AbuseCampaign.subject description: Subject of the first email in the abuse campaign. type: String - contextPath: AbnormalSecurity.AbuseCampaign.fromName description: The display name of the sender. type: String - contextPath: AbnormalSecurity.AbuseCampaign.fromAddress description: The email address of the sender. type: String - contextPath: AbnormalSecurity.AbuseCampaign.recipientName description: The email address of the recipient. type: String - contextPath: AbnormalSecurity.AbuseCampaign.recipientAddress description: The email address of the recipient. type: String - contextPath: AbnormalSecurity.AbuseCampaign.judgementStatus description: Judgement status of message. type: String - contextPath: AbnormalSecurity.AbuseCampaign.overallStatus description: Overall status of message. type: String - contextPath: AbnormalSecurity.AbuseCampaign.attackType description: The type of threat the message represents. type: String # Employee commands - arguments: - description: Email address of the employee you want to retrieve data for. name: email_address required: true - description: Returns test data if set to `True`. name: mock-data description: Get employee identity analysis (Genome) data. name: abnormal-security-get-employee-identity-analysis outputs: - contextPath: AbnormalSecurity.Employee.email description: Employee email. type: String - contextPath: AbnormalSecurity.Employee.histograms.key description: Genome key name. type: String - contextPath: AbnormalSecurity.Employee.histograms.name description: Genome title. type: String - contextPath: AbnormalSecurity.Employee.histograms.description description: Description of genome object. type: String - contextPath: AbnormalSecurity.Employee.histograms.values.value description: Category value. type: String - contextPath: AbnormalSecurity.Employee.histograms.values.percentage description: Ratio of this category relative to others. type: Number - contextPath: AbnormalSecurity.Employee.histograms.values.total_count description: Number of occurences for this category. type: Number - arguments: - description: Email address of the employee you want to retrieve data for. name: email_address required: true - description: Returns test data if set to `True`. name: mock-data description: Get employee information. name: abnormal-security-get-employee-information outputs: - contextPath: AbnormalSecurity.Employee.name description: Name of the employee. type: String - contextPath: AbnormalSecurity.Employee.email description: Email of the employee. type: String - contextPath: AbnormalSecurity.Employee.title description: Job title of the employee. type: String - contextPath: AbnormalSecurity.Employee.manager description: Email address of the employee's manager. type: String - arguments: - description: Email address of the employee you want to retrieve data for. name: email_address required: true - description: Returns test data if set to `True`. name: mock-data description: Get employee login information for last 30 days in csv format. name: abnormal-security-get-employee-last-30-days-login-csv - arguments: - description: Returns test data if set to `True`. name: mock-data - description: Email of the reporter. name: reporter required: true - description: Type of misjudgement reported. name: report_type required: true description: Submit an Inquiry to request a report on misjudgement by Abnormal Security. name: abnormal-security-submit-inquiry-to-request-a-report-on-misjudgement outputs: - contextPath: AbnormalSecurity.SubmitInquiry.detail description: Confirmation of inquiry sent. type: String - arguments: - description: Email address of the sender. name: sender_email required: true - description: Email address of the recipient. name: recipient_email required: true - description: Subject of email. name: subject required: true description: Submit a False Negative Report. name: abnormal-security-submit-false-negative-report - arguments: - description: URL link of threat log in abnormal security portal. name: portal_link required: true description: Submit a False Positive Report. name: abnormal-security-submit-false-positive-report - arguments: - description: Number of vendors that should appear on each page. Each page of data will have at most this many vendors. name: page_size - description: 1-indexed page number to get a particular page of vendors. name: page_number description: Get a list of vendors. name: abnormal-security-list-vendors outputs: - contextPath: AbnormalSecurity.VendorsList description: List of vendors. type: Unknown - contextPath: AbnormalSecurity.VendorsList.vendorDomain description: The domain of the vendor. type: String - arguments: - description: The domain name of the specific vendor for which you want to get details. name: vendor_domain required: true description: Get the details of a specific vendor. name: abnormal-security-get-vendor-details outputs: - contextPath: AbnormalSecurity.VendorDetails.vendorDomain description: The domain name of the vendor. type: String - contextPath: AbnormalSecurity.VendorDetails.riskLevel description: The risk level associated with the vendor. type: String - contextPath: AbnormalSecurity.VendorDetails.vendorContacts description: List of contacts related to the vendor. type: Unknown - contextPath: AbnormalSecurity.VendorDetails.companyContacts description: List of contacts related to the company. type: Unknown - contextPath: AbnormalSecurity.VendorDetails.vendorCountries description: List of countries associated with the vendor. type: Unknown - contextPath: AbnormalSecurity.VendorDetails.analysis description: List of analyses associated with the vendor. type: Unknown - contextPath: AbnormalSecurity.VendorDetails.vendorIpAddresses description: List of IP addresses associated with the vendor. type: Unknown - arguments: - description: Domain name for the vendor whose activity is to be retrieved. name: vendor_domain required: true description: Get the activity for a specific vendor. name: abnormal-security-get-vendor-activity outputs: - contextPath: AbnormalSecurity.VendorActivity.eventTimeline description: Event timeline for the vendor. type: Unknown - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.eventTimestamp description: Timestamp of the event in the vendor's activity timeline. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.eventType description: Type of event in the vendor's activity timeline. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.suspiciousDomain description: Suspicious domain involved in the event. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.domainIp description: IP address of the suspicious domain. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.ipGeolocation description: Geolocation of the IP address. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.attackGoal description: The goal of the attack. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.actionTaken description: Action taken in response to the event. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.hasEngagement description: Indicates whether the event involved any form of engagement. type: Boolean - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.recipient description: The recipient targeted by the event, if applicable. type: String - contextPath: AbnormalSecurity.VendorActivity.eventTimeline.threatId description: Unique identifier for the threat. type: String - arguments: - description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently only the keys `firstObservedTime` and `lastModifiedTime` are supported for `/vendor-cases`. At least one of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. Do note that provided filter time is in UTC. name: filter - description: Number of vendor cases that should appear on each page. Each page of data will have at most this many vendor cases. name: page_size - description: 1-indexed page number to get a particular page of vendor cases. name: page_number description: Get a list of vendor cases. name: abnormal-security-list-vendor-cases outputs: - contextPath: AbnormalSecurity.VendorCases description: List of vendor cases. type: Unknown - contextPath: AbnormalSecurity.VendorCases.vendorCaseId description: The identifier of the vendor case. type: Number - arguments: - description: The identifier of the vendor case to retrieve details for. name: case_id required: true description: Get the details of a vendor case. name: abnormal-security-get-vendor-case-details outputs: - contextPath: AbnormalSecurity.VendorCaseDetails.vendorCaseId description: The identifier of the vendor case. type: String - contextPath: AbnmoralSecurity.VendorCaseDetails.vendorDomain description: The vendor domain associated with the case. type: String - contextPath: AbnormalSecurity.VendorCaseDetails.firstObservedTime description: The time the vendor case was first observed. type: String - contextPath: AbnormalSecurity.VendorCaseDetails.lastModifiedTime description: The last time the vendor case was modified. type: String - contextPath: AbnormalSecurity.VendorCaseDetails.insights description: List of insights related to the vendor case. type: Unknown - contextPath: AbnormalSecurity.VendorCaseDetails.timeline description: Timeline of events related to the vendor case. type: Unknown - arguments: - description: The start time for retrieving the list of unanalyzed abuse mailbox campaigns. name: start - description: The end time for retrieving the list of unanalyzed abuse mailbox campaigns. name: end description: Get a list of unanalyzed abuse mailbox campaigns. name: abnormal-security-list-unanalyzed-abuse-mailbox-campaigns outputs: - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.abx_message_id description: An id which maps to an abuse campaign. type: Number - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.recipient.name description: The name of the recipient. type: String - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.recipient.email description: The email address of the recipient. type: String - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.reported_datetime description: The datetime the report was made. type: String - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.reporter.email description: The email address of the reporter. type: String - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.reporter.name description: The name of the reporter. type: String - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.subject description: The subject of the message. type: String - contextPath: AbnormalSecurity.UnanalyzedAbuseCampaigns.results.not_analyzed_reason description: The reason the message was not analyzed. type: String - arguments: - description: Returns test data if set to `True`. name: mock-data description: Get the latest threat intel feed. name: abnormal-security-get-latest-threat-intel-feed deprecated: true # SOAR Message Search and Respond Commands - arguments: - description: Message source (abnormal or quarantine). name: source required: true auto: PREDEFINED predefined: - abnormal - quarantine - description: Comma-separated list of tenant IDs. name: tenant_ids - description: Start time for the search in ISO 8601 format (e.g., 2024-01-01T00:00:00Z). name: start_time required: true - description: End time for the search in ISO 8601 format (e.g., 2024-01-31T23:59:59Z). name: end_time required: true - description: Filter by email subject. name: subject - description: Filter by sender email address. name: sender_email - description: Filter by sender name. name: sender_name - description: Filter by recipient email address. name: recipient_email - description: Filter by recipient name. name: recipient_name - description: Filter by attachment name. name: attachment_name - description: Filter by attachment MD5 hash. name: attachment_md5_hash - description: Filter by internet message ID. name: internet_message_id - description: Filter by body link/URL. name: body_link - description: Filter by sender IP address. name: sender_ip - description: Filter by judgement status. name: judgement auto: PREDEFINED predefined: - attack - borderline - spam - graymail - safe - description: Use regex for sender filtering (default false). name: use_sender_regex auto: PREDEFINED predefined: - 'true' - 'false' - description: Use regex for recipient filtering (default false). name: use_recipient_regex auto: PREDEFINED predefined: - 'true' - 'false' - description: Show graymail messages (default false). name: show_graymail auto: PREDEFINED predefined: - 'true' - 'false' - description: Page number (default 1). name: page_number - description: Page size (default 100, max 1000). name: page_size description: Search for messages using filters across abnormal or quarantine sources. name: abnormal-security-search-messages outputs: - contextPath: AbnormalSecurity.MessageSearch.results description: List of messages matching the search criteria. type: Unknown - contextPath: AbnormalSecurity.MessageSearch.results.abnormal_message_id description: Abnormal message identifier. type: String - contextPath: AbnormalSecurity.MessageSearch.results.subject description: Email subject. type: String - contextPath: AbnormalSecurity.MessageSearch.results.sender description: Sender email address. type: String - contextPath: AbnormalSecurity.MessageSearch.results.mailbox_name description: Mailbox name where the message was received. type: String - contextPath: AbnormalSecurity.MessageSearch.results.received_time description: Time when message was received. type: String - contextPath: AbnormalSecurity.MessageSearch.results.decision_category description: Decision category (malicious, spam, safe, graymail). type: String - contextPath: AbnormalSecurity.MessageSearch.results.judgement description: Judgement status (attack, borderline, spam, graymail, safe). type: String - contextPath: AbnormalSecurity.MessageSearch.total description: Total number of messages found. type: Number - contextPath: AbnormalSecurity.MessageSearch.pageNumber description: Current page number. type: Number - contextPath: AbnormalSecurity.MessageSearch.nextPageNumber description: Next page number. type: Number - arguments: - description: Action to perform on messages. name: action required: true auto: PREDEFINED predefined: - delete - move_to_inbox - submit_to_d360 - reclassify - description: Comma-separated list of tenant IDs. name: tenant_ids - description: Message source (abnormal or quarantine). name: source required: true auto: PREDEFINED predefined: - abnormal - quarantine - description: Reason for remediation. name: remediation_reason required: true auto: PREDEFINED predefined: - false_negative - misdirected - unsolicited - other - groups_remediation - quarantine_release - description: JSON string containing array of message objects to remediate. Required if remediate_all is false. name: messages - description: Whether to remediate all messages matching search filters (default false). name: remediate_all auto: PREDEFINED predefined: - 'true' - 'false' - description: Target folder for move actions (e.g., "Deleted Items"). name: target_folder - description: Whether to submit a Detection360 case (default false). name: submit_d360_case auto: PREDEFINED predefined: - 'true' - 'false' - description: Start time for search filters when remediate_all is true (ISO 8601 format). name: start_time - description: End time for search filters when remediate_all is true (ISO 8601 format). name: end_time - description: Subject filter when remediate_all is true. name: subject - description: Sender email filter when remediate_all is true. name: sender_email - description: Sender name filter when remediate_all is true. name: sender_name - description: Recipient email filter when remediate_all is true. name: recipient_email - description: Recipient name filter when remediate_all is true. name: recipient_name - description: Attachment name filter when remediate_all is true. name: attachment_name - description: Attachment MD5 hash filter when remediate_all is true. name: attachment_md5_hash - description: Internet message ID filter when remediate_all is true. name: internet_message_id - description: Body link/URL filter when remediate_all is true. name: body_link - description: Sender IP address filter when remediate_all is true. name: sender_ip - description: Judgement filter when remediate_all is true. name: judgement auto: PREDEFINED predefined: - attack - borderline - spam - graymail - safe - description: Use regex for sender filtering when remediate_all is true (default false). name: use_sender_regex auto: PREDEFINED predefined: - 'true' - 'false' - description: Use regex for recipient filtering when remediate_all is true (default false). name: use_recipient_regex auto: PREDEFINED predefined: - 'true' - 'false' - description: Show graymail messages when remediate_all is true (default false). name: show_graymail auto: PREDEFINED predefined: - 'true' - 'false' description: Remediate messages by performing actions like delete, move, or submit to Detection360. name: abnormal-security-remediate-messages outputs: - contextPath: AbnormalSecurity.MessageRemediation.activity_log_id description: Activity log ID for tracking the remediation request. type: Number - contextPath: AbnormalSecurity.MessageRemediation.metadata description: Metadata about the request. type: Unknown - arguments: - description: Comma-separated list of tenant IDs (will be sent as query parameters). name: tenant_ids - description: Filter by action type. name: action auto: PREDEFINED predefined: - search - remediation - csv_export - description: Page number (default 1). name: page_number - description: Page size (default 100, max 1000). name: page_size description: Get a list of activity logs for message search and remediation operations. name: abnormal-security-list-activities outputs: - contextPath: AbnormalSecurity.Activities.activities description: List of activity logs. type: Unknown - contextPath: AbnormalSecurity.Activities.activities.activity_id description: Activity log ID. type: Number - contextPath: AbnormalSecurity.Activities.activities.action description: Action type (search, remediate, csv_export). type: String - contextPath: AbnormalSecurity.Activities.activities.status description: Activity status. type: String - contextPath: AbnormalSecurity.Activities.activities.performed_by description: User who performed the action. type: String - contextPath: AbnormalSecurity.Activities.activities.timestamp description: Timestamp of the activity. type: String - contextPath: AbnormalSecurity.Activities.activities.result_count description: Number of results from the activity. type: Number - contextPath: AbnormalSecurity.Activities.total description: Total number of activities. type: Number - contextPath: AbnormalSecurity.Activities.page description: Current page number. type: Number - contextPath: AbnormalSecurity.Activities.size description: Page size. type: Number - arguments: - description: Activity log ID to get status for. name: activity_log_id required: true - description: Page number (default 1). name: page - description: Page size (default 100, max 1000). name: size description: Get the status and details of a specific activity log entry. name: abnormal-security-get-activity-status outputs: - contextPath: AbnormalSecurity.ActivityStatus.activity_id description: Activity log ID. type: Number - contextPath: AbnormalSecurity.ActivityStatus.action description: Action type. type: String - contextPath: AbnormalSecurity.ActivityStatus.status description: Activity status. type: String - contextPath: AbnormalSecurity.ActivityStatus.performed_by description: User who performed the action. type: String - contextPath: AbnormalSecurity.ActivityStatus.timestamp description: Timestamp of the activity. type: String - contextPath: AbnormalSecurity.ActivityStatus.result_count description: Number of results. type: Number - contextPath: AbnormalSecurity.ActivityStatus.remediation_details description: Detailed remediation information for each message. type: Unknown - contextPath: AbnormalSecurity.ActivityStatus.total description: Total number of remediation details. type: Number - arguments: - description: Abnormal message ID (can be negative). Obtained from message search results. name: message_id required: true - description: Name of the attachment to download. Obtained from message search results attachments field. name: attachment_name required: true - description: Tenant ID for the message. Obtained from message search results. name: tenant_id required: true - description: Cloud provider message ID (O365/GSuite). Obtained from message search results as raw_message_id. name: raw_message_id required: true - description: Cloud provider user ID. Obtained from message search results as native_user_id. name: native_user_id required: true - description: Mailbox email address. Obtained from message search results as mailbox_name. name: recipient_mailbox required: true description: Download an attachment from a message found in search results. All required parameters can be obtained from the abnormal-security-search-messages command output. name: abnormal-security-download-message-attachment - arguments: - description: The cloud_message_id from search results (format abx:CloudMessage:...). Use the cloud_message_id field from message search results. name: cloud_message_id required: true - description: Quarantine identifier (required only for quarantine messages). Obtained from quarantine_info.identity field in search results. name: quarantine_identity - description: Recipient email address (required only for quarantine messages). Obtained from mailbox_name field in search results. name: recipient_mailbox description: Download a message in RFC822 EML format for forensic analysis. For quarantine messages, both quarantine_identity and recipient_mailbox parameters are required. name: abnormal-security-download-message-eml dockerimage: demisto/python3:3.12.13.10116658 script: "" subtype: python3 type: python isfetch: true runonce: false fromversion: 6.0.0 tests: - No tests (auto formatted)