search-threats

Search Threats

Search and filter email threats detected by Abnormal Security using various criteria.

Prerequisites

• Valid Abnormal Security API token configured (ABNORMAL_API_TOKEN)
• API token must have threat detection read permissions

Steps

1. Build search filter

   • Parse all provided arguments
   • Construct OData filter expression
   • Validate date range

2. Execute search query

   GET /v1/threats?filter=...&pageSize=...
   Authorization: Bearer <token>
   

3. Format and return results

   • Display threat list with key details
   • Include AI-generated insights for each threat

Parameters

Parameter	Type	Required	Default	Description
query	string	No	-	Free text search
type	string	No	-	bec/phishing/malware/extortion/scam/spam/supply-chain
sender	string	No	-	Sender email address or domain
recipient	string	No	-	Target recipient address
status	string	No	all	remediated/not-remediated/post-remediated/all
start-date	string	No	7d ago	ISO 8601 date
end-date	string	No	now	ISO 8601 date
limit	int	No	25	Max results (1-100)

Examples

Search by Attack Type

/search-threats --type bec

Threats from a Specific Sender

/search-threats --sender "[email protected]"

Threats Targeting Finance Team

/search-threats --recipient "[email protected]"

BEC Threats This Month

/search-threats --type bec --start-date "2026-03-01" --limit 50

Search by Keyword

/search-threats --query "wire transfer"

Supply Chain Threats

/search-threats --type supply-chain --start-date "2026-03-01"

Output

Found 3 threats matching criteria (last 7 days)

+-----------+-----------+----------+---------------------+-----------------------------------+-------------------+-----------+
| Threat ID | Type      | Severity | Sender              | Subject                           | Received          | Status    |
+-----------+-----------+----------+---------------------+-----------------------------------+-------------------+-----------+
| 184def76  | BEC       | Critical | [email protected]     | Urgent: Wire Transfer Request     | 2026-03-27 09:15  | Not Remed |
| 29abc134  | BEC       | High     | [email protected]     | Confidential: Payment Update      | 2026-03-25 14:20  | Remediated|
| 3f4e5d6c  | BEC       | High     | [email protected]      | Employee Direct Deposit Change    | 2026-03-23 11:05  | Remediated|
+-----------+-----------+----------+---------------------+-----------------------------------+-------------------+-----------+

Summary:
- Critical: 1 | High: 2
- Unremediated: 1 | Remediated: 2

AI Insights (threat 184def76):
- Display name matches internal CEO but email domain is typosquat
- Reply-to address differs from sender address
- Financial request with urgency language detected
- First-time sender from this domain

Quick Actions:
- View threat details: Use abnormal_threats_get with the threat UUID
- Triage all threats: /threat-triage
- Enumerate the threat's messages: Use abnormal_messages_list