> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-abnormal-api/threats.md).

# Threats

## Overview

Get a list of threats through the [Abnormal REST API](https://app.swaggerhub.com/apis/abnormal-security/abx/1.4.3#/Threats/v1_threats_retrieve) using the **HTTP Pull** Listener.

## HTTP Pull Listener configuration

In Falcon Onum, go to the **Listeners** area and click **New Listener > HTTP Pull**. Give a name to your new Listener and enter the following data:

### Parameters

N/A

### Secrets

You must define these credentials in Onum:

* `abnormalToken` will reference your Abnormal bearer token.

To do it, click **Add element** and enter a **Name** for the secret (in this case, `abnormalToken`). Then, click the **Value** field and select **New secret** to create a new one:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

You can now select the secret you just created in the **Value** field list.

{% hint style="info" %}
Learn more about secrets in Onum in [this article](/settings/organization-settings/secrets-management.md).
{% endhint %}

### Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

{% tabs %}
{% tab title="Config as YAML" %}
Toggle **ON** the **Config as YAML** option to enable a free text field where you can paste the following YAML:

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: false
withEnumerationPhase: true
enumerationPhase:
  paginationType: "page"
  pageSize: 100
  isZeroIndex: false
  request:
    responseType: json
    method: GET
    url: https://api.abnormalplatform.com/v1/threats
    headers:
      - name: authorization
        value: Bearer ${secrets.abnormalToken}
    queryParams:
      - name: pageNumber
        value: "${pagination.pageNumber}"
      - name: pageSize
        value: "${pagination.pageSize}"
      - name: filter
        value: receivedTime gte ${temporalWindow.from} lte ${temporalWindow.to}
  output:
    select: "[.threats[].threatId]"
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: threatId
      expression: "."
      format: ""
  paginationType: none
  request:
    method: GET
    url: https://api.abnormalplatform.com/v1/threats/${inputs.threatId}
    headers:
      - name: authorization
        value: Bearer ${secrets.abnormalToken}
  output:
    select: "."
    map: "."
    outputMode: element
```

{% endtab %}

{% tab title="Manually configure" %}
**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

* **Duration**<mark style="color:$primary;">**\***</mark> - `5m`
* **Offset**<mark style="color:$primary;">**\***</mark> - `5m`
* **Format**<mark style="color:$primary;">**\***</mark> - `RFC3339`

**Enumeration Phase**

Toggle **ON** to configure the enumeration phase. This API endpoint requires an initial request that will provide a list of alert IDs. In order to get the details about that information, it will require an additional request for those details.

* **Pagination Type**<mark style="color:red;">**\***</mark> - `page`
* **Zero index**<mark style="color:red;">**\***</mark> - `false`
* **Page Size**<mark style="color:red;">**\***</mark> - `100`&#x20;
* **Request**&#x20;
  * **Response Type**<mark style="color:red;">**\***</mark> - `JSON`
  * **Method**<mark style="color:red;">**\***</mark> - `GET`
  * **URL**<mark style="color:red;">**\***</mark> - `https://api.abnormalplatform.com/v1/threats`
  * **Headers**
    * **Name** - `authorization`&#x20;
    * **Value -** `Bearer ${secrets.abnormalToken}`
  * **Query Params**
    * **Name** - `pageNumber`&#x20;
    * **Value** - `${pagination.pageNumber}`
    * **Name** - `pageSize`
    * **Value** -  `${pagination.pageSize}`
    * **Name** - `Filter`
    * **Value** - `receivedTime gte ${temporalWindow.from} lte ${temporalWindow.to}`
* **Output**&#x20;
  * **Select**<mark style="color:$primary;">**\***</mark> - `[.threats[].threatId]`
  * **Map** - `.`
  * **Output Mode**<mark style="color:$primary;">**\***</mark> - `element`

**Collection Phase**&#x20;

* **Name** - `threatId`
* **Expression** - `.`&#x20;
* **Format** - `""`
* **Pagination Type**<mark style="color:red;">**\***</mark> - `None`
* **Request**&#x20;
  * **Method**<mark style="color:red;">**\***</mark> - `GET`
  * **URL**<mark style="color:red;">**\***</mark> - `https://api.abnormalplatform.com/v1/cases/${inputs.threatId}`
  * **Headers** &#x20;
    * **Name** - `authorization`
    * **Value** - `Bearer ${secrets.abnormalToken}`&#x20;
* **Output**&#x20;
  * **Select** - `.`
  * **Map** - `.`
  * **Output Mode** - `element`
    {% endtab %}
    {% endtabs %}

When you're done, click **Create labels** to move on to the next step and define the required [Labels](/listeners/labels.md) if needed.