# Threats

Collects and ingests email threat campaigns detected by Abnormal Security. Each campaign is expanded into one record per message — including BEC, phishing, malware, and extortion attacks — with full sender, recipient, attack-type, and remediation context.

**Sync Type: Incremental**

## Prerequisites

Before connecting Monad to Abnormal Security, you need:

1. An active Abnormal Security tenant with permission to manage API integrations
2. An Abnormal Security REST API key
3. Monad's egress IP addresses added to the Abnormal IP allowlist

## Setup Instructions

### 1. Generate an Abnormal Security API Key

1. **Log in to the Abnormal portal**:
   - Sign in at your tenant's Abnormal Security portal URL

2. **Navigate to the Integrations area**:
   - Go to **Settings** → **Integrations**
   - Open the **REST API** integration tile

3. **Create an API Key**:
   - Click **Generate API Key** (or **Create Token**)
   - Provide a descriptive name (e.g., "Monad Threats Connector")
   - Copy the generated token immediately — it cannot be retrieved later
   - **Important**: Store the API key securely. Never commit it to version control.

### 2. Identify Your Tenant's API Base URL

The Abnormal API base URL is region-specific.

1. In the Abnormal portal, go to **Settings** → **Integrations** → **REST API**
2. Note the base URL listed for your tenant (for example, `https://api.abnormalplatform.com`)

### 3. Allowlist Monad Egress IPs

Abnormal requires API clients to be on an allowlist. Provide the following IPs to your Abnormal administrator or Abnormal support:

- **Monad SaaS**: see [Monad egress IP addresses](../../guides/egress-ip-addresses.mdx)
- **Monad on-premises**: your Monad instance's egress IP address

Confirm the allowlist update has been applied before running the connector.

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

### Settings

| Setting | Type | Required | Description |
| ------- | ---- | -------- | ----------- |
| Base URL | string | Yes | API base URL for your Abnormal Security tenant (e.g. `https://api.abnormalplatform.com`). Region-specific. |
| API Key | string (secret) | Yes | Abnormal Security REST API key from the portal integration tile. Sent as a Bearer token in the Authorization header. |
| Backfill Start Time | string | No | The date to start fetching data from (ISO 8601 format, e.g., `2024-01-15T00:00:00Z`). If not specified, no past records will be fetched. |

## Troubleshooting

### Common Issues

1. **Authentication Failures (401 Unauthorized)**
   - Verify the API key is correct and has not been revoked
   - Confirm the Monad egress IPs are on the Abnormal allowlist
   - Regenerate the API key if you suspect it may have been compromised

2. **Wrong Base URL (404 / connection errors)**
   - The base URL is region-specific — confirm it matches the value shown in the Abnormal portal under Settings → Integrations → REST API
   - Ensure you have not included `/v1` in the configured Base URL

3. **Missing Threats or Messages**
   - The connector filters threats by `receivedTime` — set Backfill Start Time appropriately to retrieve historical campaigns
   - Threats purged from Abnormal between the list and detail fetches will be logged and skipped; this is expected behavior

4. **Rate Limiting**
   - The connector enforces an internal request rate limit
   - If you encounter rate limit errors, check whether other processes are using the same API key
   - Threat detail fetches are issued sequentially to keep memory and request rate bounded

## Related Articles

- [Abnormal Security REST API Spec](https://app.swaggerhub.com/apis-docs/abnormal-security/abx)
- [Abnormal Security REST API Overview](https://abnormalsecurity.my.site.com/knowledgebase/s/article/Abnormal-REST-API-Integration)

## Sample Record

```json
{
  "threatId": "184712ab-6d8b-47b3-89d3-a314efef79e2",
  "abxMessageIdStr": "4551618356913732000",
  "abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/4551618356913732076",
  "subject": "Phishing Email",
  "fromAddress": "support@secure-reply.org",
  "fromName": "Support",
  "senderDomain": "secure-reply.org",
  "toAddresses": "example@example.com, another@example.com",
  "recipientAddress": "example@example.com",
  "receivedTime": "2020-06-09T17:42:59Z",
  "sentTime": "2020-06-09T17:42:59Z",
  "internetMessageId": "<5edfca1c.1c69fb81.4b055.8fd5@mx.google.com>",
  "remediationStatus": "Auto Remediated",
  "attackType": "Extortion",
  "attackStrategy": "Name Impersonation",
  "returnPath": "support@secure-reply.org",
  "replyToEmails": ["reply-to@example.com"],
  "ccEmails": ["cc@example.com"],
  "senderIpAddress": "100.101.102.103",
  "impersonatedParty": "None / Others",
  "attackVector": "Text",
  "attachmentNames": ["attachment.pdf"],
  "attachmentCount": 1,
  "urls": ["https://www.google.com/"],
  "urlCount": 1,
  "summaryInsights": [
    "Bitcoin Topics",
    "Personal Information Theft",
    "Unusual Sender"
  ],
  "remediationTimestamp": "2020-06-09T17:42:59Z",
  "isRead": true,
  "attackedParty": "VIP",
  "autoRemediated": "True",
  "postRemediated": "False",
  "source": "Attack",
  "tenantId": 1000,
  "tenantName": "acme-corp",
  "customerOverride": {
    "overrideType": "Customer Blocklist",
    "reason": "Sender Email",
    "overrideJudgement": "malicious",
    "value": "support@secure-reply.org"
  }
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.