{"openapi":"3.0.3","info":{"title":"Abnormal Security Client API","version":"1.4.3","description":"This is the specification for Abnormal Security Client API which can be used for managing security threats detected by Abnormal Security.\n

Who is this API for?

\nThis API is for managing threats to an organization identified by Abnormal Security. The organization should be integrated with Abnormal Security and enabled for real-time detection of malicious emails.\n

Integration Steps

\nGo to `https://portal.abnormalsecurity.com/home/settings/integrations` & click on `Abnormal REST API`\n

Step 1: Generating the authentication token

\n\nRetrieve your authentication token via the Abnormal portal. You will use this token to view and modify your Abnormal-detected threats and cases.\n\nKeep the token safe, as it grants access to sensitive threat data related to your organization. Store it in a secure place, such as an encrypted password vault, and do not share it unless absolutely necessary. If you feel that the token has been compromised, please contact your Account Manager immediately.\n\nOnce obtained, the token can be used in a request from any HTTP client, such as cURL:\n
 curl -H \"Authorization: Bearer  << ACCESS_TOKEN >>\" https://api.abnormalplatform.com/v1/threats
\n\n

Step 2: IP allowlisting

\n\nIP allowlisting ensures that API access is only possible from IP addresses explicitly belonging to your organization. It prevents users from unauthorized networks to access your Abnormal SOAR data. This second layer of security helps keep your data safe from unauthorized users, and protects you in the event of a token compromise.\n\nTo allowlist your organization's IPs, please provide enter into the Abnormal portal specific IPv4 / IPv6 addresses, or a range of addresses using a CIDR block.\n\n

Step 3: Try it out with Test Data

\n\nTo confirm that Steps 1 & 2 have been configured properly, send a request to the server with the following header set:\n\n
 curl -H \"Authorization: Bearer  << ACCESS_TOKEN >>\" -H \"Mock-Data: True\" https://api.abnormalplatform.com/v1/threats
\n\nThe server should respond with a body payload similar to the examples specified in this documentation.\n\n

Note for EU Customers

\n\nIf you're a customer in the EU, you'll need to make API requests to our EU host `https://eu.rest.abnormalsecurity.com`. If you'd like to test the API through SwaggerHub, you'll find both the default host and the EU host in the Servers dropdown menu below.\n","termsOfService":"https://legal.abnormalsecurity.com/legal-hub/abnormal-security-api-terms-of-service-6feee5e3","contact":{"name":"Abnormal Security Support","email":"support@abnormalsecurity.com"}},"paths":{"/abuse_mailbox/not_analyzed":{"get":{"operationId":"v1_abuse_mailbox_not_analyzed_retrieve","summary":"Get a list of messages submitted to AI Security Mailbox (formerly known as Abuse Mailbox) that were not analyzed.","parameters":[{"in":"query","name":"start","schema":{"type":"string","format":"date-time"},"description":"The start of the datetime range, as an RFC 3339 timestamp, to fetch unanalyzed messages from. Defaults to 90 days before end.","examples":{"Start":{"value":"2022-01-01T00:00:00Z","summary":"start"}}},{"in":"query","name":"end","schema":{"type":"string","format":"date-time"},"description":"The end of the datetime range, as an RFC 3339 timestamp, to fetch unanalyzed messages from. Defaults to the current time.","examples":{"End":{"value":"2022-01-07T23:59:59Z","summary":"end"}}}],"tags":["AI Security Mailbox (formerly known as Abuse Mailbox)"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AbuseMailboxUnanalyzedResponse"}}},"description":"Unanalyzed message information"},"400":{"$ref":"#/components/responses/InvalidDateError"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/abusecampaigns":{"get":{"operationId":"v1_abusecampaigns_retrieve","summary":"Get a list of campaigns submitted to AI Security Mailbox (formerly known as Abuse Mailbox)","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the keys `lastReportedTime` and `receivedTime` are supported for `/abusecampaigns`. At least one of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. `lastReportedTime` defaults to the last 24h if unspecified. Do note that provided filter time is in UTC.","explode":false,"style":"spaceDelimited","examples":{"LastReportedTime":{"value":"lastReportedTime gte 2020-01-01T00:00:00Z lte 2021-12-01T00:00:00Z","summary":"lastReportedTime"}}},{"in":"query","name":"sender","schema":{"type":"string"},"description":"Filters threats based on the name or email address of the sender"},{"in":"query","name":"recipient","schema":{"type":"string"},"description":"Filters threats based on the name or email address of the recipient"},{"in":"query","name":"subject","schema":{"type":"string"},"description":"Filters threats based on the email subject"},{"in":"query","name":"reporter","schema":{"type":"string"},"description":"Filters threats based on the reporter name or email address"},{"in":"query","name":"attackType","schema":{"type":"string","enum":["Internal-to-Internal Attacks (Email Account Takeover)","Spam","Reconnaissance","Scam","Social Engineering (BEC)","Phishing: Credential","Invoice/Payment Fraud (BEC)","Malware","Extortion","Phishing: Sensitive Data","Other"]},"description":"Filters threats based on the type of attack"},{"in":"query","name":"threatType","schema":{"type":"string","enum":["All","Malicious","Safe","Spam"]},"description":"Filters threats based on the type of threat"},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":"Number of abuse campaigns shown on each page. Each page of data will have at most pageSize abuse campaign IDs."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of abuse campaigns. Has no effect if filter is not specified."},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["AI Security Mailbox (formerly known as Abuse Mailbox)"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedAbuseCampaings"}}},"description":"Returns a paginated list of abuse campaign IDs for each campaign in AI Security Mailbox (formerly known as Abuse Mailbox). The nextPageNumber field will be absent if there are no more pages of data."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/abusecampaigns/{campaign_id}":{"get":{"operationId":"v1_abusecampaigns_retrieve_2","summary":"Get details of an abuse campaign","parameters":[{"in":"path","name":"campaign_id","schema":{"type":"string"},"description":"A UUID representing the abuse campaign id","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["AI Security Mailbox (formerly known as Abuse Mailbox)"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AbuseCampaignDetails"}}},"description":"An abuse campaign identified by Abnormal Security."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/attack_frequency":{"get":{"operationId":"v1_aggregations_attack_frequency_retrieve","summary":"Retrieve the frequency of specific attack types for a given period.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_frequency` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters attacks by frequency based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttackFrequencyResponse"}}},"description":"A summary of attack frequencies. Represents the count of specific attack types for each reported timestamp."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/attack_stopped":{"get":{"operationId":"v1_aggregations_attack_stopped_retrieve","summary":"Retrieve aggregated counts of distinct attack types that were successfully stopped, including current and previous periods.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_stopped` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters attacks stopped based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttackStoppedResponse"}}},"description":"A summary of stopped attacks. Represents the count of attacks stopped for each attack type."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/attack_strategy_breakdown":{"get":{"operationId":"v1_aggregations_attack_strategy_breakdown_retrieve","summary":"Retrieve the breakdown of attacks based on their strategy.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_strategy_breakdown` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters attack strategy breakdown based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttackStrategyBreakdownResponse"}}},"description":"A breakdown of attacks based on their strategy."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/attack_vector_breakdown":{"get":{"operationId":"v1_aggregations_attack_vector_breakdown_retrieve","summary":"Retrieve the breakdown of attacks based on their vectors.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_vector_breakdown` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters attack vector breakdown based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttackVectorBreakdownResponse"}}},"description":"A breakdown of attacks based on their vectors."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/attacker_origin":{"get":{"operationId":"v1_aggregations_attacker_origin_retrieve","summary":"Retrieve the origin countries of attackers for a given period.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attacker_origin` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters attacker origins based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttackerOriginResponse"}}},"description":"A summary of attacker origins based on geographical regions and countries."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/dashboard_summary":{"get":{"operationId":"v1_aggregations_dashboard_summary_retrieve","summary":"Retrieve an aggregated summary of multiple security data points for the dashboard.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/dashboard_summary` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters the dashboard summary based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DashboardSummary"}}}},"description":"An aggregated list of security data points."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/most_impersonated_employee":{"get":{"operationId":"v1_aggregations_most_impersonated_employee_retrieve","summary":"Retrieve the most impersonated employees for a specified period.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_employee` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters impersonated employees based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MostImpersonatedEmployeeResponse"}}},"description":"A list of the most impersonated employees and related statistics."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/most_impersonated_employee_non_vip":{"get":{"operationId":"v1_aggregations_most_impersonated_employee_non_vip_retrieve","summary":"Retrieve the most impersonated non-VIP employees for a specified period.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_employee_non_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters impersonated non-VIP employees based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MostImpersonatedEmployeeNonVIPResponse"}}},"description":"A list of the most impersonated non-VIP employees and related statistics."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/most_impersonated_employee_vip":{"get":{"operationId":"v1_aggregations_most_impersonated_employee_vip_retrieve","summary":"Retrieve the most impersonated VIP employees for a specified period.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_employee_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters impersonated VIP employees based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MostImpersonatedEmployeeVIPResponse"}}},"description":"A list of the most impersonated VIP employees and related statistics."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/most_impersonated_vendor":{"get":{"operationId":"v1_aggregations_most_impersonated_vendor_retrieve","summary":"Retrieve a list of the most impersonated vendors in attacks.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_vendor` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters the most impersonated vendor data based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MostImpersonatedVendorResponse"}}},"description":"A list of the most impersonated vendors in attacks."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/recipient_employees":{"get":{"operationId":"v1_aggregations_recipient_employees_retrieve","summary":"Retrieve a list of the employees who were recipients of attacks, based on their job titles.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/recipient_employees` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters the recipient employees data based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecipientEmployeeResponse"}}},"description":"A list of the employees who were recipients of attacks, based on their job titles."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/recipient_employees_non_vip":{"get":{"operationId":"v1_aggregations_recipient_employees_non_vip_retrieve","summary":"Retrieve a list of the non-VIP employees who were recipients of attacks, based on their job titles.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/recipient_employees_non_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters the recipient non-VIP employees data based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecipientEmployeeNonVIPResponse"}}},"description":"A list of the non-VIP employees who were recipients of attacks, based on their job titles."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/recipient_employees_vip":{"get":{"operationId":"v1_aggregations_recipient_employees_vip_retrieve","summary":"Retrieve a list of the VIP employees who were recipients of attacks, based on their job titles.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/recipient_employees_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters the recipient VIP employees data based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecipientEmployeeVIPResponse"}}},"description":"A list of the VIP employees who were recipients of attacks, based on their job titles."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/sender_impersonation_breakdown":{"get":{"operationId":"v1_aggregations_sender_impersonation_breakdown_retrieve","summary":"Retrieve a breakdown of attacks based on sender impersonation.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/sender_impersonation_breakdown` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters sender impersonation breakdown based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SenderImpersonationResponse"}}},"description":"A breakdown of attacks based on sender impersonation."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/aggregations/trending_attacks":{"get":{"operationId":"v1_aggregations_trending_attacks_retrieve","summary":"Retrieve the list of trending attacks for a specified period.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/trending_attacks` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"}}},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","advanced"]},"description":"Filters trending attacks based on the source of detection."}],"tags":["Dashboard Aggregations"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrendingAttacksResponse"}}},"description":"A list of trending attacks and related statistics."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/auditlogs":{"get":{"operationId":"v1_auditlogs_retrieve","summary":"Gets a list of Audit Logs for Portal","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only key that are supported for `/auditlogs` is `timestamp`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ format`. We limit the results returned to the last 90 days and will default to that if no filter is supplied.","style":"spaceDelimited","examples":{"Timestamp":{"value":"timestamp gte 2020-01-01T01:01:01Z lte 2020-03-01T01:01:01Z","summary":"timestamp"}}},{"in":"query","name":"action","schema":{"type":"string"},"description":"Filters audit logs based on the action(s) taken. Accepts >= 1 options in a space-delimited string. Example: `view_message_content`","style":"spaceDelimited"},{"in":"query","name":"category","schema":{"type":"string"},"description":"Filters audit logs based on their category(ies).Accepts >= 1 options in a space-delimited string. Example: `abuse_mailbox threat_log`","style":"spaceDelimited"},{"in":"query","name":"status","schema":{"type":"string"},"description":"Filters audit logs based on their status"},{"in":"query","name":"sourceIp","schema":{"type":"string"},"description":"Filters audit logs based on their source IP address"},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":"Number of audit logs that are on each page. Each page of data will have at most pageSize audit logs."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of audit logs."}],"tags":["Audit Logs"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditLogResponse"}}},"description":"The audit logs based on filters specified. The nextPageNumber field will be absent if there are no more pages of data."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/cases":{"get":{"operationId":"v1_cases_retrieve","description":"Account Takeover license is required to call this endpoint.","summary":"Get a list of Abnormal cases identified by Abnormal Security","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only key that is supported for `/cases` is `lastModifiedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format.","explode":false,"style":"spaceDelimited","examples":{"LastModifiedTime":{"value":"lastModifiedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"lastModifiedTime"},"CreatedTime":{"value":"createdTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"createdTime"},"CustomerVisibleTime":{"value":"customerVisibleTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"customerVisibleTime"}}},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":"Number of cases that are on each page. Each page of data will have at most pageSize threats. Has no effect if filter is not specified."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of cases. Has no effect if filter is not specified."},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Cases"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedCases"}}},"description":"A list of the top 100 cases identified in Abnormal Cases if no filter query parameter is specified, or a paginated list of cases if a filter query parameter is specified. The pageNumber and nextPageNumber fields will be absent if no filter query parameter is used. The nextPageNumber field will be absent if there are no more pages of data."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/cases/{case_id}":{"get":{"operationId":"v1_cases_retrieve_2","description":"Account Takeover license is required to call this endpoint.","summary":"Get details of an Abnormal case","parameters":[{"in":"path","name":"case_id","schema":{"type":"string"},"description":"A string representing the case","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Cases"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AbnormalCaseDetails"}}},"description":"An Abnormal Case."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/CaseDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}},"post":{"operationId":"v1_cases_create","description":"Account Takeover license is required to call this endpoint. Use this to update the status of an abnormal case. The action field is contains the new case status.","summary":"Manage an Abnormal Case.","parameters":[{"in":"path","name":"case_id","schema":{"type":"string"},"description":"A string representing the case","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Cases"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostCaseRequest"}}},"required":true},"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostCaseResponse"}}},"description":"Accepted for processing."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/CaseDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/cases/{case_id}/actions/{action_id}":{"get":{"operationId":"v1_cases_actions_retrieve","description":"Account Takeover license is required to call this endpoint.","summary":"Check the status of an action requested on a case.","parameters":[{"in":"path","name":"case_id","schema":{"type":"string"},"description":"A string representing the case","required":true},{"in":"path","name":"action_id","schema":{"type":"string"},"description":"A UUID representing the action id for a case","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Cases"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionStatus"}}},"description":"Status of the action requested on a case. This API can be used to check the status of a request made to the threats. The response will return a descriptive string if the action on the threat could not be completed."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/ActionDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/cases/{case_id}/analysis":{"get":{"operationId":"v1_cases_analysis_retrieve","description":"Account Takeover license is required to call this endpoint.","summary":"Provides the analysis and timeline details of a case","parameters":[{"in":"path","name":"case_id","schema":{"type":"string"},"description":"A string representing the case","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Cases"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseAnalysis"}}},"description":"The analysis results and timeline of events for the case."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/detection360/reports":{"get":{"operationId":"v1_detection360_reports_retrieve","description":"Get a list of Detection 360 reports that you have submitted and view corresponding details for each case, including report summaries, statuses, message analyses, and more.","summary":"List Detection 360 reports for a specific type of detection misclassification.","parameters":[{"in":"query","name":"inquiry_type","schema":{"enum":["MISSED_ATTACK","FALSE_POSITIVE"],"type":"string","minLength":1},"description":"Whether to fetch missed attacks or false positives.","required":true},{"in":"query","name":"start","schema":{"type":"string","format":"date-time"},"description":"The start of the datetime range, as an RFC 3339 timestamp, to fetch Detection 360 cases from. Defaults to 30 days before end.","examples":{"Start":{"value":"2022-01-01T00:00:00Z","summary":"start"}}},{"in":"query","name":"end","schema":{"type":"string","format":"date-time"},"description":"The end of the datetime range, as an RFC 3339 timestamp, to fetch Detection 360 cases from. Defaults to the current time.","examples":{"End":{"value":"2022-01-07T23:59:59Z","summary":"end"}}},{"in":"query","name":"status","schema":{"type":"array","items":{"enum":["UNREVIEWED","CONTAINING_ATTACK","IMPROVING_PLATFORM","RESOLVED","CORRECTING_JUDGEMENT"],"type":"string"}},"description":"Only Detection 360 cases with these statuses will be retrieved. Defaults to all statuses."}],"tags":["Detection360"],"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Detection360Case"}}}},"description":"Successful operation"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}},"post":{"operationId":"v1_detection360_reports_create","description":"Use this to report a detection misclassification judgement by Abnormal Security. We use this data to improve our models, and also give customers transparency into the frequency of misclassifications.","summary":"Submit a detection misclassification report","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Detection360"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Detection360ReportRequest"}}}},"responses":{"202":{"description":"Report was submitted successfully."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/employee/{email_address}":{"get":{"operationId":"v1_employee_retrieve","summary":"Get employee information","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"path","name":"email_address","schema":{"type":"string"},"description":"Email address of the employee you want to retrieve data for","required":true}],"tags":["Employee Insights"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmployeeDetails"}}},"description":"Employee information for provided email address"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/employee/{email_address}/identity":{"get":{"operationId":"v1_employee_identity_retrieve","summary":"Get employee identity analysis (Genome) data","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"path","name":"email_address","schema":{"type":"string"},"description":"Email address of the employee you want to retrieve data for","required":true}],"tags":["Employee Insights"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmployeeIdentityDetails"}}},"description":"Employee identity analysis data derived from employee login data."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/employee/{email_address}/logins":{"get":{"operationId":"v1_employee_logins_retrieve","summary":"Get employee login information for last 30 days in csv format","parameters":[{"in":"path","name":"email_address","schema":{"type":"string"},"description":"Email address of the employee you want to retrieve data for","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Employee Insights"],"responses":{"200":{"content":{"text/csv":{"schema":{"type":"string","example":"Timestamp,User Principal Name,User Display Name,Status,IP Address,City,State,Country or Region,Latitude,Longitude,App Display Name,App ID,Client App Used,Browser,Operating System,Device ID,Resource Display Name"}}},"description":"A csv list of employee login information. Headers of the csv include the following in order:
- Timestamp
- User Principal Name
- User Display Name
- Status
- IP Address
- City
- State
- Country or Region
- Latitude
- Longitude
- App Display Name
- App ID
- Client App Used
- Browser
- Operating System
- Device ID
- Resource Display Name"},"401":{"content":{"text/csv":{"schema":{"$ref":"#/components/responses/UnauthorizedError"}}},"description":""},"403":{"content":{"text/csv":{"schema":{"$ref":"#/components/responses/ForbiddenError"}}},"description":""},"404":{"content":{"text/csv":{"schema":{"$ref":"#/components/responses/NotFoundError"}}},"description":""},"429":{"content":{"text/csv":{"schema":{"$ref":"#/components/responses/TooManyRequestsError"}}},"description":""}}}},"/messages/{message_id}/attachment/{attachment_name}":{"get":{"operationId":"v1_messages_attachment_retrieve","summary":"Get details of an attachment in an email message","parameters":[{"in":"path","name":"message_id","schema":{"type":"number"},"description":"The ABX Message Id of a message.","required":true},{"in":"path","name":"attachment_name","schema":{"type":"string"},"description":"The attachment name of an attachment belonging to an email message.","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Messages"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SoarAttachmentSignalsStruct"}}},"description":"Attachment details of an attachment in an email message."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/ThreatDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/messages/{message_id}/attachment/{attachment_name}/download":{"get":{"operationId":"v1_messages_attachment_download_retrieve","summary":"Download the attachment in an email as a file","parameters":[{"in":"path","name":"message_id","schema":{"type":"number"},"description":"The ABX Message Id of a message.","required":true},{"in":"path","name":"attachment_name","schema":{"type":"string"},"description":"The attachment name of an attachment belonging to an email message.","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Messages"],"responses":{"200":{"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}},"description":"The attachment file as an octet-stream. Will resolve into a file in the file system of the machine calling the request."},"401":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/responses/UnauthorizedError"}}},"description":""},"403":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/responses/ForbiddenError"}}},"description":""},"404":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/responses/NotFoundError"}}},"description":""},"429":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/responses/TooManyRequestsError"}}},"description":""}}}},"/messages/{message_id}/download":{"get":{"operationId":"v1_messages_download_retrieve","description":"Download the message contents in plaintext in the EML format. For security reasons, this API endpoint is disabled by default. Please talk to your customer specialist to get it enabled.","summary":"Download a message in EML format","parameters":[{"in":"path","name":"message_id","schema":{"type":"number"},"description":"The ABX Message Id of a message.","required":true}],"tags":["Messages"],"responses":{"200":{"content":{"message/rfc822":{"schema":{"type":"string","example":"From: sender@example.com\nTo: recipient@example.com\nSubject: Test Email\nDate: Thu, 23 Aug 2024 12:00:00 +0000\nContent-Type: text/plain; charset=\"UTF-8\"\n\nThis is the email body\n"}}},"description":"The EML file in plain text"},"401":{"content":{"message/rfc822":{"schema":{"$ref":"#/components/responses/UnauthorizedError"}}},"description":""},"403":{"content":{"message/rfc822":{"schema":{"$ref":"#/components/responses/ForbiddenError"}}},"description":""},"404":{"content":{"message/rfc822":{"schema":{"$ref":"#/components/responses/NotFoundError"}}},"description":""},"429":{"content":{"message/rfc822":{"schema":{"$ref":"#/components/responses/TooManyRequestsError"}}},"description":""}}}},"/messages/{message_id}/remediation_history":{"get":{"operationId":"v1_messages_remediation_history_retrieve","summary":"Get details of the remediation history for a threat log message","parameters":[{"in":"path","name":"message_id","schema":{"type":"number"},"description":"The ABX Message Id of a message.","required":true}],"tags":["Messages"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemediationHistory"}}},"description":"Remediation history for a threat log message."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/resources":{"get":{"operationId":"v1_resources_retrieve","description":"Retrieve a paginated list of resources with optional filtering using pageSize and pageNumber query parameters.","summary":"List resources with pagination and filtering","parameters":[{"in":"query","name":"pageSize","schema":{"type":"integer"},"description":"Number of results to return per page (default: 20, max: 100)"},{"in":"query","name":"pageNumber","schema":{"type":"integer"},"description":"Page number to retrieve (1-indexed, default: 1)"}],"tags":["Resources"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListResourcesResponse"}}},"description":"A paginated list of resources matching the filter criteria"},"400":{"$ref":"#/components/schemas/BadRequestError"},"401":{"description":"Authentication credentials were missing or invalid"},"403":{"description":"The request was valid but the server is refusing to respond to it"},"429":{"description":"Rate limit exceeded, please try again later"},"502":{"description":"Failed to communicate with upstream service"}}}},"/resources/{resource_id}":{"get":{"operationId":"v1_resources_retrieve_2","description":"Retrieve detailed information about a specific resource by its UUID.","summary":"Get a single resource by ID","parameters":[{"in":"path","name":"resource_id","schema":{"type":"string"},"description":"Unique identifier for the resource","required":true}],"tags":["Resources"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetResourceResponse"}}},"description":"The requested resource"},"401":{"description":"Authentication credentials were missing or invalid"},"403":{"description":"The request was valid but the server is refusing to respond to it"},"404":{"$ref":"#/components/schemas/NotFoundError"},"429":{"description":"Rate limit exceeded, please try again later"},"502":{"description":"Failed to communicate with upstream service"}}}},"/resources/{resource_id}/actions":{"post":{"operationId":"v1_resources_actions_create","description":"Execute a specific action on a resource (refresh or validate). Returns 202 Accepted with action ID for tracking.","summary":"Perform an action on a resource","parameters":[{"in":"path","name":"resource_id","schema":{"type":"string"},"description":"Unique identifier for the resource","required":true}],"tags":["Resources"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PerformAction"}}},"required":true},"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PerformActionResponse"}}},"description":"Action accepted and completed"},"400":{"$ref":"#/components/schemas/BadRequestError"},"401":{"description":"Authentication credentials were missing or invalid"},"403":{"description":"The request was valid but the server is refusing to respond to it"},"404":{"$ref":"#/components/schemas/NotFoundError"},"429":{"description":"Rate limit exceeded, please try again later"},"500":{"description":"An unexpected error occurred on the server"}}}},"/resources/{resource_id}/update":{"patch":{"operationId":"v1_resources_update_partial_update","description":"Partially update an existing resource's fields (PATCH). Provide only the fields that need updating.","summary":"Update an existing resource","parameters":[{"in":"path","name":"resource_id","schema":{"type":"string"},"description":"Unique identifier for the resource","required":true}],"tags":["Resources"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchedUpdateResource"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateResourceResponse"}}},"description":"Resource updated successfully"},"400":{"$ref":"#/components/schemas/BadRequestError"},"401":{"description":"Authentication credentials were missing or invalid"},"403":{"description":"The request was valid but the server is refusing to respond to it"},"404":{"$ref":"#/components/schemas/NotFoundError"},"429":{"description":"Rate limit exceeded, please try again later"},"500":{"description":"An unexpected error occurred on the server"}}}},"/resources/create":{"post":{"operationId":"v1_resources_create_create","description":"Create a new resource with the specified name and optional description. Returns 201 Created with resource ID.","summary":"Create a new resource","tags":["Resources"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateResource"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateResourceResponse"}}},"description":"Resource created successfully"},"400":{"$ref":"#/components/schemas/BadRequestError"},"401":{"description":"Authentication credentials were missing or invalid"},"403":{"description":"The request was valid but the server is refusing to respond to it"},"429":{"description":"Rate limit exceeded, please try again later"},"500":{"description":"An unexpected error occurred on the server"}}}},"/roles":{"get":{"operationId":"v1_roles_retrieve","description":"Fetch all roles for an account from RBAC system.\n\nThis endpoint retrieves a union of both account-specific roles and\nglobal (Abnormal-defined) roles for the authenticated account from\nthe RBAC service.","summary":"Get a list of roles for an account from RBAC system","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Roles"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleListResponse"}}},"description":"A list of roles available for the account."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"description":"Forbidden - Insufficient permissions"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/search":{"post":{"operationId":"v1_search_create","description":"Search for email messages across Abnormal and Quarantine sources. Optionally filter by tenant_ids in the request body. If tenant_ids is not provided, all authorized tenants are searched. The tenant_ids must be a subset of the tenants authorized by the bearer token.\n\n**Key Filter Fields:**\n- `body_link`: Filter by URLs found in the email body (e.g., phishing links, suspicious domains)\n- `judgement`: Filter by threat classification. Values: 'attack' (confirmed threats), 'borderline' (suspicious but not confirmed), 'spam' (unwanted bulk email), 'graymail' (legitimate bulk email), 'safe' (benign messages)\n- `judgement_source`: Filter by detection source. Values: 'ABNORMAL_SYSTEM' (flagged by Abnormal's own detection), 'CUSTOMER_AI_MODEL' (flagged by a customer-defined Custom AI Model). Only supported for `source=abnormal` (not quarantine).","summary":"Search for email messages","parameters":[{"in":"query","name":"pageNumber","schema":{"type":"integer"},"description":"Page number for pagination (default: 1)"},{"in":"query","name":"pageSize","schema":{"type":"integer"},"description":"Number of results per page (default: 100, max: 1000)"}],"tags":["Search and Respond"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchRequest"},"examples":{"AllAvailableSearchFilters":{"value":{"source":"abnormal","filters":{"start_time":"2024-01-01T00:00:00Z","end_time":"2024-01-31T23:59:59Z","subject":"Urgent: Payment Required","sender_email":"suspicious@external-domain.com","sender_name":"John Doe","recipient_email":"user@company.com","recipient_name":"Jane Smith","attachment_name":"invoice.pdf","internet_message_id":"","body_link":"https://suspicious-domain.com","sender_ip":"192.0.2.1","judgement":"attack","use_sender_regex":false,"use_recipient_regex":false},"tenant_ids":[123,456]},"summary":"All available search filters"},"SearchByDateAndSender":{"value":{"source":"abnormal","filters":{"start_time":"2024-01-01T00:00:00Z","end_time":"2024-01-31T23:59:59Z","sender_email":"suspicious@external-domain.com"},"tenant_ids":[123,456]},"summary":"Search by date and sender"},"SearchBySubjectAndJudgement":{"value":{"source":"abnormal","filters":{"start_time":"2024-01-01T00:00:00Z","end_time":"2024-01-31T23:59:59Z","subject":"Urgent: Payment Required","judgement":"attack"}},"summary":"Search by subject and judgement"},"SearchByCustomAIModel(CAIM)Detection":{"value":{"source":"abnormal","filters":{"start_time":"2024-01-01T00:00:00Z","end_time":"2024-01-31T23:59:59Z","judgement_source":"CUSTOMER_AI_MODEL"},"tenant_ids":[123]},"summary":"Search by Custom AI Model (CAIM) detection"}}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchResponse"},"examples":{"SuccessfulSearchResponse":{"value":{"results":[{"customer_id":100,"tenant_id":123,"received_time":"2024-01-15T10:30:00Z","subject":"Urgent: Wire Transfer Request","sender":"attacker@malicious.com","sender_display_name":"John Doe","mailbox_name":"user@company.com","mailbox_display_name":"User Name","current_folder_name":"Inbox","raw_message_id":"AAMkAGI2THVSAAA=","native_user_id":"user@company.com","cloud_message_id":"abx:CloudMessage:123:456","internet_message_id":"","abnormal_message_id":"abc123def456","abnormal_message_uuid":"uuid-123-456","decision_category":"attack","judgement":"attack","judgement_source":"CUSTOMER_AI_MODEL","judgement_source_model_id":"700","judgement_source_model_version":"19","attachments":{"invoice.pdf":{"name":"invoice.pdf","md5_hash":"d41d8cd98f00b204e9800998ecf8427e"}},"body_links":["https://suspicious-domain.com/phishing"],"sender_ip_addresses":["192.0.2.1"]}],"total":25,"pageNumber":1,"pageSize":100,"nextPageNumber":2,"metadata":{"trace_id":"abc-123-def-456","response_time":"2024-01-15T10:30:05Z"}},"summary":"Successful search response"}}}},"description":"Search completed successfully"},"400":{"description":"Invalid request parameters"},"401":{"description":"Authentication failed (invalid bearer token) or Authorization failed (requested tenant_ids not authorized by bearer token)"},"403":{"description":"API not enabled for this customer"},"500":{"description":"Internal server error"}}}},"/search/activities":{"get":{"operationId":"v1_search_activities_retrieve","description":"List activity logs for search and remediation operations. Optionally filter by tenant_ids query parameter (e.g., ?tenant_ids=123&tenant_ids=456). If tenant_ids is not provided, all authorized tenants are included. The tenant_ids must be a subset of the tenants authorized by the bearer token.","summary":"List activity logs","parameters":[{"in":"query","name":"tenant_ids","schema":{"type":"string"},"description":"Comma-separated list of tenant IDs to filter activities (e.g., '123,456' or '789'). If not provided, all authorized tenants are included."},{"in":"query","name":"pageNumber","schema":{"type":"integer"},"description":"Page number for pagination (default: 1)"},{"in":"query","name":"pageSize","schema":{"type":"integer"},"description":"Number of results per page (default: 100, max: 1000)"},{"in":"query","name":"action","schema":{"type":"string"},"description":"Filter by remediation action (e.g., delete, move_to_inbox)"}],"tags":["Search and Respond"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActivitiesResponse"},"examples":{"ActivitiesListResponse":{"value":{"activities":[{"activity_id":12345,"action":"delete","status":"completed","performed_by":"Rest API","timestamp":"2024-01-15T10:30:00Z","result_count":5,"parameters":{"tenant_ids":[123],"source":"abnormal"},"submit_d360_case":false},{"activity_id":12346,"action":"move_to_inbox","status":"in_progress","performed_by":"Rest API","timestamp":"2024-01-15T11:00:00Z","result_count":3,"parameters":{"tenant_ids":[456],"source":"abnormal","target_folder":"inbox"},"submit_d360_case":false}],"total":50,"pageNumber":1,"pageSize":100,"metadata":{"trace_id":"abc-123-def-456","response_time":"2024-01-15T11:05:00Z"}},"summary":"Activities list response"}}}},"description":"Activity logs retrieved successfully"},"400":{"description":"Invalid request parameters"},"401":{"description":"Authentication failed (invalid bearer token) or Authorization failed (requested tenant_ids not authorized by bearer token)"},"403":{"description":"API not enabled for this customer"},"500":{"description":"Internal server error"}}}},"/search/activities/{activity_log_id}/status":{"get":{"operationId":"v1_search_activities_status_retrieve","description":"Get detailed status of a specific activity including remediation results. Authorization is automatically determined by the bearer token - if the activity belongs to any tenant authorized by your token, you will be able to access it. The activity_log_id is returned in the response from the remediation endpoint. ","summary":"Get activity status","parameters":[{"in":"path","name":"activity_log_id","schema":{"type":"integer"},"description":"The activity log ID returned from the remediation request (use 'activity_log_id' field from remediation response)","required":true}],"tags":["Search and Respond"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActivityStatusResponse"},"examples":{"SuccessfulActivityStatus":{"value":{"activity_id":12345,"action":"delete","status":"completed","performed_by":"Rest API","timestamp":"2024-01-15T10:30:00Z","result_count":5,"remediation_details":[{"tenant_id":123,"raw_message_id":"AAMkAGI2THVSAAA=","status":"success","error_message":""},{"tenant_id":123,"raw_message_id":"BBMkAGI2THVSAAA=","status":"success","error_message":""}],"total":5,"pageNumber":1,"pageSize":100,"metadata":{"trace_id":"abc-123-def-456","response_time":"2024-01-15T10:30:01Z"}},"summary":"Successful activity status"}}}},"description":"Activity status retrieved successfully"},"400":{"description":"Invalid activity_log_id parameter"},"401":{"description":"Authentication failed (invalid bearer token) or the activity does not belong to any tenant authorized by your token"},"403":{"description":"API not enabled for this customer"},"404":{"description":"Activity not found"},"500":{"description":"Internal server error"}}}},"/search/messages/{message_id}/eml":{"get":{"operationId":"v1_search_messages_eml_retrieve","description":"Download the EML file for a specific message by cloud_message_id. Returns the EML file content as message/rfc822 format. For quarantine messages, provide both 'quarantineIdentity' and 'recipientMailbox' query parameters.","summary":"Download EML file for a message","parameters":[{"in":"path","name":"message_id","schema":{"type":"string"},"description":"The cloud_message_id from the Search API response (format: 'abx:CloudMessage:...'). Use the 'cloud_message_id' field from the search results.","required":true},{"in":"query","name":"quarantineIdentity","schema":{"type":"string"},"description":"Quarantine identity for quarantined messages. Required along with 'recipientMailbox' to download quarantine messages from S3 cache."},{"in":"query","name":"recipientMailbox","schema":{"type":"string"},"description":"Recipient mailbox email address for quarantined messages. Required along with 'quarantineIdentity' to download quarantine messages from S3 cache."}],"tags":["Search and Respond"],"responses":{"200":{"content":{"application/json":{"schema":{"type":"string","format":"binary"}}},"description":"EML file downloaded successfully (Content-Type: message/rfc822)"},"400":{"description":"Bad request - invalid message ID format"},"401":{"description":"Unauthorized - invalid or expired token"},"403":{"description":"Forbidden - API not enabled or unauthorized tenant access"},"404":{"description":"Not found - message does not exist or EML not available"},"500":{"description":"Internal server error"}}}},"/search/messages/attachments/download":{"get":{"operationId":"v1_search_messages_attachments_download_retrieve","description":"Download an email attachment for a given message.","summary":"Download email attachment","parameters":[{"in":"query","name":"message_id","schema":{"type":"integer"},"description":"Message ID","required":true},{"in":"query","name":"attachment_name","schema":{"type":"string"},"description":"Name of the attachment to download","required":true},{"in":"query","name":"tenant_id","schema":{"type":"integer"},"description":"Tenant ID","required":true},{"in":"query","name":"raw_message_id","schema":{"type":"string"},"description":"Raw message ID from cloud provider","required":true},{"in":"query","name":"native_user_id","schema":{"type":"string"},"description":"Native user ID from cloud provider","required":true},{"in":"query","name":"recipient_mailbox","schema":{"type":"string"},"description":"Recipient mailbox email address","required":true}],"tags":["Search and Respond"],"responses":{"200":{"content":{"application/json":{"schema":{"type":"string","format":"binary"}}},"description":"Attachment downloaded successfully (binary file)"},"400":{"description":"Invalid request parameters"},"401":{"description":"Unauthorized"},"404":{"description":"Attachment not found"},"502":{"description":"Failed to retrieve attachment from cloud provider. The message or attachment may have been moved, deleted, or remediated."},"500":{"description":"Internal server error"}}}},"/search/remediate":{"post":{"operationId":"v1_search_remediate_create","description":"Remediate email messages by deleting, moving, or submitting them for review. Returns an `activity_log_id` that can be polled via the **Get Activity Status** endpoint.\n\n---\n\n## Two modes of operation\n\n**Specific messages** (`remediate_all=false`):\nProvide a `messages` list. Each entry must include `tenant_id`, `raw_message_id`, `mailbox_name`, `native_user_id`, `subject`, `sender`, and `received_time`. The response returns an `activity_log_id`; poll **Get Activity Status** to retrieve per-message results.\n\n**Bulk / remediate-all** (`remediate_all=true`):\nProvide `search_filters` instead of `messages`. All messages matching the filters are remediated asynchronously. The response returns an `activity_log_id`; poll **Get Activity Status** to track progress.\n\n---\n\n## Actions\n\n| `action` | Description |\n|---|---|\n| `delete` | Move messages to the provider's deleted items / recoverable items folder |\n| `move_to_inbox` | Move messages to a specified folder (requires `target_folder`) |\n\nTo attach a Detection 360 case to a remediation, set `submit_d360_case: true` alongside any `action` above.\n\n---\n\n## Valid action / remediation_reason combinations\n\n| `action` | Allowed `remediation_reason` values |\n|---|---|\n| `delete` | `false_negative`, `unsolicited`, `other`, `groups_remediation` |\n| `move_to_inbox` | `quarantine_release`, `other`, `false_negative` |\n\n---\n\n## Validation rules\n\n- `search_filters` is **required** when `remediate_all=true`.\n- `messages` is **required** when `remediate_all=false`.\n- `target_folder` is **required** when `action=move_to_inbox`.\n- `remediation_reason=quarantine_release` is only valid when `source=quarantine`.\n- `search_filters.start_time` must be strictly before `search_filters.end_time`.\n- `use_sender_regex=true` in `search_filters` requires `sender_email` to be set.\n- `use_recipient_regex=true` in `search_filters` requires `recipient_email` to be set.\n- `submit_d360_case=true` requires `remediation_reason=false_negative`. Detection 360 only supports missed-attack inquiries today; other reasons are rejected at the API boundary.\n- `submit_d360_case=true` with `remediate_all=true` requires `search_filters.subject` to be set.\n- `submit_d360_case=true` with `messages` requires `abnormal_message_uuid` on every message.\n\n---\n\n## Tenant filtering\n\nOptionally provide `tenant_ids` to restrict remediation to a subset of tenants. If omitted, all tenants authorized by the bearer token are included. `tenant_ids` must be a subset of the tenants authorized by the bearer token.","summary":"Remediate email messages","tags":["Search and Respond"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemediationRequest"},"examples":{"DeleteSpecificMessages(falseNegative)":{"value":{"action":"delete","source":"abnormal","remediation_reason":"false_negative","submit_d360_case":false,"remediate_all":false,"messages":[{"tenant_id":123,"raw_message_id":"AAMkAGI2THVSAAA=","abnormal_message_id":"abc123def456","mailbox_name":"user@company.com","native_user_id":"user@company.com","subject":"Urgent: Wire Transfer Request","sender":"attacker@malicious.com","received_time":"2024-01-15T10:30:00Z"}],"tenant_ids":[123]},"summary":"Delete specific messages (false negative)"},"MoveSpecificMessagesToInbox(quarantineRelease)":{"value":{"action":"move_to_inbox","source":"quarantine","remediation_reason":"quarantine_release","target_folder":"inbox","submit_d360_case":false,"remediate_all":false,"messages":[{"tenant_id":123,"raw_message_id":"AAMkAGI2THVSAAA=","mailbox_name":"user@company.com","native_user_id":"user@company.com","subject":"Quarterly Report","sender":"partner@trusted.com","received_time":"2024-01-15T10:30:00Z"}],"tenant_ids":[123]},"summary":"Move specific messages to inbox (quarantine release)"},"BulkDeleteUsingSearchFilters(remediateAll)":{"value":{"action":"delete","source":"abnormal","remediation_reason":"false_negative","submit_d360_case":false,"remediate_all":true,"search_filters":{"start_time":"2024-01-01T00:00:00Z","end_time":"2024-01-31T23:59:59Z","sender_email":"attacker@malicious.com","judgement":"attack"},"tenant_ids":[123]},"summary":"Bulk delete using search filters (remediate_all)"},"DeleteWithD360CaseSubmission":{"value":{"action":"delete","source":"abnormal","remediation_reason":"false_negative","submit_d360_case":true,"remediate_all":false,"messages":[{"tenant_id":123,"raw_message_id":"AAMkAGI2THVSAAA=","abnormal_message_id":"abc123def456","abnormal_message_uuid":"550e8400-e29b-41d4-a716-446655440000","mailbox_name":"user@company.com","native_user_id":"user@company.com","subject":"Urgent: Wire Transfer Request","sender":"attacker@malicious.com","received_time":"2024-01-15T10:30:00Z"}],"tenant_ids":[123]},"summary":"Delete with D360 case submission"}}}},"required":true},"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemediationResponse"},"examples":{"RemediationAccepted":{"value":{"activity_log_id":12345,"metadata":{"trace_id":"abc-123-def-456","response_time":"2024-01-15T10:30:00Z"}},"summary":"Remediation accepted"}}}},"description":"Remediation request accepted. Poll GET /v1/search/activity/{activity_log_id} to retrieve results or track progress."},"400":{"description":"Invalid request. Common causes: missing required fields (`search_filters` when `remediate_all=true`, `messages` when `remediate_all=false`, `target_folder` when `action=move_to_inbox`), incompatible action/reason combination, `quarantine_release` reason with non-quarantine source, or invalid time range."},"401":{"description":"Authentication failed (invalid bearer token) or Authorization failed (requested tenant_ids not authorized by bearer token)"},"403":{"description":"API not enabled for this customer"},"409":{"description":"Concurrent remediation limit exceeded. Retry after the in-progress operation completes."},"500":{"description":"Internal server error"}}}},"/security-settings":{"get":{"operationId":"v1_security_settings_retrieve","description":"Fetch security settings for an account.\n\nThis endpoint retrieves security settings including session timeout\nconfiguration (inactivity timeout and max session time).","summary":"Get security settings including session timeout configuration","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Security Settings"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecuritySettingsResponse"}}},"description":"Security settings for the account including session timeout configuration."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"description":"Forbidden - Either insufficient permissions or feature not enabled for account"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/soar/tokens":{"get":{"operationId":"v1_soar_tokens_retrieve","description":"Fetch all API tokens for the authenticated customer from the Go Token Management Service.\n\nThis endpoint retrieves tokens with response format containing:\n- token_id: UUID of the token\n- name: Token name\n- version: Token version (v1 or v2)\n- status: Token status (active, expired, revoked)\n- created_at: ISO 8601 creation timestamp\n- expires_at: ISO 8601 expiration timestamp\n- permissions: List of permission strings (scope)","summary":"Get a list of API tokens for the authenticated customer","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"query","name":"limit","schema":{"type":"integer"},"description":"Maximum number of tokens to return (1-200, default 50)"},{"in":"query","name":"offset","schema":{"type":"integer"},"description":"Pagination offset (default 0)"},{"in":"query","name":"show_all","schema":{"type":"boolean"},"description":"Include expired/revoked tokens (default false)"},{"in":"query","name":"sort_by","schema":{"type":"string"},"description":"Sort field: created_at, -created_at, expires_at, -expires_at"}],"tags":["Tokens"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TokenListResponseSwagger"}}},"description":"A list of API tokens for the customer."},"400":{"description":"Bad Request - Invalid query parameters"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"description":"Forbidden - Either insufficient permissions or feature not enabled for account"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"},"500":{"description":"Internal Server Error"}}}},"/spm-v2/posture-catalog":{"get":{"operationId":"v1_spm_v2_posture_catalog_retrieve","description":"Get posture catalog containing all available abnormal supported postures","summary":"Get posture catalog containing all available abnormal supported postures","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":" Number of items on each page.Default 100. Each page of data will have at most pageSize items. Has no effect if filter is not specified."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of items. Has no effect if filter is not specified."}],"tags":["SPM"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostureCatalogResponse"}}},"description":"Returns the posture catalog with all available postures"},"400":{"description":"Bad Request"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/spm-v2/postures/{posture_id}":{"get":{"operationId":"v1_spm_v2_postures_retrieve","description":"Get detailed information about a specific security posture evaluation","summary":"Get detailed information about a specific security posture evaluation","parameters":[{"in":"path","name":"posture_id","schema":{"type":"integer"},"required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["SPM"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostureDetail"}}},"description":"Returns detailed posture information"},"400":{"description":"Bad Request"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/spm-v2/postures/{posture_id}/timeline":{"get":{"operationId":"v1_spm_v2_postures_timeline_retrieve","description":"Get timeline of events for a specific security posture","summary":"Get timeline of events for a specific security posture","parameters":[{"in":"path","name":"posture_id","schema":{"type":"integer"},"required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":" Number of items on each page.Default 100. Each page of data will have at most pageSize items. Has no effect if filter is not specified."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of items. Has no effect if filter is not specified."}],"tags":["SPM"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostureTimelineResponse"}}},"description":"Returns posture timeline events"},"400":{"description":"Bad Request"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/spm-v2/postures/query":{"post":{"operationId":"v1_spm_v2_postures_query_create","description":"Get a list of all tenant postures","summary":"Get a list of all tenant postures","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":" Number of items on each page.Default 100. Each page of data will have at most pageSize items. Has no effect if filter is not specified."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of items. Has no effect if filter is not specified."}],"tags":["SPM"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostureListParams"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostureListResponse"}}},"description":"Returns a list of all tenant postures"},"400":{"description":"Bad Request"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/spm-v2/reports/summary":{"get":{"operationId":"v1_spm_v2_reports_summary_retrieve","description":"Get summary report for all postures","summary":"Get summary report for all postures","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["SPM"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SPMReport"}}},"description":"Returns summary report for all postures"},"400":{"description":"Bad Request"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/spm-v2/workflow-logs/{workflow_log_id}/raw-json":{"get":{"operationId":"v1_spm_v2_workflow_logs_raw_json_retrieve","description":"Get raw JSON for a workflow log","summary":"Get raw JSON for a workflow log","parameters":[{"in":"path","name":"workflow_log_id","schema":{"type":"integer"},"required":true},{"in":"query","name":"workflow_log_id","schema":{"type":"integer"},"description":"Workflow Log ID","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["SPM"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowLogRawJson"}}},"description":"Returns raw JSON data for the workflow log"},"400":{"description":"Bad Request"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/threats":{"get":{"operationId":"v1_threats_retrieve","summary":"Get a list of threats","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the keys that are supported for `/threats` are `receivedTime` and `latestTimeRemediated`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ format`.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"receivedTime"},"LatestTimeRemediated":{"value":"latestTimeRemediated gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"latestTimeRemediated"}}},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":" Number of threats on each page. Each page of data will have at most pageSize threats. Has no effect if filter is not specified."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of threats. Has no effect if filter is not specified."},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","attacks","borderline","spam"]},"description":"Filters threats based on the source of detection. 'all' returns threats from all sources, 'spam' returns only spam threats, 'attacks' returns only attack threats, and 'borderline' returns only borderline threats."},{"in":"query","name":"sender","schema":{"type":"string"},"description":"Filters threats based on the name or email address of the sender"},{"in":"query","name":"recipient","schema":{"type":"string"},"description":"Filters threats based on the name or email address of the recipient"},{"in":"query","name":"subject","schema":{"type":"string"},"description":"Filters threats based on the email subject"},{"in":"query","name":"topic","schema":{"type":"string","enum":["Billing Account Update","Covid-19 Related Attack","Cryptocurrency","Invoice","Invoice Inquiry"]},"description":"Filters threats based on the topic of email contents"},{"in":"query","name":"attackType","schema":{"type":"string","enum":["Internal-to-Internal Attacks (Email Account Takeover)","Spam","Reconnaissance","Scam","Social Engineering (BEC)","Phishing: Credential","Invoice/Payment Fraud (BEC)","Malware","Extortion","Phishing: Sensitive Data","Other"]},"description":"Filters threats based on the type of attack"},{"in":"query","name":"attackVector","schema":{"type":"string","enum":["Link","Attachment","Text","Others","Attachment with Zipped File","QR Code","Calendar Invite","Spam Bomb"]},"description":"Filters threats based on the attack vector"},{"in":"query","name":"attackStrategy","schema":{"type":"string","enum":["Name Impersonation","Internal Compromised Email Account","External Compromised Email Account","Spoofed Email","Unknown Sender","Covid 19 Related Attack"]},"description":"Filters threats based on the attack strategy"},{"in":"query","name":"impersonatedParty","schema":{"type":"string","enum":["VIP","Assistants","Employee (other)","Brand","Known Partners","Automated System (Internal)","Automated System (External)","Unknown Partner","None / Others"]},"description":"Filters threats based on the impersonated party"}],"tags":["Threats"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedThreats"}}},"description":"A list of the IDs of the top 100 threats identified in Threat Log if no filter query parameter is specified, or a paginated list of threats if a filter query parameter is specified. The pageNumber and nextPageNumber fields will be absent if no filter query parameter is used. The nextPageNumber field will be absent if there are no more pages of data."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/threats/{threat_id}":{"get":{"operationId":"v1_threats_retrieve_2","summary":"Get details of a threat","parameters":[{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":"Number of messages corresponding to threat in each page. Each page of data will have at most pageSize message. Total results returned cannot exceed 2000 due to database limitations"},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of threat messages. Currently ignored, only 10 results for `messages` will show. Supported will be added in a future version. Total results returned cannot exceed 2000 due to database limitations"},{"in":"path","name":"threat_id","schema":{"type":"string"},"description":"A UUID representing the threat.","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Threats"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreatDetails"}}},"description":"A threat identified by Abnormal Security."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/ThreatDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}},"post":{"operationId":"v1_threats_create","description":"Use this to remediate or unremediate a threat. If the request is found to be something which can be processed, the server will return a '202 Accept' with an actionId and status URL in the response. This can be used to check the status of the request.","summary":"Manage a Threat identified by Abnormal Security","parameters":[{"in":"path","name":"threat_id","schema":{"type":"string"},"description":"A UUID representing the threat.","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Threats"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostThreatRequest"}}},"required":true},"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostThreatResponse"}}},"description":"Accepted for processing."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/ThreatDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/threats/{threat_id}/actions/{action_id}":{"get":{"operationId":"v1_threats_actions_retrieve","summary":"Check the status of an action requested on a threat.","parameters":[{"in":"path","name":"threat_id","schema":{"type":"string"},"description":"A UUID representing the threat.","required":true},{"in":"path","name":"action_id","schema":{"type":"string"},"description":"A UUID representing the action id for a threat.","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Threats"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionStatus"}}},"description":"Status of the action requested on a threat. This API can be used to check the status of a request made to the threats. The response will return a descriptive string if the action on threat could not be completed."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/ActionDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/threats/{threat_id}/attachments":{"get":{"operationId":"v1_threats_attachments_retrieve","summary":"Get attachment details of a threat campaign.","parameters":[{"in":"path","name":"threat_id","schema":{"type":"string"},"description":"A UUID representing the threat.","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Threats"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreatAttachmentsResponse"}}},"description":"Details of the attachments in a threat campaign. This API can be used to obtain the details of the links that are embedded in the email messages of a threat."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/ThreatDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/threats/{threat_id}/links":{"get":{"operationId":"v1_threats_links_retrieve","summary":"Get information of links in a threat campagin.","parameters":[{"in":"path","name":"threat_id","schema":{"type":"string"},"description":"A UUID representing the threat.","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Threats"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreatLinksResponse"}}},"description":"Details of the links in a threat campaign. This API can be used to obtain the details of the links that are embedded in the email messages of a threat."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/ThreatDoesNotExistError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/threats_export/csv":{"get":{"operationId":"v1_threats_export_csv_retrieve","summary":"Download data from Threat Log in .csv format","parameters":[{"in":"query","name":"format","schema":{"type":"string","enum":["csv","json"]}},{"in":"query","name":"filter","schema":{"type":"string"},"description":"Max time range is 14 days. If only one of the gte or lte filters are specified, the time range defaults to 1 day within the specified filter. If neither of the gte or lte filters are specified, the time range defaults to the previous date to the current date.","style":"spaceDelimited","examples":{"ReceivedTime":{"value":"receivedTime gte 2023-01-01T01:01:01Z lte 2023-01-14T01:01:01Z","summary":"receivedTime"}}},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"},{"in":"query","name":"source","schema":{"type":"string","default":"all","enum":["all","attacks","borderline","spam"]},"description":"Filters threats based on the source of detection. 'all' returns threats from all sources, 'spam' returns only spam threats, 'attacks' returns only attack threats, and 'borderline' returns only borderline threats."},{"in":"header","name":"Accept","schema":{"type":"string","enum":["application/json","text/csv"],"default":"application/json"},"description":"Controls the response format. Use 'text/csv' to receive data in CSV format, or 'application/json' for JSON format (default)."}],"tags":["Threats"],"responses":{"200":{"content":{"text/csv":{"schema":{"type":"string","example":"Date,From Display Name,From Email,Subject,Recipient Email,Job Title of Sender,Job Title of Recipient,Abnormals best guess of attack type,Abnormals best guess of attack strategy,Abnormals best guess of impersonated entity,Abnormals best guess of attack vector,Remediation Status,Remediation Time,Judgement,Abnormal Message ID,Threat ID,Tenant ID,Tenant Name\r\n2020-06-09T17:42:59Z,,support@secure-reply.org,Phishing Email,example@example.com,,,Extortion,Name Impersonation,None / Others,Text,Auto-Remediated,2020-06-09T18:00:00Z,Malicious,4551618356913732000,42,acme-corp"}}},"description":"A csv list of all messages in the Threat Log. Headers include the following in order:
- Date
- From Display Name
- From Email
- Subject
- Recipient Email
- Job Title of Sender
- Job Title of Recipient
- Abnormals best guess of attack type
- Abnormals best guess of attack strategy
- Abnormals best guess of impersonated entity
- Abnormals best guess of attack vector
- Remediation Status
- Remediation Time
- Judgement
- Abnormal Message ID
- Threat ID
- Tenant ID
- Tenant Name"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/url-rewrite/clicked-events":{"get":{"operationId":"v1_url_rewrite_clicked_events_retrieve","description":"Retrieve paginated click and clickthrough events for URL rewrites. Supports filtering by Unix time range, user email, and event type. Returns events where users clicked on rewritten URLs in email messages.","summary":"Get URL rewrite click and clickthrough events","parameters":[{"in":"query","name":"limit","schema":{"type":"integer"},"description":"Number of results to return per page (default: 20, max: 100)"},{"in":"query","name":"start","schema":{"type":"integer"},"description":"Start time of the time range to filter by (Unix timestamp)"},{"in":"query","name":"end","schema":{"type":"integer"},"description":"End time of the time range to filter by (Unix timestamp)"},{"in":"query","name":"recipient","schema":{"type":"string"},"description":"Email address recipient of the email message to filter by"},{"in":"query","name":"event_type","schema":{"type":"string"},"description":"Event type to filter by (Click/Clickthrough)"},{"in":"query","name":"offset","schema":{"type":"string"},"description":"Offset to use for pagination"}],"tags":["URL Rewrite"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClickedEventsResponse"}}},"description":"A paginated list of clicked events"},"400":{"$ref":"#/components/schemas/Error"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"},"500":{"$ref":"#/components/schemas/Error"}}}},"/users":{"get":{"operationId":"v1_users_retrieve","description":"Retrieves users for an account from the RBAC user management system.","summary":"Get a list of users from RBAC user management system","parameters":[{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Users"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserListResponse"}}},"description":"A list of users with their roles and resource permissions."},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"description":"Forbidden - Insufficient permissions"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/vendor-cases":{"get":{"operationId":"v1_vendor_cases_retrieve","summary":"Get a list of vendor cases.","parameters":[{"in":"query","name":"filter","schema":{"type":"string"},"description":"Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/vendor-cases` are `firstObservedTime` and `lastModifiedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ format`.","style":"spaceDelimited","examples":{"FirstObservedTime":{"value":"firstObservedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"firstObservedTime"},"LastModifiedTime":{"value":"lastModifiedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","summary":"lastModifiedTime"}}},{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":"Number of vendor cases that are on each page. Each page of data will have at most pageSize vendor cases. Has no effect if filter is not specified."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of vendor cases. Has no effect if filter is not specified."},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Vendors"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedVendorCases"}}},"description":"List of cases of the queried vendor"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/vendor-cases/{case_id}":{"get":{"operationId":"v1_vendor_cases_retrieve_2","summary":"Get details of a vendor case","parameters":[{"in":"path","name":"case_id","schema":{"type":"string"},"description":"The vendor case to query","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Vendors"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VendorCaseDetails"}}},"description":"Details of the queried vendor case"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/vendors":{"get":{"operationId":"v1_vendors_retrieve","summary":"Get a list of vendors your organization has interacted with","parameters":[{"in":"query","name":"pageSize","schema":{"type":"integer","minimum":1,"default":100},"description":"Number of vendors that are on each page. Each page of data will have at most pageSize threats. Has no effect if filter is not specified."},{"in":"query","name":"pageNumber","schema":{"type":"integer","minimum":1,"default":1},"description":"1-indexed page number to get a particular page of vendors. Has no effect if filter is not specified."},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Vendors"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedVendors"}}},"description":"A paginated list of 100 vendors ordered by risk level (highest risk first) followed by domain name"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/vendors/{vendor_domain}/activity":{"get":{"operationId":"v1_vendors_activity_retrieve","summary":"Get activity of a vendor your organization has interacted with","parameters":[{"in":"path","name":"vendor_domain","schema":{"type":"string"},"description":"The vendor domain to query","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Vendors"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VendorActivity"}}},"description":"Activity history of the queried vendor"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}},"/vendors/{vendor_domain}/details":{"get":{"operationId":"v1_vendors_details_retrieve","summary":"Get details of a vendor your organization has interacted with","parameters":[{"in":"path","name":"vendor_domain","schema":{"type":"string"},"description":"The vendor domain to query","required":true},{"in":"header","name":"mock-data","schema":{"type":"string","default":"False","enum":["False","True"]},"description":"Returns test data if set to `True`"}],"tags":["Vendors"],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VendorDetail"}}},"description":"Details of the queried vendor"},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/ForbiddenError"},"404":{"$ref":"#/components/responses/NotFoundError"},"429":{"$ref":"#/components/responses/TooManyRequestsError"}}}}},"components":{"responses":{"ActionDoesNotExistError":{"description":"Action does not exist"},"CaseDoesNotExistError":{"description":"Abnormal Case does not exist"},"ForbiddenError":{"description":"Access to the resource is forbidden (e.g. IP not in allowlist)"},"InvalidDateError":{"description":"A date provided is in the wrong format or the date range is wider than the allowed range for this endpoint"},"NotFoundError":{"description":"Invalid user input when using the filter query parameter. Will return various error messages"},"ThreatDoesNotExistError":{"description":"Threat does not exist"},"TooManyRequestsError":{"description":"Request count exceeds allowed number of concurrent requests for this resource type"},"UnauthorizedError":{"description":"Access token is missing or invalid"}},"schemas":{"AbnormalCase":{"type":"object","properties":{"caseId":{"type":"string","description":"A unique identifier for this case.","example":1234},"description":{"type":"string"},"severity_level":{"$ref":"#/components/schemas/SeverityLevel3eaEnum","description":"Description of the severity level for this case."},"confidence":{"$ref":"#/components/schemas/ConfidenceEnum","description":"The confidence level for this case."},"last_modified":{"type":"string","format":"date-time"},"first_observed":{"type":"string","format":"date-time"},"created":{"type":"string","format":"date-time"},"tenant":{"type":"string","nullable":true,"description":"The short name of the tenant associated with this case. Not returned for Azure Sentinel integrations.","example":"my-tenant"}},"required":["caseId","confidence","created","description","first_observed","last_modified","severity_level"]},"AbnormalCaseDetails":{"type":"object","properties":{"caseId":{"type":"string","description":"A unique identifier for this case.","example":1234},"case_status":{"$ref":"#/components/schemas/CaseStatusEnum"},"severity":{"type":"string","description":"Description of the severity level for this case.","example":"Potential Account Takeover"},"affectedEmployee":{"type":"string","description":"Which employee this case pertains to.","example":"FirstName LastName"},"customerVisibleTime":{"type":"string","format":"date-time"},"firstObserved":{"type":"string","format":"date-time","description":"First time suspicious behavior was observed.","example":"2020-06-09T17:42:59Z"},"threatIds":{"type":"array","items":{"type":"string"},"description":"Threats related to Case","example":["184712ab-6d8b-47b3-89d3-a314efef79e2"]},"analysis":{"type":"string"},"remediation_status":{"$ref":"#/components/schemas/RemediationStatusEnum"},"severity_level":{"$ref":"#/components/schemas/AbnormalCaseDetailsSeverityLevelEnum"},"confidence":{"$ref":"#/components/schemas/ConfidenceEnum","description":"The confidence level for this case."},"genai_summary":{"type":"array","items":{"type":"string"},"description":"List of AI-generated summary points for the case"},"tenant":{"type":"string","nullable":true,"description":"The short name of the tenant associated with this case. Not returned for Azure Sentinel integrations.","example":"my-tenant"}},"required":["affectedEmployee","analysis","caseId","case_status","confidence","customerVisibleTime","firstObserved","genai_summary","remediation_status","severity","severity_level","threatIds"]},"AbnormalCaseDetailsSeverityLevelEnum":{"enum":["NONE","LOW","MEDIUM","HIGH"],"type":"string"},"AbuseCampaign":{"type":"object","properties":{"campaignId":{"type":"string","description":"An id which maps to an abuse campaign.","example":"fff51768-c446-34e1-97a8-9802c29c3ebd"}},"required":["campaignId"]},"AbuseCampaignDetails":{"type":"object","properties":{"campaignId":{"type":"string","description":"An id which maps to an abuse campaign.","example":"fff51768-c446-34e1-97a8-9802c29c3ebd"},"firstReported":{"type":"string","format":"date-time","description":"Date abuse campaign was first reported.","example":"2020-11-11T13:11:40-08:00"},"lastReported":{"type":"string","format":"date-time","description":"Date abuse campaign was last reported.","example":"2020-11-11T13:11:40-08:00"},"messageId":{"type":"string","description":"A unique identifier for the first message in the abuse campaign.","example":-1234567891011121314},"subject":{"type":"string","description":"Subject of the first email in the abuse campaign.","example":"Fwd: This is spam"},"fromName":{"type":"string","description":"The display name of the sender.","example":"Support"},"fromAddress":{"type":"string","description":"The email address of the sender.","example":"support@secure-reply.org"},"recipientName":{"type":"string","description":"The display name of the recipient.","example":"Tom"},"recipientAddress":{"type":"string","description":"The email address of the recipient.","example":"example@example.com"},"judgementStatus":{"type":"string","description":"Judgement status of message.","example":"Malicious"},"overallStatus":{"type":"string","description":"Overall status of message.","example":"Could not find original message"},"attackType":{"type":"string","description":"The type of threat the message represents. This is only present for abuse campaigns judged Malicious or Spam","example":"Malicious: Phishing"}},"required":["attackType","campaignId","firstReported","fromAddress","fromName","judgementStatus","lastReported","messageId","overallStatus","recipientAddress","recipientName","subject"]},"AbuseMailboxUnanalyzedMessage":{"type":"object","properties":{"subject":{"type":"string","description":"Subject of the message","example":"Read me"},"abx_message_id":{"type":"integer"},"reported_datetime":{"type":"string","format":"date-time"},"recipient":{"$ref":"#/components/schemas/User"},"reporter":{"$ref":"#/components/schemas/User"},"not_analyzed_reason":{"$ref":"#/components/schemas/NotAnalyzedReasonEnum"}},"required":["abx_message_id","not_analyzed_reason","recipient","reported_datetime","reporter","subject"]},"AbuseMailboxUnanalyzedResponse":{"type":"object","properties":{"results":{"type":"array","items":{"$ref":"#/components/schemas/AbuseMailboxUnanalyzedMessage"},"description":"A list of representations of messages that were reported to AI Security Mailbox (formerly known as Abuse Mailbox) but not analyzed."}},"required":["results"]},"ActionEnum":{"enum":["search","remediation","csv_export"],"title":"ActionEnum","type":"string"},"ActionReasonEnum":{"enum":["false_negative","unsolicited","other","groups_remediation","quarantine_release"],"title":"ActionReasonEnum","type":"string"},"ActionStatus":{"type":"object","properties":{"status":{"$ref":"#/components/schemas/ActionStatusStatusEnum"},"description":{"type":"string","description":"Description of the action","example":"The request was completed successfully"},"tenantId":{"type":"integer","nullable":true,"description":"The tenant ID associated with the threat","example":1234},"tenantName":{"type":"string","nullable":true,"description":"The short name of the tenant associated with the threat","example":"example-tenant"}},"required":["description","status","tenantId","tenantName"]},"ActionStatusEnum":{"enum":["pending","success","partial_success","error"],"title":"ActionStatusEnum","type":"string"},"ActionStatusStatusEnum":{"enum":["acknowledged","in_progress","done","error"],"type":"string"},"ActivitiesResponse":{"properties":{"activities":{"items":{"$ref":"#/components/schemas/ActivityLogEntry"},"title":"Activities","type":"array"},"total":{"title":"Total","type":"integer"},"pageNumber":{"title":"Pagenumber","type":"integer"},"pageSize":{"title":"Pagesize","type":"integer"},"metadata":{"$ref":"#/components/schemas/MetaData"}},"required":["activities","total","pageNumber","pageSize","metadata"],"title":"ActivitiesResponse","type":"object"},"ActivityLogEntry":{"properties":{"activity_id":{"title":"Activity Id","type":"integer"},"action":{"$ref":"#/components/schemas/ActionEnum"},"status":{"$ref":"#/components/schemas/ActionStatusEnum"},"performed_by":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Performed By"},"timestamp":{"format":"date-time","title":"Timestamp","type":"string"},"result_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null,"title":"Result Count"},"parameters":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"default":null,"title":"Parameters"},"submit_d360_case":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"title":"Submit D360 Case"}},"required":["activity_id","action","status","timestamp"],"title":"ActivityLogEntry","type":"object"},"ActivityStatusResponse":{"properties":{"activity_id":{"title":"Activity Id","type":"integer"},"action":{"anyOf":[{"$ref":"#/components/schemas/ActionEnum"},{"type":"null"}],"default":null},"status":{"anyOf":[{"$ref":"#/components/schemas/ActionStatusEnum"},{"type":"null"}],"default":null},"performed_by":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Performed By"},"timestamp":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"default":null,"title":"Timestamp"},"result_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null,"title":"Result Count"},"remediation_details":{"anyOf":[{"items":{"$ref":"#/components/schemas/RemediationDetail"},"type":"array"},{"type":"null"}],"default":null,"title":"Remediation Details"},"total":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null,"title":"Total"},"metadata":{"$ref":"#/components/schemas/MetaData"}},"required":["activity_id","metadata"],"title":"ActivityStatusResponse","type":"object"},"Actor":{"type":"object","properties":{"display_name":{"type":"string","description":"Display name of the actor who performed the action","example":"ABNORMAL_SECURITY"}}},"Attachment":{"properties":{"name":{"title":"Name","type":"string"},"md5_hash":{"title":"Md5 Hash","type":"string"}},"required":["name","md5_hash"],"title":"Attachment","type":"object"},"AttackFrequency":{"type":"object","properties":{"timeStamp":{"type":"string","format":"date-time","description":"The date and time the attack was received.","example":"2023-08-11T12:34:56Z"},"attackType":{"type":"string","description":"The type of attack detected.","example":"Scam"},"attackCount":{"type":"integer","description":"The amount of attacks detected for the specified attack type.","example":200}},"required":["attackCount","attackType","timeStamp"]},"AttackFrequencyResponse":{"type":"object","properties":{"attack_frequency":{"type":"array","items":{"$ref":"#/components/schemas/AttackFrequency"},"description":"List detailing the timestamp, the type of attack, and the count of that attack type for the given timestamp."}},"required":["attack_frequency"]},"AttackStopped":{"type":"object","properties":{"attackTypeName":{"type":"string","description":"The type or category of the attack (e.g., 'all' for all types of attacks).","example":"all"},"attackCount":{"type":"integer","description":"The number of attacks detected over a specified period of time.","example":2000},"prevAttackCount":{"type":"integer","description":"The number of attacks detected prior to the defined time range.","example":2001}},"required":["attackCount","attackTypeName","prevAttackCount"]},"AttackStoppedResponse":{"type":"object","properties":{"attack_stopped":{"type":"array","items":{"$ref":"#/components/schemas/AttackStopped"},"description":"List detailing the type of attacks stopped, the current count of attacks stopped, and the previous count of attacks stopped."}},"required":["attack_stopped"]},"AttackStrategyBreakdown":{"type":"object","properties":{"attackStrategy":{"type":"string","description":"The specific strategy employed by the attacker.","example":"Name Impersonation"},"attackStrategyDescription":{"type":"string","description":"A brief explanation of the attack strategy.","example":"Uses sender name and/or email address to impersonate a party."},"attackCount":{"type":"integer","description":"The number of occurrences of the attack associated with the given strategy in the specified time frame.","example":200}},"required":["attackCount","attackStrategy","attackStrategyDescription"]},"AttackStrategyBreakdownResponse":{"type":"object","properties":{"attack_strategy_breakdown":{"type":"array","items":{"$ref":"#/components/schemas/AttackStrategyBreakdown"},"description":"List detailing the breakdown of attacks by strategy, along with the count for each strategy."}},"required":["attack_strategy_breakdown"]},"AttackVectorBreakdown":{"type":"object","properties":{"attackVectorGroup":{"type":"string","description":"The category or type of attack vectors used in cyber-attacks.","example":"attachment"},"attackCount":{"type":"integer","description":"The number of detected attacks associated with the specified attack vector.","example":200}},"required":["attackCount","attackVectorGroup"]},"AttackVectorBreakdownResponse":{"type":"object","properties":{"attack_vector_breakdown":{"type":"array","items":{"$ref":"#/components/schemas/AttackVectorBreakdown"},"description":"List detailing the breakdown of attacks by vector, along with the count for each vector."}},"required":["attack_vector_breakdown"]},"AttackerOrigin":{"type":"object","properties":{"regionName":{"type":"string","description":"The geographical region name.","example":"Asia"},"attackCount":{"type":"integer","description":"The count of attacks originating from the specified region.","example":1000},"countries":{"type":"array","items":{"$ref":"#/components/schemas/Country"}}},"required":["attackCount","countries","regionName"]},"AttackerOriginResponse":{"type":"object","properties":{"attacker_origin":{"type":"array","items":{"$ref":"#/components/schemas/AttackerOrigin"},"description":"List detailing the region, countries in that region, and the count of attacks originating from each country and region."}},"required":["attacker_origin"]},"AuditLog":{"type":"object","properties":{"action":{"type":"string","description":"(Optional) The specific action performed during the event. This field is optional and may not be present."},"actionDetails":{"allOf":[{"$ref":"#/components/schemas/AuditLogActionDetails"}],"description":"(Optional) The details of the action performed."},"category":{"type":"string","description":"The category of the performed action."},"sourceIp":{"type":"string","description":"The IP address of the device that caused the event."},"status":{"type":"string","description":"The result of the event. Returned as either SUCCESS or FAILURE."},"tenantName":{"type":"string","description":"Name of the tenant the user has access to."},"timestamp":{"type":"string","description":"Date/time when the event occurred in UTC."},"user":{"allOf":[{"$ref":"#/components/schemas/AuditLogUser"}],"description":"Information about the user who caused the event. Currently only includes the email address."}},"required":["category","sourceIp","status","tenantName","timestamp","user"]},"AuditLogActionDetails":{"type":"object","properties":{"messageId":{"type":"string","description":"ID of the message on which an action was performed."},"providedReason":{"type":"string","description":"Reason provided for performing the action."},"requestUrl":{"type":"string","description":"URL for the request."}}},"AuditLogResponse":{"type":"object","properties":{"auditLogs":{"type":"array","items":{"$ref":"#/components/schemas/AuditLog"}},"pageNumber":{"type":"integer","description":"Current page number of the results"},"nextPageNumber":{"type":"integer","description":"(Optional) Next page number to query for. Would not be returned if it was the last page"}},"required":["auditLogs","pageNumber"]},"AuditLogUser":{"type":"object","properties":{"email":{"type":"string","format":"email","description":"Email address of the user."}},"required":["email"]},"BadRequestError":{"type":"object","description":"400 Bad Request error response.","properties":{"error":{"type":"string","default":"Bad request","description":"The request was invalid or malformed"}}},"BenchmarksEnum":{"enum":["CIS"],"type":"string"},"CaseAnalysis":{"type":"object","properties":{"insights":{"type":"array","items":{"$ref":"#/components/schemas/CaseInsights"},"description":"List of case insights"},"eventTimeline":{"type":"array","items":{"$ref":"#/components/schemas/CaseEvent"},"readOnly":true,"description":"Timeline of flagged events on the case"}},"required":["eventTimeline","insights"]},"CaseEvent":{"oneOf":[{"$ref":"#/components/schemas/RiskEvent"},{"$ref":"#/components/schemas/SignInEvent"},{"$ref":"#/components/schemas/MailRuleEvent"},{"$ref":"#/components/schemas/OutboundMessageEvent"},{"$ref":"#/components/schemas/MFAFailureEvent"},{"$ref":"#/components/schemas/MismatchedMFALocationEvent"}]},"CaseInsights":{"type":"object","properties":{"signal":{"type":"string"},"description":{"type":"string"}},"required":["description","signal"]},"CaseStatusEnum":{"enum":["Action Required","Acknowledged (In progress)","Acknowledged (Attack resolved)","Acknowledged (Not an attack)"],"type":"string"},"ClickedEventsPaginationMetadata":{"type":"object","description":"Serializer for pagination metadata on the clicked events response.","properties":{"nextOffset":{"type":"string","nullable":true,"description":"Offset token for the next page if more results exist"},"limit":{"type":"integer","nullable":true,"description":"Limit of the results"}}},"ClickedEventsResponse":{"type":"object","description":"Serializer for clicked events response.\n\nNote: the \"data\" field is injected below via `_declared_fields` because a\nclass attribute named `data` would shadow DRF's `Serializer.data` property\n(basedpyright also flags the conflict).","properties":{"metadata":{"allOf":[{"$ref":"#/components/schemas/ClickedEventsResponseMetadata"}],"description":"Response metadata including pagination"},"data":{"type":"array","items":{"$ref":"#/components/schemas/SoarClickedEvent"},"description":"List of clicked events"}},"required":["data","metadata"]},"ClickedEventsResponseMetadata":{"type":"object","description":"Serializer for response metadata containing pagination information.","properties":{"pagination":{"allOf":[{"$ref":"#/components/schemas/ClickedEventsPaginationMetadata"}],"description":"Pagination information for the response"},"requestId":{"type":"string","nullable":true,"description":"Request ID for the API request"}},"required":["pagination"]},"ConfidenceEnum":{"enum":["LOW","MEDIUM","HIGH"],"type":"string"},"Country":{"type":"object","properties":{"regionName":{"type":"string","description":"The geographical region name for the country. (This will be repetitive within the region array.)","example":"Asia"},"country":{"type":"string","description":"The name of the country.","example":"India"},"countryCode":{"type":"string","description":"The country code.","example":"IN"},"latitude":{"type":"string","description":"Latitude of the country.","example":20.5937},"longitude":{"type":"string","description":"Longitude of the country.","example":78.9629},"attackCount":{"type":"integer","description":"The count of attacks originating from the specified country.","example":650}},"required":["attackCount","country","countryCode","latitude","longitude","regionName"]},"CreateResource":{"type":"object","description":"Serializer for creating a new resource.","properties":{"name":{"type":"string","description":"Name of the resource","maxLength":255,"minLength":1},"description":{"type":"string","nullable":true,"description":"Optional description of the resource","maxLength":1000}},"required":["name"]},"CreateResourceResponse":{"type":"object","description":"Serializer for create resource response.","properties":{"resourceId":{"type":"string","description":"ID of the newly created resource"},"status":{"type":"string","description":"Status of the creation operation"}},"required":["resourceId","status"]},"CustomerOverride":{"type":"object","description":"Serializes customer override attribution for a message.\n\nPresent when blocklist or Custom AI Model attribution is enabled.","properties":{"overrideType":{"type":"string","description":"The type of customer override applied.","example":"Customer Blocklist"},"reason":{"type":"string","description":"The match type that triggered the blocklist override.","example":"Sender Email"},"overrideJudgement":{"type":"string","nullable":true,"description":"The message judgement applied by the override.","example":"malicious"},"value":{"type":"string","nullable":true,"description":"The matched blocklist entry value.","example":"support@secure-reply.org"}},"required":["overrideType","reason"]},"DashboardSummary":{"type":"object","properties":{"attackStopped":{"type":"array","items":{"$ref":"#/components/schemas/AttackStopped"},"description":"List detailing the attacks stopped."},"attackFrequency":{"type":"array","items":{"$ref":"#/components/schemas/AttackFrequency"},"description":"List detailing the attack frequency."},"attackerOrigin":{"type":"array","items":{"$ref":"#/components/schemas/AttackerOrigin"},"description":"List detailing the origin of the attacker."},"mostImpersonatedEmployee":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedEmployee"},"description":"List detailing the most impersonated employees."},"mostImpersonatedEmployeeVIP":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedEmployeeVIP"},"description":"List detailing the most impersonated VIP employees."},"mostImpersonatedEmployeeNonVIP":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedEmployeeNonVIP"},"description":"List detailing the most impersonated non-VIP employees."},"trendingAttacks":{"type":"array","items":{"$ref":"#/components/schemas/TrendingAttacks"},"description":"List detailing the trending attacks."},"attackVectorBreakdown":{"type":"array","items":{"$ref":"#/components/schemas/AttackVectorBreakdown"},"description":"List detailing the attack vectors."},"attackStrategyBreakdown":{"type":"array","items":{"$ref":"#/components/schemas/AttackStrategyBreakdown"},"description":"List detailing the attack strategies."},"senderImpersonationBreakdown":{"type":"array","items":{"$ref":"#/components/schemas/SenderImpersonationBreakdown"},"description":"List detailing the impersonated sender breakdown."},"mostImpersonatedVendor":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedVendor"},"description":"List detailing the most impersonated vendors."},"recipientEmployees":{"type":"array","items":{"$ref":"#/components/schemas/RecipientEmployee"},"description":"List detailing the recipient employees targeted in attacks."},"recipientEmployeesVIP":{"type":"array","items":{"$ref":"#/components/schemas/RecipientEmployeeVIP"},"description":"List detailing the VIP recipient employees targeted in attacks."},"recipientEmployeesNonVIP":{"type":"array","items":{"$ref":"#/components/schemas/RecipientEmployeeNonVIP"},"description":"List detailing the non-VIP recipient employees targeted in attacks."}},"required":["attackFrequency","attackStopped","attackStrategyBreakdown","attackVectorBreakdown","attackerOrigin","mostImpersonatedEmployee","mostImpersonatedEmployeeNonVIP","mostImpersonatedEmployeeVIP","mostImpersonatedVendor","recipientEmployees","recipientEmployeesNonVIP","recipientEmployeesVIP","senderImpersonationBreakdown","trendingAttacks"]},"DateRange":{"type":"object","properties":{"from_date":{"type":"string","format":"date-time","description":"Start date for the range filter","example":"2025-01-01T00:00:00Z"},"to_date":{"type":"string","format":"date-time","description":"End date for the range filter","example":"2025-12-31T23:59:59Z"}}},"DecisionCategoryEnum":{"enum":["malicious","spam","safe","graymail"],"title":"DecisionCategoryEnum","type":"string"},"Detection360Case":{"type":"object","properties":{"id":{"type":"integer"},"inquiry_type":{"$ref":"#/components/schemas/InquiryTypeEnum"},"messages":{"type":"array","items":{"type":"integer"}},"report":{"$ref":"#/components/schemas/Detection360Report"},"status":{"$ref":"#/components/schemas/Detection360CaseStatusEnum"},"submission_datetime":{"type":"string","format":"date-time"},"submitted_by":{"$ref":"#/components/schemas/User"}},"required":["id","inquiry_type","messages","status","submission_datetime","submitted_by"]},"Detection360CaseStatusEnum":{"enum":["UNREVIEWED","CONTAINING_ATTACK","IMPROVING_PLATFORM","RESOLVED","CORRECTING_JUDGEMENT"],"type":"string"},"Detection360Report":{"type":"object","properties":{"analysis":{"type":"string"},"root_causes":{"type":"array","items":{"$ref":"#/components/schemas/PortalVisibleRootCause"}}},"required":["analysis","root_causes"]},"Detection360ReportRequest":{"oneOf":[{"$ref":"#/components/schemas/FalsePositive"},{"$ref":"#/components/schemas/FalseNegative"},{"$ref":"#/components/schemas/MissedAttack"},{"$ref":"#/components/schemas/MissedSpam"},{"$ref":"#/components/schemas/MissedGraymail"}],"discriminator":{"propertyName":"report_type","mapping":{"null":"#/components/schemas/MissedGraymail"}}},"DisplayId":{"type":"object","properties":{"display_name":{"type":"string","description":"Human-readable display name","example":"HIGH"},"id":{"type":"string","description":"Internal identifier for the item","example":"high"}}},"EmailSourceEnum":{"enum":["abnormal","quarantine"],"title":"EmailSourceEnum","type":"string"},"EmployeeDetails":{"type":"object","properties":{"name":{"type":"string","description":"Name of the employee.","example":"Tom"},"email":{"type":"string","description":"Email of the employee.","example":"example@example.com"},"title":{"type":"string","description":"Job title of the employee.","example":"General Manager"},"manager":{"type":"string","description":"Email address of the employee's manager","example":"manager_email@example.com"}},"required":["email","manager","name","title"]},"EmployeeGenomeCategory":{"type":"object","properties":{"value":{"type":"string","description":"Category value","example":"203.12.172.182"},"percentage":{"type":"number","format":"double","description":"Ratio of this category relative to others","example":0.9},"total_count":{"type":"integer","description":"Number of occurences for this category","example":9}},"required":["percentage","total_count","value"]},"EmployeeGenomeDetails":{"type":"object","properties":{"key":{"type":"string","description":"Genome key name","example":"ip_address"},"name":{"type":"string","description":"Genome title","example":"Common IP Addresses"},"description":{"type":"string","description":"Description of genome object","example":"Common IP Addresses for user logins"},"values":{"type":"array","items":{"$ref":"#/components/schemas/EmployeeGenomeCategory"}}},"required":["description","key","name","values"]},"EmployeeIdentityDetails":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmployeeGenomeDetails"}}},"required":["data"]},"Error":{"type":"object","description":"Serializer for bad request error response.","properties":{"error":{"type":"string","description":"Error message"}},"required":["error"]},"EventLocation":{"type":"object","properties":{"city":{"type":"string","description":"The city where the event occurred.","example":"Aldie"},"state":{"type":"string","description":"The state where the event occurred.","example":"Virginia"},"country":{"type":"string","description":"The country where the event occurred.","example":"US"}},"required":["city","country","state"]},"FalseNegative":{"type":"object","properties":{"report_type":{"$ref":"#/components/schemas/FalseNegativeReportTypeEnum","description":"Type of report"},"recipient_email":{"type":"string","description":"Email address of the recipient","example":"alice@aloha.com"},"sender_email":{"type":"string","description":"Email address of the sender","example":"alice@aloha.com"},"subject":{"type":"string","description":"Subject of the email","example":"hello!"},"received_date":{"type":"string","description":"Date the email was received in YYYY-MM-DD format.","example":"2020/02/01"},"description":{"type":"string","description":"Free text to provide more context on the issue.","example":"Alice reported this email looked like an attack."}},"required":["recipient_email","report_type","sender_email","subject"]},"FalseNegativeReportTypeEnum":{"enum":["false-negative"],"type":"string"},"FalsePositive":{"type":"object","properties":{"report_type":{"$ref":"#/components/schemas/FalsePositiveReportTypeEnum","description":"Type of report"},"portal_link":{"type":"string","description":"Link in Portal of the False Positive Threat","example":"https://portal.abnormalsecurity.com/home/threat-center/remediation-history/1234567890"},"received_date":{"type":"string","description":"Date the email was received in YYYY-MM-DD format.","example":"2020/02/01"},"description":{"type":"string","description":"Free text to provide more context on the issue.","example":"Alice reported this email was missing from their inbox."}},"required":["portal_link","report_type"]},"FalsePositiveReportTypeEnum":{"enum":["false-positive"],"type":"string"},"GetResourceResponse":{"type":"object","description":"Serializer for get resource response.","properties":{"resource":{"allOf":[{"$ref":"#/components/schemas/Resource"}],"description":"The requested resource"}},"required":["resource"]},"InquiryTypeEnum":{"enum":["MISSED_ATTACK","FALSE_POSITIVE"],"type":"string"},"JudgementEnum":{"enum":["attack","borderline","spam","graymail","safe"],"title":"JudgementEnum","type":"string"},"JudgementSourceEnum":{"enum":["ABNORMAL_SYSTEM","CUSTOMER_AI_MODEL"],"title":"JudgementSourceEnum","type":"string"},"ListResourcesResponse":{"type":"object","description":"Serializer for list resources response.","properties":{"resources":{"type":"array","items":{"$ref":"#/components/schemas/Resource"},"description":"List of resources"},"total":{"type":"integer","description":"Total number of resources matching the query"},"pageNumber":{"type":"integer","description":"Current page number"},"nextPageNumber":{"type":"integer","nullable":true,"description":"Next page number if more pages exist"}},"required":["pageNumber","resources","total"]},"MFAFailureEvent":{"type":"object","properties":{"event_timestamp":{"type":"string","format":"date-time","description":"Time when event occurred","example":"2020-05-19T17:47:30Z"},"category":{"type":"string","description":"Type of event","example":"Failed MFA Attempt"},"title":{"type":"string","description":"Title of the event","example":"Failed MFA Attempt"},"field_labels":{"type":"object","additionalProperties":{},"description":"Anomaly labels/tags associated with fields in the event"},"ip_address":{"type":"string","description":"IP Address where user attempted Multi Factor Authentication","example":"123.456.78.900"},"browser":{"type":"string","description":"Browser that was used when attempting to sign in to mailbox","example":"Chrome"},"operating_system":{"type":"string","description":"Operating system of the device used to attempt sign in","example":"Windows 10"},"protocol":{"type":"string","description":"Connection protocol used when attempting to sign in","example":"Browser"},"application":{"type":"string","description":"Mail application used to sign in","example":"GSuite"},"location":{"allOf":[{"$ref":"#/components/schemas/EventLocation"}],"description":"Location of a sign in as detected from case analysis"}},"required":["application","browser","category","event_timestamp","field_labels","ip_address","location","operating_system","protocol","title"]},"MailRuleEvent":{"type":"object","properties":{"event_timestamp":{"type":"string","format":"date-time","description":"Time when event occurred","example":"2020-05-19T17:47:30Z"},"category":{"type":"string","description":"Type of event","example":"Mail Rule"},"title":{"type":"string","description":"Title of the event","example":"Mail Rule Change"},"rule_name":{"type":"string","description":"Name of the mail rule that was changed","example":"Delete all messages rule"},"condition":{"type":"string","description":"Condition of the mail rule","example":"hasNoCondition"},"flagging_detectors":{"type":"string","description":"Flagging detectors of the mail rule","example":"DELETE_ALL"}},"required":["category","condition","event_timestamp","flagging_detectors","rule_name","title"]},"MessageToRemediate":{"properties":{"tenant_id":{"description":"Tenant ID","title":"Tenant Id","type":"integer"},"raw_message_id":{"description":"Raw message ID","title":"Raw Message Id","type":"string"},"abnormal_message_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Abnormal Message Id"},"abnormal_message_uuid":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Abnormal Message Uuid"},"mailbox_name":{"description":"Mailbox name","title":"Mailbox Name","type":"string"},"native_user_id":{"description":"Native user ID","title":"Native User Id","type":"string"},"subject":{"description":"Subject","title":"Subject","type":"string"},"sender":{"description":"Sender","title":"Sender","type":"string"},"received_time":{"description":"Received time","format":"date-time","title":"Received Time","type":"string"}},"required":["tenant_id","raw_message_id","mailbox_name","native_user_id","subject","sender","received_time"],"title":"MessageToRemediate","type":"object"},"MetaData":{"properties":{"trace_id":{"title":"Trace Id","type":"string"},"response_time":{"title":"Response Time","type":"string"}},"required":["trace_id","response_time"],"title":"MetaData","type":"object"},"MismatchedMFALocationEvent":{"type":"object","properties":{"event_timestamp":{"type":"string","format":"date-time","description":"Time when event occurred","example":"2020-05-19T17:47:30Z"},"category":{"type":"string","description":"Type of event","example":"Authentication Events"},"title":{"type":"string","description":"Title of the event","example":"Different Authentication Factor Locations"},"field_labels":{"type":"object","additionalProperties":{},"description":"Anomaly labels/tags associated with fields in the event"},"description":{"type":"string","description":"Mismatch between session location and second factor authentication location","example":"Mismatch between session location and second factor authentication location"},"session_ip":{"type":"string","description":"IP Address where the user signed in","example":"123.456.78.900 / Indianapolis, IN, US"},"second_factor_ip":{"type":"string","description":"IP Address where the user attempted to use Multi Factor Authentication","example":"123.456.78.900 / Indianapolis, IN, US"},"used_second_factors":{"type":"string","description":"Type of 2FA technology used to make the authentication","example":"MOBILE_APP_NOTIFICATION"},"familiarity_statistics":{"type":"object","additionalProperties":{},"description":"Familiarity analysis of the other fields in this event"},"location":{"allOf":[{"$ref":"#/components/schemas/EventLocation"}],"description":"Location of a sign in as detected from case analysis"}},"required":["category","description","event_timestamp","familiarity_statistics","field_labels","location","second_factor_ip","session_ip","title","used_second_factors"]},"MissedAttack":{"type":"object","properties":{"report_type":{"$ref":"#/components/schemas/MissedAttackReportTypeEnum","description":"Type of report"},"recipient_email":{"type":"string","description":"Email address of the sender","example":"alice@aloha.com"},"sender_email":{"type":"string","description":"Email address of the sender","example":"alice@aloha.com"},"subject":{"type":"string","description":"Subject of the email","example":"hello!"},"received_date":{"type":"string","description":"Date the email was received in YYYY-MM-DD format."},"description":{"type":"string","description":"Free text to provide more context on the issue.","example":"Alice reported this email looked like an attack."}},"required":["recipient_email","report_type","sender_email","subject"]},"MissedAttackReportTypeEnum":{"enum":["missed-attack"],"type":"string"},"MissedGraymail":{"type":"object","properties":{"report_type":{"$ref":"#/components/schemas/MissedGraymailReportTypeEnum","description":"Type of report"},"recipient_email":{"type":"string"},"sender_email":{"type":"string"},"subject":{"type":"string"},"received_date":{"type":"string","description":"Date the email was received in YYYY-MM-DD format."},"description":{"type":"string","description":"Free text to provide more context on the issue.","example":"Alice does not want to see this email in her inbox."}},"required":["recipient_email","report_type","sender_email","subject"]},"MissedGraymailReportTypeEnum":{"enum":["missed-graymail"],"type":"string"},"MissedSpam":{"type":"object","properties":{"report_type":{"$ref":"#/components/schemas/MissedSpamReportTypeEnum","description":"Type of report"},"recipient_email":{"type":"string"},"sender_email":{"type":"string"},"subject":{"type":"string"},"received_date":{"type":"string","description":"Date the email was received in YYYY-MM-DD format."},"description":{"type":"string","description":"Free text to provide more context on the issue.","example":"Alice reported this email looked like spam."}},"required":["recipient_email","report_type","sender_email","subject"]},"MissedSpamReportTypeEnum":{"enum":["missed-spam"],"type":"string"},"MostImpersonatedEmployee":{"type":"object","properties":{"impersonatedEmployeeName":{"type":"string","description":"Name of the employee impersonated in attacks.","example":"John Doe"},"attackCount":{"type":"integer","description":"Number of detected attacks with the impersonated employee in the defined time range.","example":20},"prevAttackCount":{"type":"integer","description":"Number of detected impersonated attacks prior to the defined time range.","example":20}},"required":["attackCount","impersonatedEmployeeName","prevAttackCount"]},"MostImpersonatedEmployeeNonVIP":{"type":"object","properties":{"impersonatedEmployeeName":{"type":"string","description":"The name of the non-VIP employee impersonated in attacks.","example":"John Doe"},"attackCount":{"type":"integer","description":"Number of detected attacks with the impersonated non-VIP employee in the defined time range.","example":20},"prevAttackCount":{"type":"integer","description":"Number of detected impersonated attacks prior to the defined time range.","example":20}},"required":["attackCount","impersonatedEmployeeName","prevAttackCount"]},"MostImpersonatedEmployeeNonVIPResponse":{"type":"object","properties":{"most_impersonated_employee_non_vip":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedEmployeeNonVIP"},"description":"List detailing the names of the most impersonated non-VIP employees, along with the current and previous attack count for each."}},"required":["most_impersonated_employee_non_vip"]},"MostImpersonatedEmployeeResponse":{"type":"object","properties":{"most_impersonated_employee":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedEmployee"},"description":"List detailing the names of the most impersonated employees, along with the current and previous attack count for each."}},"required":["most_impersonated_employee"]},"MostImpersonatedEmployeeVIP":{"type":"object","properties":{"impersonatedEmployeeName":{"type":"string","description":"The name of the VIP employee impersonated in attacks.","example":"John Doe"},"attackCount":{"type":"integer","description":"Number of detected attacks with the impersonated VIP employee in the defined time range.","example":20},"prevAttackCount":{"type":"integer","description":"Number of detected impersonated attacks prior to the defined time range.","example":20}},"required":["attackCount","impersonatedEmployeeName","prevAttackCount"]},"MostImpersonatedEmployeeVIPResponse":{"type":"object","properties":{"most_impersonated_employee_vip":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedEmployeeVIP"},"description":"List detailing the names of the most impersonated VIP employees, along with the current and previous attack count for each."}},"required":["most_impersonated_employee_vip"]},"MostImpersonatedVendor":{"type":"object","properties":{"impersonatedBrandName":{"type":"string","description":"The name of the vendor impersonated in attacks.","example":"Apple"},"attackCount":{"type":"integer","description":"The amount of attacks detected with the respective vendor impersonation.","example":20},"prevAttackCount":{"type":"integer","description":"The amount of vendor impersonated attacks detected prior to the defined time range.","example":20}},"required":["attackCount","impersonatedBrandName","prevAttackCount"]},"MostImpersonatedVendorResponse":{"type":"object","properties":{"most_impersonated_vendor":{"type":"array","items":{"$ref":"#/components/schemas/MostImpersonatedVendor"},"description":"List detailing the most impersonated vendors, along with their attack counts for the current and previous periods."}},"required":["most_impersonated_vendor"]},"NotAnalyzedReasonEnum":{"enum":["PHISHING_SIMULATION","EXCLUDED_SENDER","CUSTOM_FILTER","INVALID_MAILBOX","ORIGINAL_EMAIL_NOT_LOCATED","UNKNOWN_REPORTER","INVALID_SUBMISSION","ROUTED_SUBMISSION","COULD_NOT_EXTRACT","FROM_PHISHING_MAILBOX","NOT_ANALYZED_POV_QUOTA_REACHED","AI_CONVERSATION"],"type":"string"},"NotFoundError":{"type":"object","description":"404 Not Found error response.","properties":{"error":{"type":"string","default":"Resource not found","description":"Resource with the specified ID was not found"}}},"OutboundMessageEvent":{"type":"object","properties":{"event_timestamp":{"type":"string","format":"date-time","description":"Time when event occurred","example":"2020-05-19T17:47:30Z"},"category":{"type":"string","description":"Type of event","example":"Mail Sent"},"title":{"type":"string","description":"Title of the event","example":"Unusual Correspondence"},"subject":{"type":"string","description":"Subject of suspicious email sent","example":"Transaction Sent"},"sender":{"type":"string","description":"Email of the Sender","example":"john.doe@lamronba.com"},"recipient":{"type":"string","description":"Name of the recipient","example":"Jane Eyre"}},"required":["category","event_timestamp","recipient","sender","subject","title"]},"PaginatedAbuseCampaings":{"type":"object","properties":{"campaigns":{"type":"array","items":{"$ref":"#/components/schemas/AbuseCampaign"},"description":"List of abuse campaign IDs."},"pageNumber":{"type":"integer","default":1,"description":"The current page number. Will not be be in the response if no filter query parameter is passed in via the request."},"nextPageNumber":{"type":"integer","default":2,"description":"The next page number. Wil not be included in the response if there are no more pages of data or if no filter query parameter is passed in via the request"}},"required":["campaigns"]},"PaginatedCases":{"type":"object","properties":{"cases":{"type":"array","items":{"$ref":"#/components/schemas/AbnormalCase"},"description":"List of Abnormal Cases."},"pageNumber":{"type":"integer","default":1,"description":"The current page number. Will not be be in the response if no filter query parameter is passed in via the request."},"nextPageNumber":{"type":"integer","default":2,"description":"The next page number. Wil not be included in the response if there are no more pages of data or if no filter query parameter is passed in via the request"}},"required":["cases"]},"PaginatedThreats":{"type":"object","properties":{"threats":{"type":"array","items":{"$ref":"#/components/schemas/Threat"},"description":"List of threat IDs."},"pageNumber":{"type":"integer","default":1,"description":"The current page number. Will not be be in the response if no filter query parameter is passed in via the request."},"nextPageNumber":{"type":"integer","default":2,"description":"The next page number. Wil not be included in the response if there are no more pages of data or if no filter query parameter is passed in via the request"}},"required":["threats"]},"PaginatedVendorCases":{"type":"object","properties":{"vendorCases":{"type":"array","items":{"$ref":"#/components/schemas/VendorCases"},"description":"List of vendor cases."},"pageNumber":{"type":"integer","default":1,"description":"The current page number. Will not be be in the response if no filter query parameter is passed in via the request."},"nextPageNumber":{"type":"integer","default":2,"description":"The next page number. Wil not be included in the response if there are no more pages of data or if no filter query parameter is passed in via the request"}},"required":["vendorCases"]},"PaginatedVendors":{"type":"object","properties":{"vendors":{"type":"array","items":{"$ref":"#/components/schemas/Vendors"},"description":"List of vendors."},"pageNumber":{"type":"integer","default":1,"description":"The current page number. Will not be be in the response if no filter query parameter is passed in via the request."},"nextPageNumber":{"type":"integer","default":2,"description":"The next page number. Wil not be included in the response if there are no more pages of data or if no filter query parameter is passed in via the request"}},"required":["vendors"]},"PaginationMetadata":{"type":"object","description":"Serializer for pagination metadata.","properties":{"page":{"type":"integer","description":"Current page number","example":1},"pageSize":{"type":"integer","description":"Number of items per page","example":10},"totalResults":{"type":"integer","description":"Total number of items available","example":42},"totalPages":{"type":"integer","description":"Total number of pages","example":5}},"required":["page","pageSize","totalPages","totalResults"]},"PaginationSwagger":{"type":"object","description":"Swagger serializer for pagination metadata.","properties":{"total":{"type":"integer","description":"Total number of tokens matching criteria"},"limit":{"type":"integer","description":"Maximum tokens returned in this response"},"offset":{"type":"integer","description":"Number of tokens skipped"}},"required":["limit","offset","total"]},"PatchedUpdateResource":{"type":"object","description":"Serializer for updating an existing resource.","properties":{"description":{"type":"string","description":"Updated description (can be empty string to clear)","maxLength":1000}}},"PerformAction":{"type":"object","description":"Serializer for performing an action on a resource.","properties":{"action":{"$ref":"#/components/schemas/PerformActionActionEnum","description":"Action to perform: refresh or validate"}},"required":["action"]},"PerformActionActionEnum":{"enum":["refresh","validate"],"type":"string"},"PerformActionResponse":{"type":"object","description":"Serializer for perform action response.","properties":{"actionId":{"type":"string","description":"Unique ID for the action request"},"resourceId":{"type":"string","description":"ID of the resource the action was performed on"},"status":{"type":"string","description":"Status of the action"}},"required":["actionId","resourceId","status"]},"PolicySwagger":{"type":"object","description":"Swagger serializer for policy object within a role.","properties":{"resource":{"type":"string","description":"The resource name (e.g., 'threats', 'cases')"},"permissions":{"type":"array","items":{"type":"string"},"description":"List of permissions granted on this resource"}},"required":["permissions","resource"]},"PortalVisibleRootCause":{"type":"object","properties":{"name":{"type":"string"},"description":{"type":"string"}},"required":["description","name"]},"PostCaseRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/PostCaseRequestActionEnum"}},"required":["action"]},"PostCaseRequestActionEnum":{"enum":["action_required","acknowledge_resolved","acknowledge_in_progress","acknowledge_not_an_attack"],"type":"string"},"PostCaseResponse":{"type":"object","properties":{"actionId":{"type":"string","description":"A unique identifier for this case.","example":"61e76395-40d3-4d78-b6a8-8b17634d0f5b"},"statusUrl":{"type":"string","description":"The URL of the status of the case.","example":"https://api.abnormalplatform.com/v1/cases/1234/actions/61e76395-40d3-4d78-b6a8-8b17634d0f5b"}},"required":["actionId","statusUrl"]},"PostThreatRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/PostThreatRequestActionEnum"}},"required":["action"]},"PostThreatRequestActionEnum":{"enum":["remediate","unremediate"],"type":"string"},"PostThreatResponse":{"type":"object","properties":{"action_id":{"type":"string","description":"The UUID representing the action id for a threat.","example":"a33a212a-89ff-461f-be34-ea52aff44a67"},"status_url":{"type":"string","description":"The URL for status of specific threat.","example":"https://api.abnormalplatform.com/v1/threats/184712ab-6d8b-47b3-89d3-a314efef79e2/actions/a33a212a-89ff-461f-be34-ea52aff44a73"},"tenantId":{"type":"integer","nullable":true,"description":"The tenant ID associated with the threat","example":1234},"tenantName":{"type":"string","nullable":true,"description":"The short name of the tenant associated with the threat","example":"example-tenant"}},"required":["action_id","status_url","tenantId","tenantName"]},"PostureArea":{"type":"object","properties":{"title":{"type":"string","description":"Title of the posture area","example":"Admin Center Highlights"},"description":{"type":"string","description":"Description of the posture area with security grade information","example":"

Abnormal rates the security grade of Admin Center as "B-" because less than 25% of postures in this area are resolved...

"},"highlights":{"type":"array","items":{"$ref":"#/components/schemas/PostureHighlight"},"description":"List of highlighted security postures in this area"}}},"PostureCatalogResponse":{"type":"object","description":"Paginated response serializer for posture catalog.","properties":{"metadata":{"allOf":[{"$ref":"#/components/schemas/ResponseMetadata"}],"description":"Response metadata including pagination information"},"data":{"type":"array","items":{"$ref":"#/components/schemas/PostureItem"},"description":"List of available postures in the catalog"}}},"PostureDetail":{"type":"object","properties":{"last_updated_time":{"type":"string","format":"date-time","description":"Timestamp when the posture was last updated","example":"2025-04-29T15:51:41.560354Z"},"posture_name":{"type":"string","description":"Name of the security posture","example":"Ensure Microsoft Authenticator is configured to protect against MFA fatigue"},"status":{"type":"string","description":"Current compliance status of the posture","example":"NON_COMPLIANT"},"workflow_status":{"type":"string","description":"Current workflow status for remediation","example":"UNTRIAGED"},"actor":{"allOf":[{"$ref":"#/components/schemas/Actor"}],"description":"Actor who last modified the posture"},"posture_type":{"type":"string","description":"Type of posture evaluation (AUTO or MANUAL)","example":"AUTO"},"description":{"type":"string","description":"Detailed description of the security posture requirement","example":"**Microsoft Authenticator** should be configured to prevent MFA fatigue attacks..."},"risk_level":{"type":"string","description":"Risk level associated with this posture","example":"HIGH"}}},"PostureHighlight":{"type":"object","properties":{"title":{"type":"string","description":"Title of the highlighted security posture","example":"Ensure Administrative accounts are separate and cloud-only"},"description":{"type":"string","description":"Description of the security posture highlight","example":"

Administrative accounts are separate and cloud-only ensures proper separation of privileged accounts from regular user accounts.

"},"posture_id":{"type":"integer","description":"Unique identifier for the posture","example":292},"risk_level":{"type":"string","description":"Risk level of the highlighted posture","example":"HIGH"}}},"PostureItem":{"type":"object","description":"Serializer for individual posture items in the catalog.","properties":{"id":{"type":"string","description":"Unique identifier for the posture","example":"ensure-microsoft-authenticator-configured"},"space_type":{"type":"string","description":"Type of space this posture applies to","example":"TENANT"},"platform_type":{"type":"string","description":"Platform type for this posture","example":"M365"},"posture_area":{"type":"string","description":"Area or category of the posture","example":"ENTRA"},"benchmarks":{"type":"array","items":{"type":"string"},"description":"List of security benchmarks this posture belongs to","example":["CIS"]},"name":{"type":"string","description":"Name of the security posture","example":"Ensure Microsoft Authenticator is configured to protect against MFA fatigue"},"category":{"type":"string","description":"Category classification of the posture","example":"AUTHENTICATION"},"risk_level":{"type":"string","description":"Risk level associated with this posture","example":"HIGH"},"description":{"type":"string","description":"Detailed description of the security posture requirement","example":"Microsoft Authenticator should be configured to prevent MFA fatigue attacks by requiring number matching..."},"insight":{"type":"string","description":"Additional insights about the posture","example":"This configuration helps prevent attackers from bypassing MFA through fatigue attacks"},"remediation_steps":{"type":"string","description":"Steps to remediate this posture","example":"1. Navigate to Azure AD admin center 2. Go to Security > Authentication methods..."},"created_at":{"type":"string","format":"date-time","description":"Timestamp when the posture was created","example":"2025-01-15T10:30:00Z"},"updated_at":{"type":"string","format":"date-time","description":"Timestamp when the posture was last updated","example":"2025-04-29T15:51:41.560354Z"}}},"PostureListItem":{"type":"object","properties":{"posture_id":{"type":"integer","description":"Unique identifier for the posture","example":421},"posture_name":{"type":"string","description":"Name of the security posture","example":"Ensure that collaboration invitations are sent to allowed domains only"},"status":{"type":"string","description":"Current compliance status","example":"PENDING_EVALUATION"},"workflow_status":{"type":"string","description":"Current workflow status","example":"UNTRIAGED"},"risk_level":{"allOf":[{"$ref":"#/components/schemas/DisplayId"}],"description":"Risk level of the posture"},"last_updated_time":{"type":"string","format":"date-time","description":"Timestamp when the posture was last updated","example":"2025-04-24T07:50:04.086534Z"},"last_evaluated_at":{"type":"string","format":"date-time","description":"Timestamp when the posture was last evaluated","example":"2025-04-24T07:50:04.087191Z"},"posture_type":{"type":"string","description":"Type of posture evaluation","example":"MANUAL"},"benchmarks":{"type":"array","items":{"$ref":"#/components/schemas/DisplayId"},"description":"List of security benchmarks this posture belongs to"},"tags":{"type":"array","items":{"$ref":"#/components/schemas/DisplayId"},"description":"List of tags associated with the posture"}}},"PostureListParams":{"type":"object","properties":{"risk_levels":{"type":"array","items":{"$ref":"#/components/schemas/RiskLevelsEnum"},"description":"Filter by risk levels","example":["HIGH","MED"]},"statuses":{"type":"array","items":{"$ref":"#/components/schemas/StatusesEnum"},"description":"Filter by compliance statuses","example":["PENDING_EVALUATION","NON_COMPLIANT"]},"benchmarks":{"type":"array","items":{"$ref":"#/components/schemas/BenchmarksEnum"},"description":"Filter by security benchmarks","example":["CIS"]},"last_evaluated_at":{"allOf":[{"$ref":"#/components/schemas/DateRange"}],"description":"Filter by last evaluation date range"},"posture_area":{"type":"array","items":{"type":"string"},"description":"Filter by posture areas","example":["ADMIN_CENTER","ENTRA"]},"platform_type":{"type":"array","items":{"type":"string"},"description":"Filter by platform types","example":["M365"]},"posture_types":{"type":"array","items":{"type":"string"},"description":"Filter by posture types","example":["MANUAL","AUTO"]}}},"PostureListResponse":{"type":"object","description":"Paginated response serializer for posture list.","properties":{"metadata":{"allOf":[{"$ref":"#/components/schemas/ResponseMetadata"}],"description":"Response metadata including pagination information"},"postures":{"type":"array","items":{"$ref":"#/components/schemas/PostureListItem"},"description":"List of postures"}}},"PostureStats":{"type":"object","properties":{"total_postures_count":{"type":"integer","description":"Total number of postures in this area","example":13},"success_postures_count":{"type":"integer","description":"Number of postures that are compliant","example":0},"fail_postures_count":{"type":"integer","description":"Number of postures that are non-compliant","example":13}}},"PostureTimelineResponse":{"type":"object","description":"Paginated response serializer for posture timeline events.","properties":{"metadata":{"allOf":[{"$ref":"#/components/schemas/ResponseMetadata"}],"description":"Response metadata including pagination information"},"events":{"type":"array","items":{"$ref":"#/components/schemas/TimelineEntry"},"description":"List of timeline events for the posture"}}},"QuarantineInfo":{"properties":{"identity":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Identity"},"message_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Message Id"},"policy_type":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Policy Type"},"quarantine_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Quarantine Reason"},"release_status":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Release Status"},"type":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Type"},"processed_at":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"default":null,"title":"Processed At"}},"title":"QuarantineInfo","type":"object"},"RecipientEmployee":{"type":"object","properties":{"job_title":{"type":"string","description":"The job title of the employee who was the target of the attack.","example":"Software Engineer"},"display_name":{"type":"string","description":"The display name of the employee who was the target of the attack.","example":"Jane Doe"},"attack_count":{"type":"integer","description":"The number of occurrences of the attack targeting the given employee in the specified time frame.","example":15},"prev_attack_count":{"type":"integer","description":"The number of occurrences of the attack targeting the given employee in the previous period.","example":10}},"required":["attack_count","display_name","job_title","prev_attack_count"]},"RecipientEmployeeNonVIP":{"type":"object","properties":{"job_title":{"type":"string","description":"The job title of the non-VIP employee who was the target of the attack.","example":"Software Engineer"},"display_name":{"type":"string","description":"The display name of the non-VIP employee who was the target of the attack.","example":"Jane Doe"},"attack_count":{"type":"integer","description":"The number of occurrences of the attack targeting the given non-VIP employee in the specified time frame.","example":15},"prev_attack_count":{"type":"integer","description":"The number of occurrences of the attack targeting the given non-VIP employee in the previous period.","example":10}},"required":["attack_count","display_name","job_title","prev_attack_count"]},"RecipientEmployeeNonVIPResponse":{"type":"object","properties":{"recipient_employees_non_vip":{"type":"array","items":{"$ref":"#/components/schemas/RecipientEmployeeNonVIP"},"description":"List detailing the recipient non-VIP employees, their job titles, and the attack counts against them for the current and previous periods."}},"required":["recipient_employees_non_vip"]},"RecipientEmployeeResponse":{"type":"object","properties":{"recipient_employees":{"type":"array","items":{"$ref":"#/components/schemas/RecipientEmployee"},"description":"List detailing the recipient employees, their job titles, and the attack counts against them for the current and previous periods."}},"required":["recipient_employees"]},"RecipientEmployeeVIP":{"type":"object","properties":{"job_title":{"type":"string","description":"The job title of the VIP employee who was the target of the attack.","example":"Software Engineer"},"display_name":{"type":"string","description":"The display name of the VIP employee who was the target of the attack.","example":"Jane Doe"},"attack_count":{"type":"integer","description":"The number of occurrences of the attack targeting the given VIP employee in the specified time frame.","example":15},"prev_attack_count":{"type":"integer","description":"The number of occurrences of the attack targeting the given VIP employee in the previous period.","example":10}},"required":["attack_count","display_name","job_title","prev_attack_count"]},"RecipientEmployeeVIPResponse":{"type":"object","properties":{"recipient_employees_vip":{"type":"array","items":{"$ref":"#/components/schemas/RecipientEmployeeVIP"},"description":"List detailing the recipient VIP employees, their job titles, and the attack counts against them for the current and previous periods."}},"required":["recipient_employees_vip"]},"RemediationActionEnum":{"enum":["delete","move_to_inbox"],"title":"RemediationActionEnum","type":"string"},"RemediationDetail":{"properties":{"tenant_id":{"title":"Tenant Id","type":"integer"},"raw_message_id":{"title":"Raw Message Id","type":"string"},"subject":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Subject"},"sender":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Sender"},"mailbox_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Mailbox Name"},"current_folder_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Current Folder Name"},"native_user_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Native User Id"},"date_created":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"default":null,"title":"Date Created"},"date_remediated":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"default":null,"title":"Date Remediated"},"status":{"$ref":"#/components/schemas/ActionStatusEnum"},"status_details":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Status Details"},"received_time":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"default":null,"title":"Received Time"}},"required":["tenant_id","raw_message_id","status"],"title":"RemediationDetail","type":"object"},"RemediationHistory":{"type":"object","properties":{"remediation_history":{"type":"object","additionalProperties":{"type":"string","format":"date-time"},"description":"Remediation history of a threat.","example":"\"Auto-Remediated\": \"2023-04-11T20:54:56.244716+00:00\""},"folder_locations":{"type":"array","items":{"type":"string"},"description":"Folder locations.","example":["Junk"]}},"required":["folder_locations","remediation_history"]},"RemediationRequest":{"properties":{"action":{"$ref":"#/components/schemas/RemediationActionEnum","description":"Remediation action"},"source":{"$ref":"#/components/schemas/EmailSourceEnum","description":"Source of the messages"},"remediation_reason":{"$ref":"#/components/schemas/ActionReasonEnum","description":"Reason for remediation"},"target_folder":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"Target folder for move actions","title":"Target Folder"},"submit_d360_case":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"title":"Submit D360 Case"},"messages":{"anyOf":[{"items":{"$ref":"#/components/schemas/MessageToRemediate"},"type":"array"},{"type":"null"}],"default":null,"title":"Messages"},"remediate_all":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"title":"Remediate All"},"search_filters":{"anyOf":[{"$ref":"#/components/schemas/SearchFilters"},{"type":"null"}],"default":null},"tenant_ids":{"anyOf":[{"items":{"type":"integer"},"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Optional list of tenant IDs to filter remediation. If not provided, all authorized tenants are included.","title":"Tenant Ids"}},"required":["action","source","remediation_reason"],"title":"RemediationRequest","type":"object"},"RemediationResponse":{"properties":{"activity_log_id":{"title":"Activity Log Id","type":"integer"},"metadata":{"$ref":"#/components/schemas/MetaData"}},"required":["activity_log_id","metadata"],"title":"RemediationResponse","type":"object"},"RemediationStatusEnum":{"enum":["Not remediated","remediated","Remediation attempted"],"type":"string"},"Resource":{"type":"object","description":"Serializer for resource representation in responses.","properties":{"resourceId":{"type":"string","description":"Unique identifier for the resource"},"name":{"type":"string","description":"Human-readable name of the resource"},"description":{"type":"string","nullable":true,"description":"Optional description of the resource"},"tags":{"type":"array","items":{"type":"string"},"description":"List of tags"}},"required":["name","resourceId"]},"ResourcePermissionSwagger":{"type":"object","description":"Swagger serializer for resource permissions.","properties":{"resource":{"type":"string","description":"Name of the resource (e.g., 'ato', 'threat_log')"},"permissions":{"type":"array","items":{"type":"string"},"description":"List of permissions for this resource (e.g., 'view', 'write', 'manage')"}},"required":["permissions","resource"]},"ResponseMetadata":{"type":"object","description":"Serializer for response metadata containing pagination information.","properties":{"pagination":{"allOf":[{"$ref":"#/components/schemas/PaginationMetadata"}],"description":"Pagination information for the response"}},"required":["pagination"]},"RiskEvent":{"type":"object","properties":{"event_timestamp":{"type":"string","format":"date-time","description":"Time when event occurred","example":"2020-05-19T17:47:30Z"},"category":{"type":"string","description":"Type of event","example":"Risk Event"},"title":{"type":"string","description":"Title of the event","example":"Impossible Travel"},"field_labels":{"type":"object","additionalProperties":{},"description":"Anomaly labels/tags associated with fields in the event"},"ip_address":{"type":"string","description":"IP Address where user accessed mail from","example":"123.456.78.900"},"location":{"allOf":[{"$ref":"#/components/schemas/EventLocation"}],"description":"Location of a sign in as detected from case analysis"},"prev_location":{"allOf":[{"$ref":"#/components/schemas/EventLocation"}],"description":"Location of a sign in as detected from case analysis"}},"required":["category","event_timestamp","field_labels","ip_address","location","prev_location","title"]},"RiskLevelsEnum":{"enum":["LOW","MED","HIGH"],"type":"string"},"RoleListResponse":{"type":"object","description":"Swagger serializer for role list response.","properties":{"status":{"type":"string","default":"success","description":"Status of the response"},"status_code":{"type":"integer","default":200,"description":"HTTP status code"},"data":{"type":"array","items":{"$ref":"#/components/schemas/RoleSwagger"},"description":"List of global roles from RBAC system"}},"required":["data"]},"RoleSwagger":{"type":"object","description":"Swagger serializer for role object.","properties":{"id":{"type":"integer","description":"The unique identifier for the role"},"name":{"type":"string","description":"Name of the role"},"description":{"type":"string","default":"","description":"Description of the role"},"policies":{"type":"array","items":{"$ref":"#/components/schemas/PolicySwagger"},"description":"Simplified view of permissions granted by this role"}},"required":["id","name","policies"]},"SPMReport":{"type":"object","properties":{"sections":{"type":"array","items":{"$ref":"#/components/schemas/Section"},"description":"List of security posture sections organized by platform area"}}},"SearchFilters":{"properties":{"start_time":{"description":"Start time in ISO 8601 format","format":"date-time","title":"Start Time","type":"string"},"end_time":{"description":"End time in ISO 8601 format","format":"date-time","title":"End Time","type":"string"},"subject":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Subject"},"sender_email":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Sender Email"},"sender_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Sender Name"},"recipient_email":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Recipient Email"},"recipient_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Recipient Name"},"attachment_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Attachment Name"},"attachment_md5_hash":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Attachment Md5 Hash"},"internet_message_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Internet Message Id"},"body_link":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Body Link"},"sender_ip":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Sender Ip"},"judgement":{"anyOf":[{"$ref":"#/components/schemas/JudgementEnum"},{"type":"null"}],"default":null},"judgement_source":{"anyOf":[{"$ref":"#/components/schemas/JudgementSourceEnum"},{"type":"null"}],"default":null},"judgement_source_model_ids":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"default":null,"title":"Judgement Source Model Ids"},"judgement_source_model_versions":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"default":null,"title":"Judgement Source Model Versions"},"use_sender_regex":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"title":"Use Sender Regex"},"use_recipient_regex":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"title":"Use Recipient Regex"}},"required":["start_time","end_time"],"title":"SearchFilters","type":"object"},"SearchRequest":{"properties":{"source":{"$ref":"#/components/schemas/EmailSourceEnum","description":"Source of the search"},"filters":{"$ref":"#/components/schemas/SearchFilters","description":"Search filters"},"tenant_ids":{"anyOf":[{"items":{"type":"integer"},"minItems":1,"type":"array"},{"type":"null"}],"default":null,"description":"Optional list of tenant IDs to filter the search. If not provided, all authorized tenants are included.","title":"Tenant Ids"}},"required":["source","filters"],"title":"SearchRequest","type":"object"},"SearchResponse":{"properties":{"results":{"items":{"$ref":"#/components/schemas/SearchResult"},"title":"Results","type":"array"},"total":{"title":"Total","type":"integer"},"pageNumber":{"title":"Pagenumber","type":"integer"},"pageSize":{"title":"Pagesize","type":"integer"},"nextPageNumber":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null,"title":"Nextpagenumber"},"metadata":{"$ref":"#/components/schemas/MetaData"}},"required":["results","total","pageNumber","pageSize","metadata"],"title":"SearchResponse","type":"object"},"SearchResult":{"properties":{"customer_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null,"title":"Customer Id"},"tenant_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null,"title":"Tenant Id"},"received_time":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"default":null,"title":"Received Time"},"subject":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Subject"},"sender":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Sender"},"sender_display_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Sender Display Name"},"mailbox_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Mailbox Name"},"mailbox_display_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Mailbox Display Name"},"current_folder_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Current Folder Name"},"raw_message_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Raw Message Id"},"native_user_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Native User Id"},"cloud_message_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Cloud Message Id"},"internet_message_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Internet Message Id"},"abnormal_message_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Abnormal Message Id"},"abnormal_message_uuid":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Abnormal Message Uuid"},"decision_category":{"anyOf":[{"$ref":"#/components/schemas/DecisionCategoryEnum"},{"type":"null"}],"default":null},"judgement":{"anyOf":[{"$ref":"#/components/schemas/JudgementEnum"},{"type":"null"}],"default":null},"judgement_source":{"anyOf":[{"$ref":"#/components/schemas/JudgementSourceEnum"},{"type":"null"}],"default":null},"judgement_source_model_id":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Judgement Source Model Id"},"judgement_source_model_version":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Judgement Source Model Version"},"attachments":{"anyOf":[{"additionalProperties":{"$ref":"#/components/schemas/Attachment"},"type":"object"},{"type":"null"}],"default":null,"title":"Attachments"},"body_links":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"default":null,"title":"Body Links"},"sender_ip_addresses":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"default":null,"title":"Sender Ip Addresses"},"quarantine_info":{"anyOf":[{"$ref":"#/components/schemas/QuarantineInfo"},{"type":"null"}],"default":null}},"title":"SearchResult","type":"object"},"Section":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier for the section","example":"ADMIN_CENTER"},"platform_type":{"type":"string","description":"Platform type for this section","example":"M365"},"display_name":{"type":"string","description":"Human-readable name for the section","example":"Admin Center"},"stats":{"allOf":[{"$ref":"#/components/schemas/PostureStats"}],"description":"Statistics about postures in this section"},"posture_area":{"allOf":[{"$ref":"#/components/schemas/PostureArea"}],"description":"Detailed information about the posture area"}}},"SecuritySettingsDataSwagger":{"type":"object","description":"Swagger serializer for security settings data.","properties":{"session_settings":{"allOf":[{"$ref":"#/components/schemas/SessionSettingsSwagger"}],"description":"Session timeout settings"}},"required":["session_settings"]},"SecuritySettingsResponse":{"type":"object","description":"Swagger serializer for security settings response.","properties":{"status":{"type":"string","default":"success","description":"Status of the response"},"status_code":{"type":"integer","default":200,"description":"HTTP status code"},"data":{"allOf":[{"$ref":"#/components/schemas/SecuritySettingsDataSwagger"}],"description":"Security settings data"}},"required":["data"]},"SenderImpersonationBreakdown":{"type":"object","properties":{"impersonatedPartyName":{"type":"string","description":"The specific name or category of the party being impersonated in the attack.","example":"VIP"},"attackCount":{"type":"integer","description":"The number of detected attacks associated with the specific impersonated party","example":200}},"required":["attackCount","impersonatedPartyName"]},"SenderImpersonationResponse":{"type":"object","properties":{"sender_impersonation_breakdown":{"type":"array","items":{"$ref":"#/components/schemas/SenderImpersonationBreakdown"},"description":"List detailing the breakdown of attacks by impersonated sender, along with the count for each impersonated sender type."}},"required":["sender_impersonation_breakdown"]},"SessionSettingsSwagger":{"type":"object","description":"Swagger serializer for session settings.","properties":{"inactivity_timeout_minutes":{"type":"integer","nullable":true,"description":"Inactivity timeout in minutes (time before session expires due to inactivity)"},"max_session_time_minutes":{"type":"integer","nullable":true,"description":"Maximum session time in minutes (absolute max time before re-authentication required)"}},"required":["inactivity_timeout_minutes","max_session_time_minutes"]},"SeverityLevel3eaEnum":{"enum":["LOW","MEDIUM","HIGH"],"type":"string"},"SignInEvent":{"type":"object","properties":{"event_timestamp":{"type":"string","format":"date-time","description":"Time when event occurred","example":"2020-05-19T17:47:30Z"},"category":{"type":"string","description":"Type of event","example":"Sign In Event"},"title":{"type":"string","description":"Title of the event","example":"Suspicious Failed Sign In Attempt"},"field_labels":{"type":"object","additionalProperties":{},"description":"Anomaly labels/tags associated with fields in the event"},"description":{"type":"string","description":"Description of the sign in event","example":"Suspicious Failed Sign In Attempt for foo@bar.com"},"ip_address":{"type":"string","description":"IP Address where user attempted to sign in from","example":"123.456.78.900"},"isp":{"type":"string","description":"ISP that was used when attempting to sign in to mailbox","example":"NGCOM"},"browser":{"type":"string","description":"Browser that was used when attempting to sign in to mailbox","example":"Chrome"},"operating_system":{"type":"string","description":"Operating system of the device used to attempt sign in","example":"Windows 10"},"device_trust_type":{"type":"string","description":"Trust type used by device when signing in"},"protocol":{"type":"string","description":"Connection protocol used when attempting to sign in","example":"Browser"},"application":{"type":"string","description":"Mail application used to sign in","example":"GSuite"},"location":{"allOf":[{"$ref":"#/components/schemas/EventLocation"}],"description":"Location of a sign in as detected from case analysis"}},"required":["application","browser","category","description","device_trust_type","event_timestamp","field_labels","ip_address","isp","location","operating_system","protocol","title"]},"SoarAttachmentSignalsStruct":{"type":"object","description":"Serializes a AttachmentSignalsPortalStruct object for Soar payload","properties":{"attachmentName":{"type":"string","readOnly":true,"description":"Name of the attachment file","example":"test_attachment.pdf"},"type":{"type":"string","readOnly":true,"description":"File type of the attachment","example":"JPEG"},"details":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"Details of insights gained from analyzing the attachment","example":["has Javascript"]},"md5":{"type":"string","nullable":true,"readOnly":true,"description":"MD5 algorithm hash of the attachment","example":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"},"sha1":{"type":"string","nullable":true,"readOnly":true,"description":"SHA1 hash of the attachment","example":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"},"sha256":{"type":"string","nullable":true,"readOnly":true,"description":"SHA256 hash of the attachment","example":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"},"size":{"type":"string","readOnly":true,"description":"Size of the attachment file","example":"1KB"},"createdOn":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp attachment file was created on","example":"2020-01-01T00:00:00Z"},"lastUpdated":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp attachment file was last updated","example":"2020-01-01T00:00:00Z"},"url":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"URLs found in the attachment","example":["http://malicious.lamronba.com"]},"keyPhrases":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"Key phrases flagging the attachment as potential malware","example":["view","completed document"]}},"required":["attachmentName","createdOn","details","keyPhrases","lastUpdated","md5","sha1","sha256","size","type","url"]},"SoarClickedEvent":{"type":"object","description":"Serializer for clicked event representation in responses.","properties":{"type":{"type":"string","description":"Type of click event (click or clickthrough)"},"link":{"type":"string","description":"The URL that was clicked"},"insights":{"type":"array","items":{"type":"string"},"description":"List of insights about the click"},"messageMetadata":{"allOf":[{"$ref":"#/components/schemas/SoarMessageMetadata"}],"description":"Metadata about the email message"},"user":{"allOf":[{"$ref":"#/components/schemas/SoarUserAddress"}],"description":"Information about the user who clicked"},"clickedTime":{"type":"integer","description":"Unix timestamp when the click occurred"}},"required":["clickedTime","insights","link","messageMetadata","type","user"]},"SoarMessageMetadata":{"type":"object","description":"Serializer for message metadata.\n\nNote: the \"from\" field is injected below via `_declared_fields` because\n`from` is a Python keyword and cannot be declared as a class attribute.","properties":{"subject":{"type":"string","nullable":true,"description":"Subject of the email message"},"sender":{"allOf":[{"$ref":"#/components/schemas/SoarUserAddress"}],"description":"Sender of the email message"},"to":{"type":"array","items":{"$ref":"#/components/schemas/SoarUserAddress"},"description":"Recipients of the email message"},"cc":{"type":"array","items":{"$ref":"#/components/schemas/SoarUserAddress"},"description":"CC recipients of the email message"},"from":{"allOf":[{"$ref":"#/components/schemas/SoarUserAddress"}],"description":"Sender of the email message"}},"required":["cc","from","sender","to"]},"SoarUserAddress":{"type":"object","description":"Serializer for user address information.","properties":{"name":{"type":"string","nullable":true,"description":"Display name of the user"},"emailAddress":{"type":"string","description":"Email address of the user who clicked the link"}},"required":["emailAddress"]},"StatusesEnum":{"enum":["NON_COMPLIANT","COMPLIANT","PENDING_EVALUATION","PERMISSIONS_NEEDED"],"type":"string"},"TextBlock":{"type":"object","properties":{"type":{"type":"string","description":"Type of text block (TEXT, LINK, or STATUS)","example":"TEXT"},"text":{"type":"string","description":"Text content of the block","example":"Abnormal Security"},"href":{"type":"string","description":"URL for link type blocks","example":"/home/knowledge/tenant/41ef22d1-8ada-4f0b-a384-5d78274bcedb"}}},"Threat":{"type":"object","properties":{"threatId":{"type":"string","description":"An id which maps to a threat campaign. A threat campaign might be received by multiple users.","example":"184712ab-6d8b-47b3-89d3-a314efef79e2"}},"required":["threatId"]},"ThreatAttachments":{"type":"object","properties":{"abxMessageId":{"type":"integer","description":"An integer representing a unique identifier for an individual message within a threat (i.e email campaign). This is deprecated, use abxMessageIdStr instead.","deprecated":true,"example":4551618356913732000},"abxMessageIdStr":{"type":"string","description":"A string representing a unique identifier for an individual message within a threat (i.e email campaign).","example":4551618356913732000},"attachmentName":{"type":"string","description":"Name of the attachment","example":"attachment1.jpg"}},"required":["abxMessageId","abxMessageIdStr","attachmentName"]},"ThreatAttachmentsResponse":{"type":"object","properties":{"attachments":{"type":"array","items":{"$ref":"#/components/schemas/ThreatAttachments"},"description":"List of attachments in the email messages of a threat"},"tenantId":{"type":"integer","nullable":true,"description":"The tenant ID associated with the threat","example":1234},"tenantName":{"type":"string","nullable":true,"description":"The short name of the tenant associated with the threat","example":"example-tenant"}},"required":["attachments","tenantId","tenantName"]},"ThreatDetails":{"type":"object","properties":{"threatId":{"type":"string","description":"An id which maps to a threat campaign. A threat campaign might be received by multiple users.","example":"184712ab-6d8b-47b3-89d3-a314efef79e2"},"recipientCount":{"type":"integer","description":"The total number of unique recipients who received messages in this threat campaign."},"messages":{"type":"array","items":{"$ref":"#/components/schemas/ThreatMessage"},"description":"A list of messages comprised in this threat (i.e email campaign)."},"tenantId":{"type":"integer","nullable":true,"description":"The tenant ID associated with the threat","example":1234},"tenantName":{"type":"string","nullable":true,"description":"The short name of the tenant associated with the threat","example":"example-tenant"},"pageNumber":{"type":"integer","default":1,"description":"The current page number"},"nextPageNumber":{"type":"integer","default":2,"description":"The next page number. Wil not be includedin the response if there are no more pages of data"}},"required":["messages","recipientCount","tenantId","tenantName","threatId"]},"ThreatLinks":{"type":"object","properties":{"abxMessageId":{"type":"integer","description":"An integer representing a unique identifier for an individual message within a threat (i.e email campaign). This is deprecated, use abxMessageIdStr instead.","deprecated":true,"example":4551618356913732000},"abxMessageIdStr":{"type":"string","description":"A string representing a unique identifier for an individual message within a threat (i.e email campaign).","example":4551618356913732000},"domainLink":{"type":"string","description":"The domain name of the link","example":"lamronba.com"},"linkType":{"type":"string","description":"The type of link in the email","example":"html href"},"source":{"type":"string","description":"The location in the email where the link may be found","example":"body"},"displayText":{"type":"string","description":"The link's display text","example":"This is not a spoof!"},"linkUrl":{"type":"string","description":"The URL of the link","example":"http://spoof.lamronba.com"}},"required":["abxMessageId","abxMessageIdStr","displayText","domainLink","linkType","linkUrl","source"]},"ThreatLinksResponse":{"type":"object","properties":{"links":{"type":"array","items":{"$ref":"#/components/schemas/ThreatLinks"},"description":"List of links in the email messages of a threat"},"tenantId":{"type":"integer","nullable":true,"description":"The tenant ID associated with the threat","example":1234},"tenantName":{"type":"string","nullable":true,"description":"The short name of the tenant associated with the threat","example":"example-tenant"}},"required":["links","tenantId","tenantName"]},"ThreatMessage":{"type":"object","properties":{"threatId":{"type":"string","description":"An id which maps to a threat campaign. A threat campaign might be received by multiple users.","example":"184712ab-6d8b-47b3-89d3-a314efef79e2"},"abxMessageId":{"type":"integer","description":"An integer representing a unique identifier for an individual message within a threat (i.e email campaign). This is deprecated, use abxMessageIdStr instead.","deprecated":true,"example":4551618356913732000},"abxMessageIdStr":{"type":"string","description":"A string representing a unique identifier for an individual message within a threat (i.e email campaign).","example":4551618356913732000},"abxPortalUrl":{"type":"string","description":"The URL at which the specific message details are viewable in Abnormal Security's Portal web interface.","example":"https://portal.abnormalsecurity.com/home/threat-center/remediation-history/4551618356913732076"},"subject":{"type":"string","description":"The email subject.","example":"Phishing Email"},"fromAddress":{"type":"string","description":"The email address of the sender.","example":"support@secure-reply.org"},"fromName":{"type":"string","description":"The display name of the sender.","example":"Support"},"senderDomain":{"type":"string","description":"Email domain of sender (only available for IESS customers)","example":"secure-reply.org"},"toAddresses":{"type":"string","description":"All the email addresses to which the message was sent, comma-separated & truncated at 255 chars.","example":"example@example.com, another@example.com"},"recipientAddress":{"type":"string","description":"The email address of the user who actually received the message.","example":"example@example.com"},"receivedTime":{"type":"string","format":"date-time","description":"The timestamp at which this message arrived.","example":"2020-06-09T17:42:59Z"},"sentTime":{"type":"string","format":"date-time","description":"The timestamp at which this message was sent.","example":"2020-06-09T17:42:59Z"},"internetMessageId":{"type":"string","description":"The internet message ID, per RFC 822","example":"<5edfca1c.1c69fb81.4b055.8fd5@mx.google.com>"},"remediationStatus":{"type":"string","description":"The remediation status of the email threat.","example":"Auto Remediated"},"attackType":{"type":"string","description":"The type of threat the message represents.","example":"Extortion"},"attackStrategy":{"type":"string","description":"The strategy of threat the message represents.","example":"Name Impersonation"},"returnPath":{"type":"string","description":"The path where this message was sent.","example":"support@secure-reply.org"},"replyToEmails":{"type":"array","items":{"type":"string"},"description":"The 'reply-to' list of emails.","example":["reply-to@example.com"]},"ccEmails":{"type":"array","items":{"type":"string"},"description":"List of email addresses CC'ed.","example":["cc@example.com"]},"senderIpAddress":{"type":"string","description":"IP address of sender.","example":"100.101.102.103"},"impersonatedParty":{"type":"string","description":"Impersonated party, if any.","example":"None / Others"},"attackVector":{"type":"string","description":"The attack medium.","example":"Text"},"attachmentNames":{"type":"array","items":{"type":"string"},"description":"List of attachment names, if any.","example":["attachment.pdf"]},"attachmentCount":{"type":"integer","description":"Number of attachments in email (only available for IESS customers)"},"urls":{"type":"array","items":{"type":"string"},"description":"URLs present in the email body, if any.","example":["https://www.google.com/"]},"urlCount":{"type":"integer","description":"Number of urls in email (only available for IESS customers)"},"summaryInsights":{"type":"array","items":{"type":"string"},"description":"A summary of insights into this attack.","example":["Bitcoin Topics","Personal Information Theft","Unusual Sender"]},"remediationTimestamp":{"type":"string","format":"date-time","description":"The timestamp at which this message was remediated, or empty if it has not been remediated.","example":"2020-06-09T17:42:59Z"},"isRead":{"type":"boolean","description":"Whether an email has been read","example":"true"},"attackedParty":{"type":"string","description":"The party that was targeted by an attack.","example":"VIP"},"autoRemediated":{"type":"boolean","description":"Indicates whether Abnormal has automatically detected and remediated the message from the user's Inbox. Note``:`` Abnormal has retained this field and the postRemediated field to support prior integrations, but in newly created integrations, you should capture this information from the remediationStatus field.","example":"True"},"postRemediated":{"type":"boolean","description":"Indicates whether Abnormal remediated the campaign at a later time, after landing in the user's Inbox. Note``:`` Abnormal has retained this field and the autoRemediated field to support prior integrations, but in newly created integrations, you should capture this information from the remediationStatus field.","example":"False"},"source":{"type":"string","nullable":true,"description":"A string representing the judgement of the message.","example":"Attack"},"tenantId":{"type":"integer","nullable":true,"description":"The tenant ID associated with this message.","example":1000},"tenantName":{"type":"string","nullable":true,"description":"The tenant name associated with this message.","example":"acme-corp"},"customerOverride":{"allOf":[{"$ref":"#/components/schemas/CustomerOverride"}],"nullable":true}},"required":["abxMessageId","abxMessageIdStr","abxPortalUrl","attachmentCount","attachmentNames","attackStrategy","attackType","attackVector","attackedParty","autoRemediated","ccEmails","fromAddress","fromName","impersonatedParty","internetMessageId","isRead","postRemediated","receivedTime","recipientAddress","remediationStatus","remediationTimestamp","replyToEmails","returnPath","senderDomain","senderIpAddress","sentTime","subject","summaryInsights","threatId","toAddresses","urlCount","urls"]},"TimelineEntry":{"type":"object","properties":{"entry_type":{"type":"string","description":"Type of timeline entry (WORKFLOW_ITEM or NOTABLE_EVENT)","example":"WORKFLOW_ITEM"},"detail":{"allOf":[{"$ref":"#/components/schemas/TimelineEntryDetail"}],"description":"Detailed information about the timeline entry"}}},"TimelineEntryDetail":{"type":"object","properties":{"id":{"type":"integer","description":"Unique identifier for the timeline entry","example":175},"title":{"type":"string","description":"Title of the timeline event","example":"Posture Workflow Status Updated"},"created_at":{"type":"string","format":"date-time","description":"Timestamp when the event was created","example":"2025-04-29T15:51:46.564185Z"},"updated_at":{"type":"string","format":"date-time","description":"Timestamp when the event was last updated","example":"2025-04-29T15:51:46.564185Z"},"description":{"type":"array","items":{"$ref":"#/components/schemas/TextBlock"},"description":"Structured description of the event as text blocks"},"category":{"allOf":[{"$ref":"#/components/schemas/DisplayId"}],"description":"Category classification for the event"},"event_id":{"type":"string","description":"External event identifier","example":"33646635-3331-6332-3964-363137646630"},"risk":{"allOf":[{"$ref":"#/components/schemas/DisplayId"}],"description":"Risk level associated with the event"},"abnormality":{"allOf":[{"$ref":"#/components/schemas/DisplayId"}],"description":"Abnormality level of the event"}}},"TokenListResponseSwagger":{"type":"object","description":"Swagger serializer for token list response.","properties":{"status":{"type":"string","default":"success","description":"Response status"},"status_code":{"type":"integer","default":200,"description":"HTTP status code"},"data":{"type":"array","items":{"$ref":"#/components/schemas/TokenSwagger"},"description":"List of API tokens"},"pagination":{"allOf":[{"$ref":"#/components/schemas/PaginationSwagger"}],"description":"Pagination metadata"}},"required":["data","pagination"]},"TokenSwagger":{"type":"object","description":"Swagger serializer for token object.","properties":{"token_id":{"type":"string","description":"Unique token identifier (UUID)"},"name":{"type":"string","description":"Token name"},"version":{"type":"string","description":"Token version (v1 or v2)"},"status":{"type":"string","description":"Token status (active, expired, revoked)"},"created_at":{"type":"string","format":"date-time","description":"Token creation timestamp (ISO 8601)"},"expires_at":{"type":"string","format":"date-time","description":"Token expiration timestamp (ISO 8601)"},"permissions":{"type":"array","items":{"type":"string"},"description":"List of endpoint permissions (e.g., soar_v1_read_threats, soar_v1_manage_threat)"}},"required":["created_at","expires_at","name","permissions","status","token_id","version"]},"TrendingAttacks":{"type":"object","properties":{"attackCount":{"type":"integer","description":"The number of occurrences of the attack for the specified attack type in the current time frame.","example":200},"attackType":{"type":"string","description":"The name or type of the attack detected.","example":"Scam"},"attackTypeDescription":{"type":"string","description":"A detailed description of the attack type detected.","example":"Advance fee fraud and similar scams"},"prevAttackCount":{"type":"integer","description":"The number of occurrences of the attack in the previous time frame.","example":201}},"required":["attackCount","attackType","attackTypeDescription","prevAttackCount"]},"TrendingAttacksResponse":{"type":"object","properties":{"trending_attacks":{"type":"array","items":{"$ref":"#/components/schemas/TrendingAttacks"},"description":"List detailing various trending attacks, along with the current and previous attack counts for each."}},"required":["trending_attacks"]},"UpdateResourceResponse":{"type":"object","description":"Serializer for update resource response.","properties":{"resourceId":{"type":"string","description":"ID of the updated resource"},"status":{"type":"string","description":"Status of the update operation"}},"required":["resourceId","status"]},"User":{"type":"object","properties":{"name":{"type":"string","description":"The name of the user","example":"Ching Li-Hsieh"},"email":{"type":"string","description":"The email address of the user","example":"lhching@bigcompany.com"}},"required":["name"]},"UserListResponse":{"type":"object","description":"Swagger serializer for user list response.","properties":{"status":{"type":"string","default":"success","description":"Status of the response"},"status_code":{"type":"integer","default":200,"description":"HTTP status code"},"data":{"type":"array","items":{"$ref":"#/components/schemas/UserSwagger"},"description":"List of users from RBAC system with their roles and resource permissions"}},"required":["data"]},"UserSwagger":{"type":"object","description":"Swagger serializer for user object.","properties":{"user_id":{"type":"integer","description":"The unique identifier for the user"},"email":{"type":"string","format":"email","description":"Email address of the user"},"groups":{"type":"array","items":{"type":"string"},"default":[],"description":"List of group IDs the user belongs to"},"local_login_enabled":{"type":"boolean","default":false,"description":"Whether local login is enabled for the user"},"sso_enabled":{"type":"boolean","default":true,"description":"Whether SSO is enabled for the user"},"role":{"allOf":[{"$ref":"#/components/schemas/RoleSwagger"}],"description":"Role assigned to the user with associated permissions"},"resource_permissions":{"type":"array","items":{"$ref":"#/components/schemas/ResourcePermissionSwagger"},"description":"List of resource permissions granted to the user through their role (only includes enabled permissions)"}},"required":["email","user_id"]},"VendorActivity":{"type":"object","properties":{"eventTimeline":{"type":"array","items":{"$ref":"#/components/schemas/VendorActivityEvent"}}},"required":["eventTimeline"]},"VendorActivityEvent":{"oneOf":[{"$ref":"#/components/schemas/VendorFederatedEventTimeline"},{"$ref":"#/components/schemas/VendorInvestigationEventTimeline"}]},"VendorCaseDetails":{"type":"object","properties":{"vendorCaseId":{"type":"integer","description":"Unique ID of vendor case.","example":0},"vendorDomain":{"type":"string","description":"Domain of vendor.","example":"vendor.com"},"firstObservedTime":{"type":"string","format":"date-time","description":"The timestamp at which the first message associated with this vendor case arrived.","example":"2020-06-09T17:42:59Z"},"lastModifiedTime":{"type":"string","format":"date-time","description":"The latest timestamp when details of the vendor case was last modified.","example":"2020-06-09T17:42:59Z"},"insights":{"type":"array","items":{"$ref":"#/components/schemas/VendorCaseInsights"},"readOnly":true,"description":"List of insights generated by Abnormal Security."},"timeline":{"type":"array","items":{"$ref":"#/components/schemas/VendorCaseTimeline"},"readOnly":true,"description":"List of timeline events relevant to case."}},"required":["firstObservedTime","insights","lastModifiedTime","timeline","vendorCaseId","vendorDomain"]},"VendorCaseInsights":{"type":"object","properties":{"highlight":{"type":"string","readOnly":true},"description":{"type":"string","readOnly":true}},"required":["description","highlight"]},"VendorCaseTimeline":{"type":"object","properties":{"eventTimestamp":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp of event","example":"2021-01-01T00:00:00Z"},"senderAddress":{"type":"string","description":"Sender Address","example":"alice@vendor.com"},"recipientAddress":{"type":"string","description":"Recipient Address","example":"bob@company.com"},"subject":{"type":"string","description":"Subject of the event","example":"Click Me!"},"markedAs":{"type":"string","readOnly":true,"description":"Indication if your organisation has interacted with email","example":"Malicious"},"threatId":{"type":"string","description":"Unique ID of email threat. May be used in /threats endpoint","example":"184712ab-6d8b-47b3-89d3-a314efef79e2"}},"required":["eventTimestamp","markedAs","recipientAddress","senderAddress","subject","threatId"]},"VendorCases":{"type":"object","properties":{"vendorCaseId":{"type":"integer","description":"Unique ID of vendor case."}},"required":["vendorCaseId"]},"VendorDetail":{"type":"object","properties":{"vendorDomain":{"type":"string","readOnly":true,"description":"The domain used by the vendor.","example":"vendor.com"},"riskLevel":{"type":"string","readOnly":true,"description":"The risk level of the vendor.","example":"High"},"vendorContacts":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"Mailboxes from the vendor that had prior interaction with.","example":["alice@vendor.com"]},"companyContacts":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"Mailboxes from your organisation that had prior interaction with vendor.","example":["bob@company.com"]},"vendorCountries":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"Countries which vendor interactions originated from.","example":["United States"]},"analysis":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"Analysis provided by Abnormal Security.","example":["Vendor compromise observed in Abnormal Community"]},"vendorIpAddresses":{"type":"array","items":{"type":"string"},"readOnly":true,"description":"IP addresses which vendor interactions originated from.","example":["127.0.0.1"]}},"required":["analysis","companyContacts","riskLevel","vendorContacts","vendorCountries","vendorDomain","vendorIpAddresses"]},"VendorFederatedEventTimeline":{"type":"object","properties":{"eventTimestamp":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp of event","example":"2021-01-01T00:00:00Z"},"eventType":{"type":"string","readOnly":true,"description":"Type of event detected","example":"Federated Signal"},"suspiciousDomain":{"type":"string","readOnly":true,"description":"Domain which event originated from","example":"alice@vendor.com"},"domainIp":{"type":"string","readOnly":true,"description":"IP address which event originated from","example":"127.0.0.1"},"ipGeolocation":{"type":"string","readOnly":true,"description":"Country Code which event originated from","example":"US"},"attackGoal":{"type":"string","readOnly":true,"description":"Objectives behind event","example":"malware and ransom"}},"required":["attackGoal","domainIp","eventTimestamp","eventType","ipGeolocation","suspiciousDomain"]},"VendorInvestigationEventTimeline":{"type":"object","properties":{"eventTimestamp":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp of event","example":"2021-01-01T00:00:00Z"},"eventType":{"type":"string","readOnly":true,"description":"Type of event detected","example":"Targeted Attack"},"suspiciousDomain":{"type":"string","readOnly":true,"description":"Domain which event originated from","example":"alice@vendor.com"},"attackGoal":{"type":"string","readOnly":true,"description":"Objectives behind event","example":"malware and ransom"},"actionTaken":{"type":"string","readOnly":true,"description":"Actions taken by Abnormal Security","example":"Post Remediated"},"hasEngagement":{"type":"boolean","readOnly":true,"description":"Indication if your organisation has interacted with email","example":"False"},"recipient":{"type":"string","readOnly":true,"description":"Recipient of email","example":"bob@company.com"},"threatId":{"type":"string","readOnly":true,"description":"Unique ID of email threat. May be used in /threats endpoint","example":"184712ab-6d8b-47b3-89d3-a314efef79e2"}},"required":["actionTaken","attackGoal","eventTimestamp","eventType","hasEngagement","recipient","suspiciousDomain","threatId"]},"Vendors":{"type":"object","properties":{"vendorDomain":{"type":"string","description":"The domain used by the vendor.","example":"vendor.com"}},"required":["vendorDomain"]},"WorkflowLogRawJson":{"type":"object","description":"Serializer for the workflow log raw json response.","properties":{"raw_json":{"type":"string","description":"Raw JSON data from the workflow log","example":"{\"status\": \"updated\", \"workflow_status\": \"UNTRIAGED\", \"timestamp\": \"2025-04-29T15:51:46.564185Z\"}"}}}},"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer"}}},"servers":[{"url":"https://api.abnormalplatform.com/v1","description":"Production Server for managing threats"},{"url":"https://eu.rest.abnormalsecurity.com/v1","description":"EU Production Server for managing threats."}],"tags":[{"name":"Dashboard Aggregations","description":"APIs to manage Dashboard metrics"},{"name":"Threats","description":"APIs to manage threats notified in the Abnormal Threat Log"},{"name":"Cases","description":"APIs to manage Abnormal Cases"},{"name":"Messages","description":"API to manage message details"},{"name":"AI Security Mailbox (formerly known as Abuse Mailbox)","description":"API to manage AI Security Mailbox (formerly known as Abuse Mailbox)"},{"name":"Employee Insights","description":"API to manage employees"},{"name":"Vendors","description":"API to manage Vendorbase and threats from Vendors"},{"name":"Audit Logs","description":"API to retrieve audit logs for Portal"},{"name":"Roles","description":"API to retrieve roles from RBAC system"},{"name":"Users","description":"API to retrieve users from RBAC system"},{"name":"Tokens","description":"API to manage SOAR API tokens"},{"name":"Security Settings","description":"API to retrieve security settings including session timeout configuration"}],"security":[{"BearerAuth":[]}]}