Threats

Overview

Coordinated, continuous series of malicious messages or actions that share common characteristics is called an Abuse Campaign.

Abnormal Security's behavioral AI detects and groups these related incidents so that they can be handled as a single threat, rather than dozens of individual alerts.

Configuration

Parameters

No parameters needed.

Secrets

• Authorization (abnormalToken)

Open the Secret fields and click New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

Learn more about secrets in Onum in this article.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the fields, or simply paste the given YAML:

Config as YAML

Toggle this ON to enable a free text field where you can paste your YAML.

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: false
withEnumerationPhase: true
enumerationPhase:
  paginationType: "page"
  pageSize: 100
  isZeroIndex: false
  request:
    responseType: json
    method: GET
    url: https://api.abnormalplatform.com/v1/abusecampaigns
    headers:
      - name: authorization
        value: Bearer ${secrets.abnormalToken}
    queryParams:
      - name: pageNumber
        value: "${pagination.pageNumber}"
      - name: pageSize
        value: "${pagination.pageSize}"
      - name: filter
        value: receivedTime gte ${temporalWindow.from} lte ${temporalWindow.to}
  output:
    select: "[.campaigns[].campaignId]"
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: campaignId
      expression: "."
      format: ""
  paginationType: none
  request:
    method: GET
    url: https://api.abnormalplatform.com/v1/abusecampaigns/${inputs.campaignId}
    headers:
      - name: authorization
        value: Bearer ${secrets.abnormalToken}
  output:
    select: "."
    map: "."
    outputMode: element

Manually configure

This HTTP Pull Listener now uses the data export API to extract alert events.

Click Create labels to move on to the next step and define the required Labels if needed.