abnormal-security

Audit for account takeover indicators and suspicious sign-ins in Abnormal Security

Review and triage abuse mailbox cases in Abnormal Security

Search for specific threat patterns in Abnormal Security by sender, recipient, attack type, or keywords

Triage recent email threats detected by Abnormal Security by severity and attack type

Check vendor risk scores and compromised vendor activity in Abnormal Security VendorBase

Use this agent when investigating email threats detected by Abnormal Security, analyzing attack chains, assessing user exposure, or managing remediation across client tenants. Trigger for: abnormal threat investigation, BEC attack, business email compromise, account takeover, phishing case, abnormal remediation, user reported phishing abnormal, abuse report review. Examples: "Investigate this Abnormal threat ID", "Show me all open BEC cases for Acme Corp", "Have any account takeovers been detected this week?", "Review and remediate today's abuse reports"

Use this agent when generating periodic threat landscape reports from Abnormal Security data across the MSP client portfolio — not for live threat investigation, but for summarizing attack trends, most targeted organizations, most common attack types, BEC attempt volumes, and remediation effectiveness over time. Trigger for: Abnormal threat report, email threat trends, Abnormal portfolio report, BEC trend report, phishing trend Abnormal, monthly Abnormal report, threat landscape email, attack volume report, Abnormal QBR, portfolio threat summary, Abnormal security review. Examples: "Generate the monthly email threat landscape report across all our Abnormal clients", "Which clients are being targeted the most this quarter?", "Show me the BEC attempt trend for the last 90 days", "What are the most common attack types across our portfolio this month?"

Use this skill when working with Abnormal Security account takeover (ATO) detection - suspicious sign-ins, impossible travel, compromised accounts, mailbox rule changes, and lateral movement indicators. Covers account takeover cases, investigation workflows, and remediation actions. Essential for MSP security analysts investigating compromised accounts detected by Abnormal Security.

Use this skill when working with the Abnormal Security REST API - Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, error handling, and common API patterns. Covers token management, request/response formats, and integration best practices. Essential for developers and MSP administrators integrating with the Abnormal Security API.

Use this skill when working with Abnormal Security abuse mailbox cases - user-reported emails, case triage, remediation actions, case lifecycle, and phishing simulation management. Covers case statuses, judgments, bulk actions, and MSP workflows for managing user-reported suspicious emails. Essential for MSP security analysts triaging abuse mailbox submissions in Abnormal Security.

Use this skill when working with Abnormal Security message analysis - email headers, attachments, sender reputation, delivery context, authentication results (SPF/DKIM/DMARC), and message metadata. Covers message retrieval, header inspection, and contextual analysis for incident investigation. Essential for MSP security analysts performing deep message analysis in Abnormal Security.

Use this skill when working with Abnormal Security threat detection and analysis - BEC, phishing, malware, socially-engineered attacks, spam, graymail, and credential theft. Covers threat types, attack vectors, severity assessment, remediation actions, and investigation workflows. Essential for MSP security analysts investigating email-borne threats detected by Abnormal Security's AI-powered behavioral engine.