You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: packages/abnormal_security/_dev/build/docs/README.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
-
# Abnormal Security
1
+
# Abnormal AI
2
2
3
-
Abnormal Security is a behavioral AI-based email security platform that learns the behavior of every identity in a cloud email environment and analyzes the risk of every event to block even the most sophisticated attacks.
3
+
Abnormal AI is a behavioral AI-based email security platform that learns the behavior of every identity in a cloud email environment and analyzes the risk of every event to block even the most sophisticated attacks.
4
4
5
-
The Abnormal Security integration collects data for AI Security Mailbox (formerly known as Abuse Mailbox), Audit, Case, and Threat logs using REST API.
5
+
The Abnormal AI integration collects data for AI Security Mailbox (formerly known as Abuse Mailbox), Audit, Case, and Threat logs using REST API.
6
6
7
7
## Data streams
8
8
9
-
The Abnormal Security integration collects six types of logs:
9
+
The Abnormal AI integration collects six types of logs:
10
10
11
11
-**[AI Security Mailbox](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox))** - Get details of AI Security Mailbox.
12
12
@@ -26,31 +26,31 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
26
26
27
27
## Setup
28
28
29
-
### To collect data from the Abnormal Security Client API:
29
+
### To collect data from the Abnormal AI Client API:
30
30
31
31
#### Step 1: Go to Portal
32
-
* Visit the [Abnormal Security Portal](https://portal.abnormalsecurity.com/home/settings/integrations) and click on the `Abnormal REST API` setting.
32
+
* Visit the [Abnormal AI Portal](https://portal.abnormalsecurity.com/home/settings/integrations) and click on the `Abnormal REST API` setting.
33
33
34
34
#### Step 2: Generating the authentication token
35
-
* Retrieve your authentication token. This token will be used further in the Elastic integration setup to authenticate and access different Abnormal Security Logs.
35
+
* Retrieve your authentication token. This token will be used further in the Elastic integration setup to authenticate and access different Abnormal AI Logs.
36
36
37
37
#### Step 3: IP allowlisting
38
-
* Abnormal Security requires you to restrict API access based on source IP. So in order for the integration to work, user needs to update the IP allowlisting to include the external source IP of the endpoint running the integration via Elastic Agent.
38
+
* Abnormal AI requires you to restrict API access based on source IP. So in order for the integration to work, user needs to update the IP allowlisting to include the external source IP of the endpoint running the integration via Elastic Agent.
39
39
40
40
### Enabling the integration in Elastic:
41
41
42
42
1. In Kibana navigate to Management > Integrations.
43
-
2. In "Search for integrations" top bar, search for `Abnormal Security`.
44
-
3. Select the "Abnormal Security" integration from the search results.
45
-
4. Select "Add Abnormal Security" to add the integration.
43
+
2. In "Search for integrations" top bar, search for `Abnormal AI`.
44
+
3. Select the "Abnormal AI" integration from the search results.
45
+
4. Select "Add Abnormal AI" to add the integration.
46
46
5. Add all the required integration configuration parameters, including Access Token, Interval, Initial Interval and Page Size to enable data collection.
47
47
6. Select "Save and continue" to save the integration.
48
48
49
-
**Note**: By default, the URL is set to `https://api.abnormalplatform.com`. We have observed that Abnormal Security Base URL changes based on location so find your own base URL.
49
+
**Note**: By default, the URL is set to `https://api.abnormalplatform.com`. We have observed that Abnormal AI Base URL changes based on location so find your own base URL.
50
50
51
51
### Enabling enrichment for Threat events
52
52
53
-
Introduced in version 1.8.0, the Abnormal Security integration includes a new option called `Enable Attachments and Links enrichment` for the Threat data stream. When enabled, this feature enriches incoming threat events with additional details about any attachments and links included in the original message.
53
+
Introduced in version 1.8.0, the Abnormal AI integration includes a new option called `Enable Attachments and Links enrichment` for the Threat data stream. When enabled, this feature enriches incoming threat events with additional details about any attachments and links included in the original message.
Copy file name to clipboardExpand all lines: packages/abnormal_security/data_stream/ai_security_mailbox_not_analyzed/manifest.yml
+3-3Lines changed: 3 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -13,18 +13,18 @@ streams:
13
13
required: true
14
14
show_user: true
15
15
default: 2160h
16
-
description: How far back to pull the AI Security Mailbox Not Analyzed messages from Abnormal Security API. Defaults to 90 days (2160h) before end. Supported units for this parameter are h/m/s.
16
+
description: How far back to pull the AI Security Mailbox Not Analyzed messages from Abnormal AI API. Defaults to 90 days (2160h) before end. Supported units for this parameter are h/m/s.
17
17
- name: wait_interval
18
18
type: text
19
19
title: Recent Message Grace Interval
20
20
multi: false
21
21
required: true
22
22
show_user: true
23
-
description: How long to wait before attempting to collect recent messages. This option allows the Abnormal Security API to complete analysis of messages before the agent attempts to collect them. This should not be greater than the initial interval. Supported units for this parameter are h/m/s.
23
+
description: How long to wait before attempting to collect recent messages. This option allows the Abnormal AI API to complete analysis of messages before the agent attempts to collect them. This should not be greater than the initial interval. Supported units for this parameter are h/m/s.
24
24
- name: interval
25
25
type: text
26
26
title: Interval
27
-
description: Duration between requests to the Abnormal Security API. Defaults to 1 hour. Supported units for this parameter are h/m/s.
27
+
description: Duration between requests to the Abnormal AI API. Defaults to 1 hour. Supported units for this parameter are h/m/s.
0 commit comments