abnormal-security

Audit for account takeover indicators and suspicious sign-ins in Abnormal Security

Review and triage abuse mailbox cases in Abnormal Security

Search for specific threat patterns in Abnormal Security by sender, recipient, attack type, or keywords

Triage recent email threats detected by Abnormal Security by severity and attack type

Check vendor risk scores and compromised vendor activity in Abnormal Security VendorBase

Use this skill when working with Abnormal Security account takeover (ATO) detection - suspicious sign-ins, impossible travel, compromised accounts, mailbox rule changes, and lateral movement indicators. Covers account takeover cases, investigation workflows, and remediation actions. Essential for MSP security analysts investigating compromised accounts detected by Abnormal Security.

Use this skill when working with the Abnormal Security REST API - Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, error handling, and common API patterns. Covers token management, request/response formats, and integration best practices. Essential for developers and MSP administrators integrating with the Abnormal Security API.

Use this skill when working with Abnormal Security abuse mailbox cases - user-reported emails, case triage, remediation actions, case lifecycle, and phishing simulation management. Covers case statuses, judgments, bulk actions, and MSP workflows for managing user-reported suspicious emails. Essential for MSP security analysts triaging abuse mailbox submissions in Abnormal Security.

Use this skill when working with Abnormal Security message analysis - email headers, attachments, sender reputation, delivery context, authentication results (SPF/DKIM/DMARC), and message metadata. Covers message retrieval, header inspection, and contextual analysis for incident investigation. Essential for MSP security analysts performing deep message analysis in Abnormal Security.

Use this skill when working with Abnormal Security threat detection and analysis - BEC, phishing, malware, socially-engineered attacks, spam, graymail, and credential theft. Covers threat types, attack vectors, severity assessment, remediation actions, and investigation workflows. Essential for MSP security analysts investigating email-borne threats detected by Abnormal Security's AI-powered behavioral engine.

Use this skill when working with Abnormal Security VendorBase vendor risk assessment - vendor risk scores, compromised vendor detection, vendor domain analysis, and supply chain email threat monitoring. Covers vendor risk levels, risk factors, compromised vendor workflows, and vendor-related threat investigation. Essential for MSP security analysts monitoring third-party vendor risk via Abnormal Security.