Abnormal Security Abuse Mailbox Cases

Overview

Abnormal Security's Abuse Mailbox automatically processes user-reported suspicious emails. When users forward or report emails to a designated abuse mailbox address, Abnormal analyzes the reported message and creates a case with an AI-generated judgment. This skill covers case lifecycle, triage workflows, remediation actions, and bulk operations.

Case Lifecycle

User Reports Email
       |
       v
  Case Created (status: Open)
       |
       v
  AI Analysis (judgment generated)
       |
       +---> Malicious   ---> Auto-Remediate (if configured)
       |
       +---> Suspicious  ---> Analyst Review Required
       |
       +---> Spam         ---> Auto-Dismiss (if configured)
       |
       +---> Safe         ---> Auto-Dismiss (if configured)
       |
       v
  Analyst Action
       |
       +---> Remediate (quarantine/delete across org)
       |
       +---> Mark Not Spam (release to inbox)
       |
       +---> Dismiss (close case, no action)
       |
       v
  Case Closed (status: Done)

Case Field Reference

Core Fields

Judgment Fields

Reported Message Fields

Case Judgments

MCP Tools

Tool Usage Examples

List open cases:

{
  "tool": "abnormal_cases_list",
  "parameters": {
    "filter": "overallStatus eq 'Open'",
    "pageSize": 25
  }
}

Get case details:

{
  "tool": "abnormal_cases_get",
  "parameters": {
    "caseId": "12345"
  }
}

Remediate a case:

{
  "tool": "abnormal_cases_action",
  "parameters": {
    "caseId": "12345",
    "action": "REMEDIATE"
  }
}

Triage Workflows

Standard Triage Workflow

1. List open cases - Get all cases with overallStatus eq 'Open'
2. Sort by severity - Address critical and high severity first
3. Review AI judgment:
   • If Malicious: verify and remediate across organization
   • If Spam: dismiss or move to junk
   • If Safe: dismiss and respond to reporter
   • If No Action Needed: dismiss (likely phishing simulation)
4. Take action - Remediate, dismiss, or mark not spam
5. Close case - Case moves to Done status after action

Bulk Triage Workflow

1. Filter cases by judgment - Start with cases judged as Malicious
2. Batch remediate - Remediate all confirmed Malicious cases
3. Review Suspicious - Manually review cases without clear judgment
4. Auto-dismiss Safe/Spam - Close remaining low-risk cases

Escalation Criteria

Escalate a case when:

• Multiple users report the same email
• The reported email impersonates an executive
• The email contains active malware or ransomware
• Credentials may have been entered on a phishing page
• The sender is a known vendor or partner (supply chain risk)

Case Actions

Error Handling

Common API Errors

Best Practices

1. Triage daily - Review abuse mailbox cases at least once per day
2. Trust the AI judgment - Abnormal's accuracy is high; use it to prioritize
3. Remediate org-wide - When a threat is confirmed, remediate for all recipients
4. Respond to reporters - Let users know their report was reviewed
5. Track phishing simulation reports - Monitor security awareness training effectiveness
6. Correlate with threats - Check if reported emails match known threat campaigns
7. Monitor false positive rate - High FP rates may indicate policy tuning needed

Related Skills

• Abnormal Threats - Threat detection and analysis
• Abnormal Messages - Message analysis
• Abnormal API Patterns - API authentication and usage