> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-abnormal-api.md).

# Pull data from the Abnormal API

Use the **HTTP Pull** Listener to collect data from the [Abnormal REST API](https://abnormalsecurity.my.site.com/knowledgebase/s/article/Abnormal-REST-API-Integration).

This API is for managing threats to an organization identified by **Abnormal Security**. The organization should be integrated with Abnormal Security and enabled for real-time detection of malicious emails.

This API uses bearer authentication to retrieve events through paginated API calls.

{% hint style="warning" %}
This API restricts the IPs that consume the data from them through an IP whitelisting mechanism. To allow your organization’s IPs, your IP must be in the Abnormal portal specific IPv4 / IPv6 address list, or a range of addresses using a CIDR block.
{% endhint %}

We currently support the following types of data:

* [Abuse campaign](/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-abnormal-api/abuse-campaigns.md)
* [Audit logs](/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-abnormal-api/audit-logs.md)
* [Cases](/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-abnormal-api/cases.md)
* [Threats](/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-abnormal-api/threats.md)
* [Vendor cases](/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-abnormal-api/vendor-cases.md)