Abnormal Security

• New threatRuns when Abnormal adds a threat (an attack email campaign) to its threat log, with its sender, subject, kind of attack and each recipient's copy. Threats there when the workflow is turned on don't start it.
• Threat remediatedRuns when Abnormal takes a threat's emails out of inboxes, on its own or when someone asks, with each recipient's copy and its status. Threats remediated before the workflow is turned on don't start it.
• New caseRuns when Abnormal opens an account takeover case, with its severity, the employee it's about and Abnormal's summary. Cases open when the workflow is turned on don't start it.
• Case updatedRuns when an account takeover case is opened or changes in Abnormal, such as new activity or a new status, with the case as it is now.
• Case status changedRuns when someone acknowledges an account takeover case in Abnormal, or only when a case reaches the status you choose. Statuses cases had when the workflow was turned on don't start it.
• New AI Security Mailbox campaignRuns when employees report a new email campaign to AI Security Mailbox (formerly Abuse Mailbox), with its sender, subject and Abnormal's judgement. Campaigns reported before the workflow is turned on don't start it.
• Reported email not analyzedRuns when an employee reports an email to AI Security Mailbox and Abnormal doesn't analyze it, such as a phishing simulation or an email it couldn't find, with the reason, so someone can look at it.
• New vendor caseRuns when Abnormal opens a vendor case (a vendor whose email looks compromised), with what it noticed and the emails involved. A case quiet for 30 days that changes again starts it too.
• Misclassification report reviewedRuns when Abnormal moves a false positive or missed attack your organization reported (Detection 360) to a new status, such as Resolved, with its analysis. Reports sent in the last 30 days are watched.
• New audit log entryRuns when someone does something in the Abnormal portal, such as viewing an email or remediating a threat, with who, what and from where.

• List threatsList the IDs of threats in Abnormal's threat log, by when they were received or remediated, the kind of attack, sender, recipient or subject. Use 'Get threat' for each one's details.
• Get threatGet a threat (an email campaign): its subject, sender, kind of attack, and each recipient's copy with its remediation status.
• Remediate threatTake a threat's emails out of every inbox, or put them back. Abnormal does it in the background: 'Get threat action status' says when it's done.
• Get threat action statusCheck whether a remediation request on a threat is done, still running, or failed.
• Get threat linksList the links in a threat's emails, with their domains, such as to block them in a web filter.
• Get message remediation historyGet each remediation status one email has had, such as Auto-Remediated, and the folder it's in now.
• List casesList account takeover cases, by when they last changed. Needs Abnormal's Account Takeover product.
• Get caseGet an account takeover case: its status, severity, the employee it's about, its threats and Abnormal's summary.
• Update case statusAcknowledge a case (in progress, attack resolved or not an attack), mark it as needing action, or record that you remediated it yourself. 'Get case action status' says when it's done.
• Get case action statusCheck whether a change to a case is done, still running, or failed.
• Get case analysisGet what Abnormal noticed about a case, such as impossible travel, and its timeline of sign-ins, mail rules and emails sent.
• List AI Security Mailbox campaignsList the IDs of campaigns employees reported to AI Security Mailbox (formerly Abuse Mailbox). Without dates, the last 24 hours.
• Get AI Security Mailbox campaignGet a campaign employees reported: its subject, sender, who received it, when it was reported and Abnormal's judgement.
• List reported emails not analyzedList emails employees reported to AI Security Mailbox that Abnormal did not analyze, such as phishing simulations, and why. Without dates, the last 90 days.
• List vendorsList the vendors your organization emails with, riskiest first.
• Get vendorGet a vendor's risk level, the people on each side who email, where its email comes from and Abnormal's analysis.
• Get vendor activityGet what Abnormal has seen from a vendor: attacks from its domain, signals from other customers, and what Abnormal did.
• List vendor casesList the IDs of vendor cases: vendors whose email looks compromised. Use 'Get vendor case' for each one's details.
• Get vendor caseGet a vendor case: the vendor, what Abnormal noticed, and the emails involved.
• Get employeeGet an employee's name, job title and manager, as Abnormal knows them.
• Get employee identity analysisGet what's usual for an employee, such as the IP addresses, devices and places they sign in from, to compare a suspicious sign-in with.
• Get employee sign-insGet an employee's sign-ins over the last 30 days: when, from where, with which app and device, and whether each worked.
• List audit logsList who did what in the Abnormal portal, such as viewing an email or remediating a threat. Abnormal keeps 90 days.
• Report misclassified emailTell Abnormal it flagged a safe email (a false positive), or missed an attack, spam or graymail, so it can review it. Abnormal's answer shows in 'List misclassification reports'.
• List misclassification reportsList the false positives or missed attacks your organization reported (Detection 360), with where Abnormal is with each and its analysis. Without dates, the last 30 days.

No actions match that.