servosity/msp-skills/abnormal

Abnormal Security - Claude Code Skill

Prerequisites: Install the CLI

This skill drives the abnormal-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/abnormal/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/abnormal/install.ps1 | iex ``

1. Verify: abnormal-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the abnormal-cli and abnormal-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

Every threat, case, vendor, employee, and dashboard operation from Abnormal's official API, plus a synced SQLite store that powers a ranked triage queue, joined employee-risk and vendor-risk investigation views, blocking remediate-watch confirmation, and a consolidated report-snapshot for client reporting. The incumbent integrations live inside SOAR and SIEM platforms; this runs in your terminal and your agents.

When to Use This CLI

Use this CLI for SOC work against an Abnormal Security tenant: triaging the email threat feed, confirming remediations, investigating account-takeover cases and vendor email compromise, pulling employee identity and login context, and producing security reports from the dashboard aggregations. It is the right choice whenever an agent needs Abnormal threat or case data in structured form, or needs to act on a threat and verify the action completed.

Anti-triggers

Do not use this CLI for:

• Quarantining or purging mail directly inside Microsoft 365 mailboxes - Abnormal remediates through its own actions; use Graph or Defender tooling for raw mailbox surgery
• Sending or composing email
• Changing Abnormal detection policies or integration settings - those are portal-only and not exposed by the REST API
• Continuous high-volume SIEM ingestion - use Abnormal's native Splunk/Elastic integrations for streaming pipelines

Unique Capabilities

SOC triage that compounds

• `triage` - Surface the newest, highest-severity, still-unremediated threats first so an analyst starts the shift on what actually matters.

_Reach for this when asked what email threats need attention now - it returns a ranked queue instead of a flat list._

``bash abnormal-cli triage --since 24h --top 20 --agent ``

• `remediate-watch` - Remediate a threat or case and block until Abnormal reports the action reached a terminal state, with a typed exit code and receipt.

_Use this when a remediation must be confirmed done, not just submitted - exit code 0 means the action completed._

``bash abnormal-cli remediate-watch threat 184712ab-6d8b-47b3-89d7-a314efef23ff --timeout 5m ``

Reporting and onboarding

• `report-snapshot` - Pull the key dashboard aggregations - attacks seen, attacks stopped, impersonation breakdowns, trending attacks - into one client-ready table or CSV.

_Use this to build a weekly or QBR security report without screenshotting dashboard panels._

``bash abnormal-cli report-snapshot --since 30d --csv ``

• `smoke` - Verify token, base URL (US/EU), and IP allowlist reachability using Abnormal's vendor-supplied test payloads - without touching real tenant data.

_Run this first when onboarding a tenant or rotating a token to prove connectivity before real queries._

``bash abnormal-cli smoke ``

Investigation joins

• `employee-risk` - One account-takeover risk picture per employee: profile, Genome identity analysis, 30-day login pattern, and open cases naming them.

_Use this when investigating a suspected account takeover to scope identity and blast radius in one call._

``bash abnormal-cli employee-risk vip@example.com --agent ``

• `vendor-risk` - One vendor-email-compromise picture per vendor: details, recent activity, and open vendor cases.

_Use this when a vendor's emails look suspicious to see their whole relationship and case history at once._

``bash abnormal-cli vendor-risk supplier.example.com --agent ``

Command Reference

abuse-mailbox - Manage abuse mailbox

• abnormal-cli abuse-mailbox - Get a list of messages submitted to AI Security Mailbox (formerly known as Abuse Mailbox) that were not analyzed.

abusecampaigns - Manage abusecampaigns

• abnormal-cli abusecampaigns retrieve - Get a list of campaigns submitted to AI Security Mailbox (formerly known as Abuse Mailbox)
• abnormal-cli abusecampaigns retrieve-2 - Get details of an abuse campaign

aggregations - Manage aggregations

• abnormal-cli aggregations attack-frequency-retrieve - Retrieve the frequency of specific attack types for a given period.
• abnormal-cli aggregations attack-stopped-retrieve - Retrieve aggregated counts of distinct attack types that were successfully stopped
• abnormal-cli aggregations attack-strategy-breakdown-retrieve - Retrieve the breakdown of attacks based on their strategy.
• abnormal-cli aggregations attack-vector-breakdown-retrieve - Retrieve the breakdown of attacks based on their vectors.
• abnormal-cli aggregations attacker-origin-retrieve - Retrieve the origin countries of attackers for a given period.
• abnormal-cli aggregations dashboard-summary-retrieve - Retrieve an aggregated summary of multiple security data points for the dashboard.
• abnormal-cli aggregations most-impersonated-employee-non-vip-retrieve - Retrieve the most impersonated non-VIP employees for a specified period.
• abnormal-cli aggregations most-impersonated-employee-retrieve - Retrieve the most impersonated employees for a specified period.
• abnormal-cli aggregations most-impersonated-employee-vip-retrieve - Retrieve the most impersonated VIP employees for a specified period.
• abnormal-cli aggregations most-impersonated-vendor-retrieve - Retrieve a list of the most impersonated vendors in attacks.
• abnormal-cli aggregations recipient-employees-non-vip-retrieve - Retrieve a list of the non-VIP employees who were recipients of attacks, based on their job titles.
• abnormal-cli aggregations recipient-employees-retrieve - Retrieve a list of the employees who were recipients of attacks, based on their job titles.
• abnormal-cli aggregations recipient-employees-vip-retrieve - Retrieve a list of the VIP employees who were recipients of attacks, based on their job titles.
• abnormal-cli aggregations sender-impersonation-breakdown-retrieve - Retrieve a breakdown of attacks based on sender impersonation.
• abnormal-cli aggregations trending-attacks-retrieve - Retrieve the list of trending attacks for a specified period.

api_resources - Manage api resources

• abnormal-cli api-resources resources-actions-create - Execute a specific action on a resource (refresh or validate). Returns 202 Accepted with action ID for tracking.
• abnormal-cli api-resources resources-create-create - Create a new resource with the specified name and optional description. Returns 201 Created with resource ID.
• abnormal-cli api-resources resources-retrieve - Retrieve a paginated list of resources with optional filtering using pageSize and pageNumber query parameters.
• abnormal-cli api-resources resources-retrieve-2 - Retrieve detailed information about a specific resource by its UUID.
• abnormal-cli api-resources resources-update-partial-update - Partially update an existing resource's fields (PATCH). Provide only the fields that need updating.

auditlogs - Manage auditlogs

• abnormal-cli auditlogs - Gets a list of Audit Logs for Portal

cases - APIs to manage Abnormal Cases

• abnormal-cli cases create - Account Takeover license is required to call this endpoint. Use this to update the status of an abnormal case.
• abnormal-cli cases retrieve - Get a list of Abnormal cases identified by Abnormal Security
• abnormal-cli cases retrieve-2 - Account Takeover license is required to call this endpoint.

detection360 - Manage detection360

• abnormal-cli detection360 reports-create - Use this to report a detection misclassification judgement by Abnormal Security.
• abnormal-cli detection360 reports-retrieve - Get a list of Detection 360 reports that you have submitted and view corresponding details for each case

email_search - Manage email search

• abnormal-cli email-search search-activities-retrieve - List activity logs for search and remediation operations. Optionally filter by tenant_ids query parameter (e.g., ?
• abnormal-cli email-search search-activities-status-retrieve - Get detailed status of a specific activity including remediation results.
• abnormal-cli email-search search-create - Search for email messages across Abnormal and Quarantine sources. Optionally filter by tenant_ids in the request body.
• abnormal-cli email-search search-messages-attachments-download-retrieve - Download an email attachment for a given message.
• abnormal-cli email-search search-messages-eml-retrieve - Download the EML file for a specific message by cloud_message_id. Returns the EML file content as message/rfc822 format.
• abnormal-cli email-search search-remediate-create - Remediate email messages by deleting, moving, or submitting them for review.

employee - Manage employee

• abnormal-cli employee <email_address> - Get employee information

messages - API to manage message details

roles - API to retrieve roles from RBAC system

• abnormal-cli roles - Fetch all roles for an account from RBAC system.

security-settings - API to retrieve security settings including session timeout configuration

• abnormal-cli security-settings - Fetch security settings for an account.

soar - Manage soar

• abnormal-cli soar - Fetch all API tokens for the authenticated customer from the Go Token Management Service.

spm-v2 - Manage spm v2

• abnormal-cli spm-v2 posture-catalog-retrieve - Get posture catalog containing all available abnormal supported postures
• abnormal-cli spm-v2 postures-query-create - Get a list of all tenant postures
• abnormal-cli spm-v2 postures-retrieve - Get detailed information about a specific security posture evaluation
• abnormal-cli spm-v2 postures-timeline-retrieve - Get timeline of events for a specific security posture
• abnormal-cli spm-v2 reports-summary-retrieve - Get summary report for all postures
• abnormal-cli spm-v2 workflow-logs-raw-json-retrieve - Get raw JSON for a workflow log

threats - APIs to manage threats notified in the Abnormal Threat Log

• abnormal-cli threats create - Use this to remediate or unremediate a threat.
• abnormal-cli threats retrieve - Get a list of threats
• abnormal-cli threats retrieve-2 - Get details of a threat

threats-export - Manage threats export

• abnormal-cli threats-export - Download data from Threat Log in .csv format

url-rewrite - Manage url rewrite

• abnormal-cli url-rewrite - Retrieve paginated click and clickthrough events for URL rewrites.

users - API to retrieve users from RBAC system

• abnormal-cli users - Retrieves users for an account from the RBAC user management system.

vendor-cases - Manage vendor cases