Discover available Abnormal Security tools by domain. Returns tool names and descriptions for the selected domain. All tools are callable at any time — this is a help/discovery aid, not a prerequisite.

Show connection status and available domains

List detected threats and cases from Abnormal Security. Returns a paginated list of threat IDs with summary information.

Get detailed information about a specific threat case by ID. Returns threat details including classification, severity, and related message IDs.

List messages contained within a specific threat case. Returns message IDs and summary data for all emails associated with the threat.

Get detailed analysis of a specific message within a threat case. Returns full message metadata, headers, URLs, attachments, and AI-based threat analysis.

Trigger or check the status of a remediation action for a specific threat message. Supports requesting remediation (removal from mailboxes) or checking current remediation status.

List phishing emails reported by users via the Abuse Mailbox. Returns user-submitted reports with analysis results indicating whether Abnormal confirmed the threat.

List all active security investigation cases in Abnormal Security. Cases group related threats for analyst review and workflow management.

Get detailed information about a specific security case by ID. Returns case status, analyst notes, associated threats, and timeline.