Help us improve
Share bugs, ideas, or general feedback.
From abnormal-security
Analyzes Abnormal Security messages: email headers, attachments, sender reputation, delivery context, SPF/DKIM/DMARC authentication, and metadata for incident investigations.
npx claudepluginhub wyre-technology/msp-claude-plugins --plugin abnormal-securityHow this skill is triggered — by the user, by Claude, or both
Slash command
/abnormal-security:messagesThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Abnormal Security provides deep message analysis capabilities beyond basic threat detection. This skill covers message retrieval, header inspection, attachment analysis, sender authentication results, and delivery context. Use it when performing forensic analysis of specific emails or investigating delivery patterns.
Analyzes Abnormal Security email threats like BEC, phishing, malware, social engineering, spam, graymail, and credential theft. Covers threat types, attack vectors, severity assessment, remediation, and investigation workflows.
Analyzes Checkpoint Harmony Email (Avanan) threats including phishing, malware, BEC, ATO; extracts IOCs, builds threat timelines, assesses severity for email security investigations.
Guides Proofpoint Forensics and threat response for email-borne threats: auto-pull, search-and-destroy, message trace, evidence collection, and post-delivery remediation workflows.
Share bugs, ideas, or general feedback.
Abnormal Security provides deep message analysis capabilities beyond basic threat detection. This skill covers message retrieval, header inspection, attachment analysis, sender authentication results, and delivery context. Use it when performing forensic analysis of specific emails or investigating delivery patterns.
| Field | Type | Description |
|---|---|---|
abxMessageId | long | Abnormal internal message ID |
subject | string | Email subject line |
fromAddress | string | From header email address |
fromName | string | From header display name |
toAddresses | string[] | All To: recipients |
ccAddresses | string[] | All CC: recipients |
bccAddresses | string[] | All BCC: recipients (if available) |
sentTime | datetime | When the email was sent |
receivedTime | datetime | When the email was received by Abnormal |
internetMessageId | string | RFC 5322 Message-ID header |
| Field | Type | Description |
|---|---|---|
senderAddress | string | Envelope sender address |
senderName | string | Sender display name |
senderDomain | string | Sender domain |
senderIpAddress | string | Originating IP address |
returnPath | string | Return-Path header (envelope sender) |
replyToEmails | string[] | Reply-To header addresses |
| Field | Type | Description |
|---|---|---|
spfResult | string | SPF check result: pass, fail, softfail, neutral, none |
dkimResult | string | DKIM signature result: pass, fail, none |
dmarcResult | string | DMARC policy result: pass, fail, none |
authenticationResults | string | Full Authentication-Results header |
| Field | Type | Description |
|---|---|---|
attachmentCount | int | Number of attachments |
attachmentNames | string[] | Filenames of attachments |
attachmentTypes | string[] | MIME types of attachments |
attachmentSizes | int[] | Sizes of attachments in bytes |
| Field | Type | Description |
|---|---|---|
urls | string[] | All URLs found in message body |
urlCount | int | Total number of URLs |
| Field | Type | Description |
|---|---|---|
isRead | boolean | Whether the recipient has read the email |
isInternal | boolean | Whether the email is internal (within org) |
isExternal | boolean | Whether the email is from outside the org |
remediationStatus | string | Current remediation status |
| Tool | Description | Key Parameters |
|---|---|---|
abnormal_messages_get | Get full message details | threatId, abxMessageId |
abnormal_messages_list | List messages for a threat | threatId |
abnormal_messages_headers | Get raw email headers | threatId, abxMessageId |
Get message details:
{
"tool": "abnormal_messages_get",
"parameters": {
"threatId": "184def76-3c28-4e1b-9ef0-a5abc123def4",
"abxMessageId": 987654321
}
}
List messages associated with a threat:
{
"tool": "abnormal_messages_list",
"parameters": {
"threatId": "184def76-3c28-4e1b-9ef0-a5abc123def4"
}
}
invoice.pdf.exe).docm, .xlsm).zip, .rar, .7z) containing executables| Result | Meaning | Risk |
|---|---|---|
pass | Sending IP authorized by domain | Low |
softfail | IP not authorized but not explicitly denied | Medium |
fail | IP explicitly not authorized | High |
neutral | No SPF assertion | Medium |
none | No SPF record exists | Medium |
| Result | Meaning | Risk |
|---|---|---|
pass | Valid DKIM signature, aligned | Low |
fail | DKIM signature invalid | High |
none | No DKIM signature present | Medium |
| Result | Meaning | Risk |
|---|---|---|
pass | Passes DMARC policy (SPF or DKIM aligned) | Low |
fail | Fails DMARC policy | High |
none | No DMARC record exists | Medium |
| Code | Message | Resolution |
|---|---|---|
| 400 | Invalid message ID | Verify abxMessageId is a valid long integer |
| 401 | Unauthorized | Check API token |
| 404 | Message not found | Message may have been purged or threat ID is wrong |
| 429 | Rate limited | Wait and retry |