{"slug":"abnormal-security-cases","title":"Abnormal Security Cases","summary":"Abnormal Security abuse mailbox cases: user-reported email submissions, case statuses and judgments, the case lifecycle, bulk and remediation actions, and phishing simulation handling.","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-09-21T18:26:32.494936Z","repo":{"url":"https://github.com/WYRE-AI/msp-claude-plugins","stars":47,"forks":26,"license":"Apache-2.0","updatedAt":"2026-09-29T18:42:56Z"},"bodyHtml":"
\n

name: \"Abnormal Security Cases\"\ndescription: >\nAbnormal Security abuse mailbox cases: user-reported email submissions,\ncase statuses and judgments, the case lifecycle, bulk and remediation\nactions, and phishing simulation handling.\nwhen_to_use: >-\nWhen triaging or remediating user-reported suspicious emails in the\nAbnormal Security abuse mailbox. Use when: abnormal case, abuse mailbox,\nuser reported email, reported phishing, case triage, case review, abnormal\ncases, abuse case management, phishing report, user submission, case\nremediation, or case judgment.

\n

Abnormal Security Abuse Mailbox Cases

\n

Overview

\n

Abnormal Security's Abuse Mailbox automatically processes user-reported suspicious emails. When users forward or report emails to a designated abuse mailbox address, Abnormal analyzes the reported message and creates a case with an AI-generated judgment. This skill covers case lifecycle, triage workflows, remediation actions, and bulk operations.

\n

Anti-triggers

\n\n

Case Lifecycle

\n
User Reports Email\n       |\n       v\n  Case Created (status: Open)\n       |\n       v\n  AI Analysis (judgment generated)\n       |\n       +---> Malicious   ---> Auto-Remediate (if configured)\n       |\n       +---> Suspicious  ---> Analyst Review Required\n       |\n       +---> Spam         ---> Auto-Dismiss (if configured)\n       |\n       +---> Safe         ---> Auto-Dismiss (if configured)\n       |\n       v\n  Analyst Action\n       |\n       +---> Remediate (quarantine/delete across org)\n       |\n       +---> Mark Not Spam (release to inbox)\n       |\n       +---> Dismiss (close case, no action)\n       |\n       v\n  Case Closed (status: Done)\n
\n

Case Field Reference

\n

Core Fields

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldTypeDescription
caseIdnumberUnique case identifier — numeric, unlike threatId
severitystringSeverity level of the case
affectedEmployeestringEmail address of the user who reported
firstReporteddatetimeWhen the case was first reported
\n

Judgment Fields

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldTypeDescription
overallStatusstringCase status: Open, Acknowledged, Done
judgmentStatusstringAI judgment: Malicious, Spam, Safe, No Action Needed
customerVisibleTimedatetimeWhen the case became visible in portal
\n

Reported Message Fields

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldTypeDescription
reportedMessage.subjectstringSubject of the reported email
reportedMessage.senderAddressstringSender of the reported email
reportedMessage.senderNamestringDisplay name of the sender
reportedMessage.recipientAddressstringRecipient of the reported email
reportedMessage.receivedTimedatetimeWhen the reported email was received
reportedMessage.attackTypestringDetected attack type (if malicious)
\n

Case Judgments

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
JudgmentDescriptionRecommended Action
MaliciousConfirmed threat (BEC, phishing, malware)Remediate across organization
SpamUnsolicited bulk email, marketingDismiss or move to junk
SafeLegitimate email, no threat detectedDismiss, notify user it is safe
No Action NeededPhishing simulation or already remediatedDismiss
\n

MCP Tools

\n

The cases domain is read-only. Two tools, both GETs. There is no tool\nthat changes a case's state, assigns it to an analyst, dismisses it, or\ncloses it. Case state changes happen in the Abnormal portal, not through\nthis server — an agent can read and reason about a case, then it has to\nhand the actual disposition to a human in the UI.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ToolDescriptionParameters
abnormal_cases_listList casespageSize (default 100, max 100), pageNumber (1-indexed), filter (OData string)
abnormal_cases_getGet one case by IDcaseId (required, number)
\n

There is no date-range parameter. Narrow by time through the OData\nfilter string: createdTime gt 2026-03-01T00:00:00Z.

\n

ID vocabulary

\n

caseId is a number — 12345, not \"12345\". The neighbouring\nthreatId used by abnormal_threats_get is a UUID string. Both are\ncalled \"the ID\" in conversation and they are not interchangeable; a\nthreat UUID passed to abnormal_cases_get is a type error, not a lookup\nmiss.

\n

The one action this server can take on the mail behind a case is\nmessage remediation, and it is reached through the threat, not the case:\nabnormal_remediation_manage needs a threatId and a messageId, and a\ncaseId is neither.

\n

Tool Usage Examples

\n

List cases from this month:

\n
{\n  \"tool\": \"abnormal_cases_list\",\n  \"parameters\": {\n    \"filter\": \"createdTime gt 2026-03-01T00:00:00Z\",\n    \"pageSize\": 25\n  }\n}\n
\n

Get case details:

\n
{\n  \"tool\": \"abnormal_cases_get\",\n  \"parameters\": {\n    \"caseId\": 12345\n  }\n}\n
\n

Triage Workflows

\n

Standard Triage Workflow

\n
    \n
  1. List open cases - Get all cases with overallStatus eq 'Open'
    2. \n
  2. Sort by severity - Address critical and high severity first
    3. \n
  3. Review AI judgment:\n\n
    4. \n
  4. Decide - produce the disposition and the evidence for it
    5. \n
  5. Hand off - the case's own state (Open → Acknowledged → Done) can\nonly be changed in the Abnormal portal. If mail still needs pulling\nfrom inboxes, that runs through the threat:\nabnormal_messages_list then abnormal_remediation_manage per\nmessage.
    6. \n
\n

Bulk Triage Workflow

\n
    \n
  1. Filter cases by judgment - Start with cases judged as Malicious
    2. \n
  2. Review Suspicious - Manually review cases without clear judgment
    3. \n
  3. Batch the read, not the write - paginate abnormal_cases_list to\nbuild the full picture in one pass. There is no bulk case action to\nfollow it with; dispositions are entered in the portal one at a time.
    4. \n
\n

Escalation Criteria

\n

Escalate a case when:

\n\n

Case Actions — where they actually happen

\n

The dispositions below are portal actions. None of them is an MCP tool,\nand none can be driven from this server.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
DispositionEffectWhere
RemediateRemove the email from recipients' inboxesAbnormal portal — or, per message, via abnormal_remediation_manage on the underlying threat
Mark not spamRelease email back to inboxAbnormal portal only
DismissClose case without actionAbnormal portal only
\n

The gap matters for automation design: an agent can fully triage the\nqueue from abnormal_cases_list and abnormal_cases_get, but the case\nstays Open until a human touches the portal. Write the handoff into the\nworkflow rather than assuming the agent closed anything.

\n

Error Handling

\n

Common API Errors

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CodeMessageResolution
400Invalid filterCheck OData filter syntax
401UnauthorizedCheck API token
403Insufficient permissionsToken needs abuse mailbox scope
404Case not foundVerify the case ID — and that you passed a numeric caseId, not a threat UUID
429Rate limitedWait and retry
\n

Best Practices

\n
    \n
  1. Triage daily - Review abuse mailbox cases at least once per day
    2. \n
  2. Trust the AI judgment - Abnormal's accuracy is high; use it to prioritize
    3. \n
  3. Remediate every message, not \"the case\" - remediation is per message on the underlying threat; loop abnormal_remediation_manage and confirm each one, or you will leave the campaign half-pulled
    4. \n
  4. Respond to reporters - Let users know their report was reviewed
    5. \n
  5. Track phishing simulation reports - Monitor security awareness training effectiveness
    6. \n
  6. Correlate with threats - Check if reported emails match known threat campaigns
    7. \n
  7. Monitor false positive rate - High FP rates may indicate policy tuning needed
    8. \n
\n

Related Skills

\n\n","files":[{"path":"SKILL.md","sizeBytes":9311,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-09-21T18:26:42.741155Z","sha256":"DFC36FF2073DEAE37CF12D8259F759066A1C31F6A65DF0EF4816A6A39F280739","sizeBytes":3786},"review":null,"source":{"repositoryUrl":"https://github.com/WYRE-AI/msp-claude-plugins","path":"msp-claude-plugins/abnormal/abnormal-security/skills/cases","license":"Apache-2.0","commit":"9dad81e23a2f5a868fd6a66e1b0b8c1a1612a243","subtreeSha":"A443FE73191EF0188DA5ABA572BD5027C35BCD8A5279A032226AD1225B3B38EC","lastSyncedAt":"2026-09-29T20:56:48.29469Z"},"reviewedAt":"2026-09-21T18:27:09.985658Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/WYRE-AI/msp-claude-plugins/tree/main/msp-claude-plugins/abnormal/abnormal-security/skills/cases"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install wyre-ai-msp-claude-plugins@llmmart"},{"target":"git","command":"git clone https://github.com/WYRE-AI/msp-claude-plugins.git"}]}