Abnormal Security Threats

Overview

Abnormal Security uses behavioral AI to detect email threats that bypass traditional secure email gateways (SEGs). Unlike signature or rule-based detection, Abnormal profiles normal communication patterns and detects deviations indicative of attacks. This skill covers threat types, attack vectors, severity assessment, remediation, and investigation workflows.

Anti-triggers

• An email a user reported to the abuse mailbox — those arrive as cases carrying their own AI judgment and action set; use Abnormal Security Cases.
• A mailbox behaving strangely rather than an email arriving — impossible travel, new inbox rules, and lateral sending are account compromise, and this server exposes no account-takeover surface at all. Investigate identity in the M365 tenant instead; use cipp-users.
• Header, SPF/DKIM/DMARC, or attachment forensics on one message — use Abnormal Security Messages.
• Releasing something from a quarantine queue — Abnormal has no gateway queue. It inspects mail post-delivery through the M365 API and pulls it back out of inboxes. Anything sitting in a hold queue belongs to the gateway holding it: SpamTitan Quarantine, Mimecast Message Tracking, or Proofpoint Quarantine.
• A threat the gateway already stopped — mail blocked before delivery never reaches the mailbox, so Abnormal never sees it. Search the gateway's own logs.
• The same mail flagged by Check Point Harmony Email — Avanan is the other API-based, post-delivery platform on this stack and produces its own threat records; use avanan-threats.

Threat Types

Type	Description	Severity Range
BEC (Business Email Compromise)	Impersonation of executives or trusted contacts to request financial actions	High - Critical
Credential Phishing	Emails designed to harvest credentials via fake login pages	Medium - Critical
Malware	Emails containing malicious attachments or links to malware downloads	High - Critical
Extortion	Threatening emails demanding payment (sextortion, DDoS threats)	Medium - High
Social Engineering	Manipulation attacks using urgency, authority, or trust	Medium - Critical
Spam	Unsolicited bulk email	Low
Graymail	Marketing, newsletters, and promotional content	Low
Scam	Advance-fee fraud, fake invoices, lottery scams	Medium - High
Supply Chain Compromise	Attacks from compromised vendor or partner email accounts	Critical

Detection Approach

Engine	Description	What It Detects
Behavioral AI	Models normal communication patterns per user/org	BEC, social engineering, impersonation
Content Analysis	NLP analysis of email body and intent	Urgency, financial requests, credential harvesting
Sender Profiling	Reputation and authentication of sender	Spoofing, domain impersonation, first-time senders
URL Analysis	Real-time scanning of embedded links	Credential phishing pages, malware delivery
Attachment Analysis	File inspection and sandboxing	Malware, ransomware payloads
VendorBase	Vendor risk intelligence network	Supply chain compromise, compromised vendor accounts

Threat Field Reference

Core Fields

Field	Type	Description
threatId	string	Unique threat identifier (UUID)
abxMessageId	long	Abnormal internal message ID
abxPortalUrl	string	Direct link to threat in Abnormal portal
attackType	string	BEC, PHISHING, MALWARE, EXTORTION, SPAM, etc.
attackStrategy	string	Specific attack strategy (e.g., "Invoice/Payment Fraud")
sentTime	datetime	When the email was sent
receivedTime	datetime	When the email was received
attackVector	string	How the attack was delivered (Link, Attachment, Text)
summaryInsights	string[]	AI-generated summary of why this is a threat

Sender Fields

Field	Type	Description
senderAddress	string	Sender email address
senderName	string	Sender display name
fromAddress	string	From header address
fromName	string	From header display name
replyToEmails	string[]	Reply-to addresses
returnPath	string	Return-path/envelope sender
senderIpAddress	string	Originating IP address
senderDomain	string	Sender domain
impersonatedParty	string	Who is being impersonated (if applicable)

Recipient Fields

Field	Type	Description
recipientAddress	string	Primary recipient
toAddresses	string[]	All To: addresses
ccAddresses	string[]	All CC: addresses

Remediation Fields

Field	Type	Description
remediationStatus	string	Auto-Remediated, Not Remediated, Post-Remediated
remediationTimestamp	datetime	When remediation action was taken
postRemediated	boolean	Whether email was remediated after delivery
isRead	boolean	Whether the recipient read the email

MCP Tools

Two tools cover the threat domain. There is no threat-level action tool — nothing here changes a threat's state, and abnormal_threats_get is a read.

Tool	Description	Parameters
abnormal_threats_list	List detected threats. Returns threat IDs plus summary only — no message bodies, no headers.	pageSize (default 100, max 100), pageNumber (1-indexed), filter (OData string)
abnormal_threats_get	Get one threat by ID, including its related message IDs.	threatId (required)

There is no date-range parameter. Narrow by time through the OData filter string: receivedTime gt 2026-03-20T00:00:00Z.

ID vocabulary

threatId is a UUID string. The neighbouring caseId used by abnormal_cases_get is a number. The two identifiers read alike in prose ("pull case 12345", "pull the case for that threat") and are not interchangeable — passing a threat UUID to abnormal_cases_get is a type error, not a lookup miss.

Tool Usage Examples

List recent threats:

{
  "tool": "abnormal_threats_list",
  "parameters": {
    "filter": "receivedTime gt 2026-03-20T00:00:00Z",
    "pageSize": 25
  }
}

Get threat details:

{
  "tool": "abnormal_threats_get",
  "parameters": {
    "threatId": "184def76-3c28-4e1b-9ef0-a5abc123def4"
  }
}

Threat Investigation Workflows

BEC Investigation Workflow

1. Review threat details - Check attackType, attackStrategy, summaryInsights
2. Analyze impersonation:
   • Who is being impersonated (impersonatedParty)
   • Display name vs actual email address mismatch
   • Reply-to vs from address mismatch
   • First-time sender or unusual communication pattern
3. Check financial indicators:
   • Wire transfer, ACH, or gift card requests
   • Invoice or payment redirection
   • Urgency language ("urgent", "today", "confidential")
4. Assess scope:
   • Re-run abnormal_threats_list over the window and correlate on sender in the results — there is no tenant-wide message search, so scope is assembled from threat records, not from a sender query
   • Check whether other threats in the window share the sender or domain
5. Remediate - abnormal_messages_list, then abnormal_remediation_manage per message (see Remediation is per-message). Alert targeted recipients directly. Sender-domain blocking is not an Abnormal action — do it at the gateway or in M365.
6. Document - Record findings and IOCs

Credential Phishing Investigation Workflow

1. Get threat details - Focus on attackVector and embedded URLs
2. Analyze URLs:
   • Check for brand impersonation (Microsoft, Google, Dropbox)
   • Look for redirect chains and URL shorteners
   • Identify credential harvesting pages
3. Check sender authentication:
   • SPF, DKIM, DMARC results
   • Domain age and reputation
4. Assess user interaction:
   • Was the email read (isRead)?
   • Was it post-remediated (delivered then removed)?
5. Remediate - loop abnormal_remediation_manage over every message in the threat. Password resets and domain blocks are outside this server entirely: run them through cipp-users or the M365 tenant.

Malware Investigation Workflow

1. Get attachment details - File name, type, size
2. Review AI insights - Check summaryInsights for behavioral indicators
3. Assess delivery:
   • Was the attachment opened?
   • How many users received the same attachment?
4. Remediate - loop abnormal_remediation_manage over every message in the threat. Hash blocking and endpoint isolation are EDR actions, not Abnormal ones.

Severity Assessment Matrix

Factor	Low	Medium	High	Critical
Attack Type	Spam, Graymail	Scam, Extortion	Phishing, BEC	Supply Chain, compromised internal sender
Recipients	1 user	2-10 users	10-50 users	50+ or executives
User Interaction	Not read	Read, no click	Link clicked	Credentials entered
Sender Profile	Known spam	Unknown external	Impersonation	Compromised internal
Financial Impact	None	Low value request	Wire/ACH request	Active fraud

Remediation is per-message, not per-threat

Remediation does not live in this domain. The only mutating tool on the server is abnormal_remediation_manage, and it requires both threatId and messageId:

Argument	Required	Notes
threatId	yes	UUID of the containing threat
messageId	yes	one specific message inside that threat
action	yes	remediate | unremediate | status

There is no "remediate this campaign" call. To act on a threat you must:

1. abnormal_threats_get — confirm the threat is what you think it is.
2. abnormal_messages_list — enumerate the messages inside it.
3. abnormal_remediation_manage — once per message, in a loop.

Why the loop is the hazard

The shape of the risk is not "one big blast radius decision". It is an N-call loop that can stop halfway.

• Partial failure leaves a campaign half-remediated. Rate limiting (60 req/min) or a single 4xx mid-loop means some recipients had the message pulled and others still have it in the inbox. Nothing in the API reports "the campaign is done" — only per-message results. Track which messageIds succeeded; do not infer completion from the first few.
• The message list is a point-in-time snapshot. A live campaign can land in more mailboxes while you are looping. Re-run abnormal_messages_list after the loop rather than trusting the original enumeration.
• action — not the tool name — decides the blast radius. status is a plain GET. remediate and unremediate are POSTs that move real mail. One tool name spans a safe read and a destructive write, so any allowlist keyed on tool name grants all three. An agent permitted to check status is, mechanically, permitted to unremediate.
• unremediate is not an undo. It delivers a message Abnormal classified as an attack back into a user's inbox. Treat it as a delivery decision requiring the same approval as the original remediation, not as a correction.

Verify with action: "status" per message after the loop.

Error Handling

Common API Errors

Code	Message	Resolution
400	Invalid filter parameter	Check filter syntax and valid field names
401	Unauthorized	Check API token validity
403	Insufficient permissions	Token needs threat detection scope
404	Threat not found	Verify threat ID
429	Rate limited	Wait and retry with exponential backoff

Best Practices

1. Prioritize by attack type - BEC and supply chain threats first
2. Check user interaction - Prioritize threats that were read or clicked
3. Review AI insights - summaryInsights explains why Abnormal flagged the email
4. Correlate account compromise elsewhere - A phishing campaign may lead to account compromise, but nothing on this server detects it; pivot to cipp-users
5. Monitor remediation status - Check action: "status" per message; there is no campaign-level status
6. Track post-remediation - Emails remediated after delivery need immediate attention
7. Never release confirmed threats - unremediate delivers a known attack; escalate to management instead

Related Skills

• Abnormal Cases - Abuse mailbox case management
• Abnormal Messages - Message analysis
• Abnormal API Patterns - API authentication and usage