---
title: "Abnormal Security Abnormal Security Integration"
slug: "abnormal-security-s3"
updated: 2026-11-02T10:27:20Z
published: 2026-11-02T10:27:20Z
canonical: "docs.hunters.ai/abnormal-security-s3"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Abnormal Security Abnormal Security Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Abnormal Security Cases | ✅ |  |  | ✅ | `abnormal_security_cases` | JSON | S3 |

## Overview

Abnormal Security is a cloud-native email and identity security platform that uses behavioral AI to detect account takeover, phishing, business email compromise, and other identity-based attacks across email and SaaS/cloud identity providers (e.g., Microsoft 365, Google Workspace, Okta). This integration ingests "Cases" generated by Abnormal Security's detection engine — aggregated security investigations that bundle together related suspicious activity (sign-ins, risk events, email campaigns, audit log activity) tied to a specific affected employee. Each case includes a severity classification, confidence score, remediation status, and a human-readable GenAI-generated summary describing the underlying evidence. Ingesting these cases into Hunters surfaces high-fidelity, triaged account takeover and insider-threat signals — including geolocation anomalies, browser/OS fingerprints, and campaign-level phishing activity — enabling security teams to rapidly investigate and respond to compromised identities alongside other telemetry in the Hunters platform.

## Supported data types

### Abnormal Security Cases

**Table name:** `abnormal_security_cases`

This data type contains Abnormal Security "Case" records — investigations automatically generated and triaged by Abnormal Security's detection engine. Each case aggregates related suspicious activity (such as anomalous sign-ins, lateral phishing campaigns, or privilege escalation) for a specific affected employee, and includes severity, confidence, remediation status, and a GenAI-generated natural-language summary of the underlying evidence.

**Expected format**

Logs are expected in nested JSON format, with case details embedded as a JSON string in the `_raw` field alongside flattened top-level fields.

`{"host": "ip-10-24-83-142-main-nimbus-falcon-7p2maq8", "source": "https://eu.rest.abnormalsecurity.com/v1/cases/55016646", "_raw": "{\"caseId\": 55016646, \"affectedEmployee\": \"riley.jordan@acmecorp.com\", \"analysis\": \"SIGN_IN\", \"case_status\": \"Acknowledged (In progress)\", \"customerVisibleTime\": \"2026-03-31T16:40:26.817970+00:00\", \"firstObserved\": \"2026-03-31T16:12:22+00:00\", \"remediation_status\": \"remediated\", \"severity\": \"Account Takeover\", \"severity_level\": \"HIGH\", \"confidence\": \"HIGH\", \"threatIds\": [], \"genai_summary\": [\"Mail filter was created within 2 hours of suspicious sign-in activity, indicating attacker persistence after initial access.\"], \"tenant\": \"acme_corp\"}", "caseId": 55016646, "affectedEmployee": "riley.jordan@acmecorp.com", "analysis": "SIGN_IN", "case_status": "Acknowledged (In progress)", "severity": "Account Takeover", "severity_level": "HIGH", "confidence": "HIGH", "tenant": "acme_corp", "_time": 1785161703.346, "cribl_breaker": "Abnormal_Ruleset:Abnormal_Event_Breaker_Collect", "cribl_pipe": ["passthru", "passthru"]}`

## Send data to Hunters

Hunters supports the collection of Abnormal Security logs using S3.

**To connect Abnormal Security logs:**

1. Route Abnormal Security Cases logs into an AWS S3 bucket (for example, via a Cribl pipeline that pulls case data from the Abnormal Security REST API and stages it in S3).
2. Once logs are in S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3).