Details
Content
Dependencies
Version History

Abnormal Security detects and protects against the whole spectrum of email attacks

Abnormal Security

Abnormal Security detects the whole spectrum of email attacks, from vendor email compromise and spear-phishing to unwanted email spam and graymail. To stop these advanced attacks, Abnormal leverages the industry’s most advanced behavioral data science to baseline known good behavior and detects anomalies. The integration of Abnormal Security's SOAR API with Cortex XSOAR empowers security teams to respond to incidents with speed and helps to dramatically reduce mean time to respond.

What does this pack do?

The integration pack allows:
• Retrieving email threat campaign data using Cortex XSOAR
• Retrieving email anomaly cases using Cortex XSOAR

For more information on Abnormal Security, please visit www.abnormalsecurity.com

Abnormal Security

Abnormal Security detects the whole spectrum of email attacks, from vendor email compromise and spear-phishing to unwanted email spam and graymail. To stop these advanced attacks, Abnormal leverages the industry’s most advanced behavioral data science to baseline known good behavior and detects anomalies. The integration of Abnormal Security's SOAR API with Cortex XSIAM empowers security teams to respond to incidents with speed and helps to dramatically reduce mean time to respond.

What does this pack do?

The integration pack allows:
• Retrieving email threat campaign data using Cortex XSIAM
• Retrieving email anomaly cases using Cortex XSIAM

For more information on Abnormal Security, please visit www.abnormalsecurity.com

Classifiers

Name	Description
Abnormal Security - Incoming Mapper

Incident Fields

Name	Description
Abnormal Security Sent Time
Abnormal Security Recipient Name
Abnormal Security Received Time
Abnormal Security Abuse Campaign Judgement Status
Abnormal Security Sender IP Address
Abnormal Security Campaign ID
Abnormal Security Abuse Campaign First Reported
Abnormal Security Affected Employee
Abnormal Security Abuse Campaign Last Reported
Abnormal Security Threat IDs
Abnormal Security From Name
Abnormal Security Recipient Address
Abnormal Security Portal URL
Abnormal Security Threat ID
Abnormal Security Attack Strategy
Abnormal Security Reply To Emails
Abnormal Security Abuse Campaign From Name
Abnormal Security Abuse Campaign Overall Status
Abnormal Security First Reported
Abnormal Security Abuse Campaign Attack Type
Abnormal Security Message ID
Abnormal Security Case Status
Abnormal Security Judgement Status
Abnormal Security Attack Vector
Abnormal Security Attacked Party
Abnormal Security Attachment Names
Abnormal Security Severity
Abnormal Security Abuse Campaign From Address
Abnormal Security Summary Insights
Abnormal Security Abuse Campaign ID
Abnormal Security CC Emails
Abnormal Security Post Remediated
Abnormal Security Abuse Campaign Message ID
Abnormal Security Is Read
Abnormal Security Auto Remediated
Abnormal Security First Observed Time
Abnormal Security Abuse Campaign Recipient Address
Abnormal Security Severity Level
Abnormal Security Analysis
Abnormal Security Sender Domain
Abnormal Security Attachment Count
Abnormal Security Remediation Status
Abnormal Security Return Path
Abnormal Security Subject
Abnormal Security Last Reported
Abnormal Security To Addresses
Abnormal Security From Address
Abnormal Security Attack Type
Abnormal Security Overall Status
Abnormal Security Url Count
Abnormal Security Abuse Campaign Subject
Abnormal Security Internet Message ID
Abnormal Security Abuse Campaign Recipient Name
Abnormal Security Remediation Timestamp
Abnormal Security Impersonated Party
Abnormal Security Customer Visible Time
Abnormal Security Case ID

Incident Types

Name	Description
AbnormalSecurity

Integrations

Name	Description
Abnormal Security (Partner Contribution)	Abnormal Security detects the whole spectrum of email attacks, from vendor email compromise and spear-phishing to unwanted email spam and graymail. To stop these advanced attacks, Abnormal leverages the industry’s most advanced behavioral data science to baseline known good behavior and detects anomalies.

Classifiers

Name	Description
Abnormal Security - Incoming Mapper

Incident Fields

Name	Description
Abnormal Security Judgement Status
Abnormal Security Attachment Names
Abnormal Security Severity
Abnormal Security Received Time
Abnormal Security Abuse Campaign Judgement Status
Abnormal Security Sender Domain
Abnormal Security Attack Vector
Abnormal Security CC Emails
Abnormal Security Attack Type
Abnormal Security Overall Status
Abnormal Security Recipient Address
Abnormal Security Url Count
Abnormal Security Return Path
Abnormal Security Auto Remediated
Abnormal Security Impersonated Party
Abnormal Security Remediation Timestamp
Abnormal Security Summary Insights
Abnormal Security Case Status
Abnormal Security Threat ID
Abnormal Security Affected Employee
Abnormal Security Attachment Count
Abnormal Security Portal URL
Abnormal Security Message ID
Abnormal Security Last Reported
Abnormal Security Sent Time
Abnormal Security Abuse Campaign Attack Type
Abnormal Security Severity Level
Abnormal Security Campaign ID
Abnormal Security Is Read
Abnormal Security Attacked Party
Abnormal Security From Name
Abnormal Security Post Remediated
Abnormal Security Abuse Campaign From Name
Abnormal Security From Address
Abnormal Security Abuse Campaign Overall Status
Abnormal Security Subject
Abnormal Security Abuse Campaign ID
Abnormal Security Attack Strategy
Abnormal Security Abuse Campaign Subject
Abnormal Security Abuse Campaign First Reported
Abnormal Security Abuse Campaign Recipient Address
Abnormal Security Remediation Status
Abnormal Security First Reported
Abnormal Security Abuse Campaign Recipient Name
Abnormal Security Case ID
Abnormal Security Reply To Emails
Abnormal Security Abuse Campaign Last Reported
Abnormal Security Internet Message ID
Abnormal Security Abuse Campaign Message ID
Abnormal Security Customer Visible Time
Abnormal Security Analysis
Abnormal Security First Observed Time
Abnormal Security Recipient Name
Abnormal Security Sender IP Address
Abnormal Security Threat IDs
Abnormal Security Abuse Campaign From Address
Abnormal Security To Addresses

Incident Types

Name	Description
AbnormalSecurity

Integrations

Name	Description
Abnormal Security Event Collector	Abnormal Security Event Collector integration for XSIAM.
Abnormal Security (Partner Contribution)	Abnormal Security detects the whole spectrum of email attacks, from vendor email compromise and spear-phishing to unwanted email spam and graymail. To stop these advanced attacks, Abnormal leverages the industry’s most advanced behavioral data science to baseline known good behavior and detects anomalies.

Modeling Rules

Name	Description
Abnormal Security Event Collector

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

2.2.11 - 1748140 (December 4, 2024)

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37528
- 37524
- 37525
- 37526
- 37527

Download

2.2.10 - R1681986 (November 21, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 34511

Download

2.2.9 - R1051712 (May 28, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 34374

Download

2.2.8 - 1019707 (May 16, 2024)

Integrations

Abnormal Security

Fixed an issue in the abnormal-security-submit_false_positive_report command where the portal_link argument did not work as expected.
Fixed an issue in the abnormal-security-submit_false_negative_report command where the recipient_email argument did not work as expected.

Related pull requests:
- 34297
- 34366

Download

2.2.7 - 913451 (March 25, 2024)

Integrations

Abnormal Security

Added an additional search filters arguments (such as sender, recipient, subject, etc.) for the abnormal-security-list-abuse-mailbox-campaigns and abnormal-security-list-threats commands.
Updated the Docker image to: demisto/python3:3.10.14.90585.

Related pull requests:
- 33462
- 32959

Download

2.2.6 - 865088 (March 3, 2024)

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.10.13.88772.

Related pull requests:
- 33184

Download

2.2.5 - 823153 (February 12, 2024)

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.10.13.87159.

Related pull requests:
- 32837

Download

2.2.4 - 798475 (February 1, 2024)

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.10.13.86272.

Related pull requests:
- 32533

Download

2.2.3 - 757686 (January 11, 2024)

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.10.13.84405.

Related pull requests:
- 32061

Download

2.2.2 - 7190203 (December 17, 2023)

Integrations

Abnormal Security

Modified the occurred time source for incidents.

Related pull requests:
- 31522
- 31404

Download

2.2.1 - 7161298 (December 14, 2023)

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.10.13.83255.

Related pull requests:
- 31470

Download

2.2.0 - 7054275 (December 3, 2023)

Incident Fields

New: Abnormal Security Abuse Campaign From Address
New: Abnormal Security Post Remediated
New: Abnormal Security Analysis
New: Abnormal Security First Reported
New: Abnormal Security Severity
New: Abnormal Security Recipient Name
New: Abnormal Security Abuse Campaign ID
New: Abnormal Security Recipient Address
New: Abnormal Security Portal URL
New: Abnormal Security Attacked Party
New: Abnormal Security First Observed Time
New: Abnormal Security Subject
New: Abnormal Security Internet Message ID
New: Abnormal Security Severity Level
New: Abnormal Security Attachment Count
New: Abnormal Security Abuse Campaign From Name
New: Abnormal Security Judgement Status
New: Abnormal Security Abuse Campaign Subject
New: Abnormal Security Abuse Campaign Overall Status
New: Abnormal Security Message ID
New: Abnormal Security Reply To Emails
New: Abnormal Security Attack Strategy
New: Abnormal Security Is Read
New: Abnormal Security Abuse Campaign Judgement Status
New: Abnormal Security Threat ID
New: Abnormal Security Attachment Names
New: Abnormal Security Received Time
New: Abnormal Security Impersonated Party
New: Abnormal Security Sender Domain
New: Abnormal Security Remediation Timestamp
New: Abnormal Security Case Status
New: Abnormal Security From Name
New: Abnormal Security Affected Employee
New: Abnormal Security Abuse Campaign First Reported
New: Abnormal Security Abuse Campaign Message ID
New: Abnormal Security Case ID
New: Abnormal Security Url Count
New: Abnormal Security Remediation Status
New: Abnormal Security Return Path
New: Abnormal Security To Addresses
New: Abnormal Security Campaign ID
New: Abnormal Security Abuse Campaign Recipient Name
New: Abnormal Security Attack Vector
New: Abnormal Security From Address
New: Abnormal Security Sent Time
New: Abnormal Security Summary Insights
New: Abnormal Security Attack Type
New: Abnormal Security Threat IDs
New: Abnormal Security Abuse Campaign Last Reported
New: Abnormal Security Last Reported
New: Abnormal Security Customer Visible Time
New: Abnormal Security Auto Remediated
New: Abnormal Security Sender IP Address
New: Abnormal Security CC Emails
New: Abnormal Security Abuse Campaign Recipient Address
New: Abnormal Security Overall Status
New: Abnormal Security Abuse Campaign Attack Type

Incident Types

New: AbnormalSecurity

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.10.13.81631.

Mappers

New: Abnormal Security - Incoming Mapper

New: Abnormal Security Mapper (Available from Cortex XSOAR 6.9.0).

Related pull requests:
- 30393
- 31233

Download

2.1.3 - 7029664 (November 30, 2023)

Integrations

Abnormal Security

Updated the Docker image to: demisto/python3:3.10.13.80593.

Related pull requests:
- 31198

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	July 13, 2021
Last Release	December 4, 2024

Phishing

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.