Abnormal Security Cases

Abnormal Security Abuse Mailbox Cases

Overview

Abnormal Security's Abuse Mailbox automatically processes user-reported suspicious emails. When users forward or report emails to a designated abuse mailbox address, Abnormal analyzes the reported message and creates a case with an AI-generated judgment. This skill covers case lifecycle, triage workflows, remediation actions, and bulk operations.

Anti-triggers

• A compromised mailbox rather than a reported email — sign-in anomalies, new inbox rules, and session revocation have no surface on this server at all; investigate identity in the M365 tenant, use cipp-users.
• Threats Abnormal found on its own — no user reported them, so no case exists; use Abnormal Security Threats.
• User-reported phishing in a different platform — IRONSCALES runs its own report-to-incident loop from its Outlook and Gmail add-ins, with separate IDs and its own classification verbs; use IRONSCALES Incidents.
• A user who reported a simulated phish — campaign reporting rates belong to the training platform; use KnowBe4 Phishing.

Case Lifecycle

User Reports Email
       |
       v
  Case Created (status: Open)
       |
       v
  AI Analysis (judgment generated)
       |
       +---> Malicious   ---> Auto-Remediate (if configured)
       |
       +---> Suspicious  ---> Analyst Review Required
       |
       +---> Spam         ---> Auto-Dismiss (if configured)
       |
       +---> Safe         ---> Auto-Dismiss (if configured)
       |
       v
  Analyst Action
       |
       +---> Remediate (quarantine/delete across org)
       |
       +---> Mark Not Spam (release to inbox)
       |
       +---> Dismiss (close case, no action)
       |
       v
  Case Closed (status: Done)

Case Field Reference

Core Fields

Field	Type	Description
caseId	number	Unique case identifier — numeric, unlike threatId
severity	string	Severity level of the case
affectedEmployee	string	Email address of the user who reported
firstReported	datetime	When the case was first reported