Initial release

efd6 · Aug 9, 2024 · Jul 30, 2024 · Jul 30, 2024 · Aug 6, 2024 · Aug 8, 2024
commit bb0c4e03c25178e0e932f6a43c4e11de880f3db5
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -8,6 +8,7 @@
 # Package owners below.
 # Please keep the list sorted.
 /packages/1password @elastic/security-service-integrations
+/packages/abnormal_security @elastic/security-service-integrations
 /packages/activemq @elastic/obs-infraobs-integrations
 /packages/airflow @elastic/obs-infraobs-integrations
 /packages/akamai @elastic/security-service-integrations

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: git@v8.11.0
@@ -0,0 +1,105 @@
+# Abnormal Security
+
+Abnormal Security is a behavioral AI-based email security platform that learns the behavior of every identity in a cloud email environment and analyzes the risk of every event to block even the most sophisticated attacks.
+
+The Abnormal Security integration collects data for AI Security Mailbox (formerly known as Abuse Mailbox), Audit, Case, and Threat logs using REST API.
+
+## Data streams
+
+The Abnormal Security integration collects four types of logs:
+
+**[AI Security Mailbox](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox))** - Get details of an AI Security Mailbox.
+
+**[Audit](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Audit%20Logs)** - Get details of an Audit logs for Portal.
+
+**[Case](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Cases)** - Get details of an Abnormal Cases.
+
+**[Threat](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Threats)** - Get details of an Abnormal Threat Log.
+
+## Requirements
+
+Elastic Agent must be installed. For more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
+
+### Installing and managing an Elastic Agent:
+
+You have a few options for installing and managing an Elastic Agent:
+
+### Install a Fleet-managed Elastic Agent (recommended):
+
+With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.
+
+### Install Elastic Agent in standalone mode (advanced users):
+
+With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.
+
+### Install Elastic Agent in a containerized environment:
+
+You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.
+
+There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html#_minimum_requirements).
+
+## Setup
+
+### To collect data from the Abnormal Security Client API:
+
+#### Step 1: Go to Portal
+* Visit the [Abnormal Security Portal](https://portal.abnormalsecurity.com/home/settings/integrations) and click on the `Abnormal REST API` setting.
+
+#### Step 2: Generating the authentication token
+* Retrieve your authentication token. This token will be used further in the Elastic integration setup to authenticate and access different Abnormal Security Logs.
+
+#### Step 3: IP allowlisting
+* It ensures that API access is only possible from IP addresses (of Elastic Agent).
+
+### Enabling the integration in Elastic:
+
+1. In Kibana go to Management > Integrations.
+2. In "Search for integrations" search bar, type Abnormal Security.
+3. Click on the "Abnormal Security" integration from the search results.
+4. Click on the "Add Abnormal Security" button to add the integration.
+5. Add all the required integration configuration parameters, including Access Token, Interval, Initial Interval and Page Size to enable data collection.
+6. Click on "Save and continue" to save the integration.
+
+**Note**: By default, the URL is set to `https://api.abnormalplatform.com`. We have observed that Abnormal Security Base URL get change as per location so find your own base URL.
+
+## Logs reference
+
+### AI Security Mailbox
+
+This is the `ai_security_mailbox` dataset.
+
+#### Example
+
+{{event "ai_security_mailbox"}}
+
+{{fields "ai_security_mailbox"}}
+
+### Audit
+
+This is the `audit` dataset.
+
+#### Example
+
+{{event "audit"}}
+
+{{fields "audit"}}
+
+### Case
+
+This is the `case` dataset.
+
+#### Example
+
+{{event "case"}}
+
+{{fields "case"}}
+
+### Threat
+
+This is the `threat` dataset.
+
+#### Example
+
+{{event "threat"}}
+
+{{fields "threat"}}
@@ -0,0 +1,15 @@
+version: '2.3'
+services:
+  abnormal_security:
+    image: docker.elastic.co/observability/stream:v0.15.0
+    hostname: abnormal_security
+    ports:
+      - 8090
+    volumes:
+      - ./files:/files:ro
+    environment:
+      PORT: '8090'
+    command:
+      - http-server
+      - --addr=:8090
+      - --config=/files/config.yml
@@ -0,0 +1,183 @@
+rules:
+  - path: /v1/abusecampaigns
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 1
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"campaigns":[{"campaignId":"fff51768-c446-34e1-97a8-9802c29c3ebd"}],"pageNumber":1,"nextPageNumber":2}
+  - path: /v1/abusecampaigns
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 2
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"campaigns":[],"pageNumber":2,"nextPageNumber":3}
+  - path: /v1/abusecampaigns/fff51768-c446-34e1-97a8-9802c29c3ebd
+    methods: ['GET']
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"campaignId":"fff51768-c446-34e1-97a8-9802c29c3ebd","firstReported":"2020-11-11T13:11:40-08:00","lastReported":"2020-11-11T13:11:40-08:00","messageId":"-1234567891011121314","subject":"Fwd: This is spam","fromName":"Support","fromAddress":"support@secure-reply.org","recipientName":"Tom","recipientAddress":"example@example.com","judgementStatus":"Malicious","overallStatus":"Could not find original message","attackType":"Malicious: Phishing"}
+  - path: /v1/auditlogs
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 1
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"auditLogs":[{"action":"view_message_content","actionDetails":{"messageId":"-8674108407491446899","providedReason":"Reason","requestUrl":"/v2.1/messages/email_content/"},"category":"threat_log","sourceIp":"2a02:cf40::","status":"FAILURE","tenantName":"mock_tenant","timestamp":"2024-07-18 18:41:37.467000+00:00","user":{"email":"johan@example.com"}}],"pageNumber":1,"nextPageNumber":2}
+  - path: /v1/auditlogs
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 2
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"auditLogs":[],"pageNumber":2,"nextPageNumber":3}
+  - path: /v1/cases
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 1
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"cases":[{"caseId":"1234","severity":"Potential Account Takeover"}],"pageNumber":1,"nextPageNumber":2}
+  - path: /v1/cases
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 2
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"cases":[],"pageNumber":2,"nextPageNumber":3}
+  - path: /v1/cases/1234
+    methods: ['GET']
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"caseId":"1234","severity":"Unrecognized devices logging in","affectedEmployee":"Dav Hallet","firstObserved":"2024-06-19T14:55:05Z","description":"Multiple failed login attempts","analysis":"Profile Updated","customerVisibleTime":"2024-02-24T19:57:37Z","remediation_status":"Under Review","severity_level":"Low","case_status":"Assessment Needed","threatIds":["184712ab-6d8b-47b3-89d3-a314efef79e2","184712ab-6d8b-47b3-89d3-a314efef79ee","184712ab-6d8b-47b3-89d3-a314efef79ef"]}
+  - path: /v1/threats
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 1
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"threats":[{"threatId":"184712ab-6d8b-47b3-89d3-a314efef79e2"}],"pageNumber":1,"nextPageNumber":2}
+  - path: /v1/threats
+    methods: ['GET']
+    query_params:
+      filter: "{filter:.*}"
+      pageNumber: 2
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"threats":[],"pageNumber":2,"nextPageNumber":3}
+  - path: /v1/threats/184712ab-6d8b-47b3-89d3-a314efef79e2
+    methods: ['GET']
+    query_params:
+      pageNumber: 1
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"threatId":"184712ab-6d8b-47b3-89d3-a314efef79e2","messages":[{"threatId":"184712ab-6d8b-47b3-89d3-a314efef79e2","abxMessageId":4551618356913732000,"abxPortalUrl":"https://portal.abnormalsecurity.com/home/threat-center/remediation-history/4551618356913732076","subject":"Phishing Email","fromAddress":"support@secure-reply.org","fromName":"Support","senderDomain":"secure-reply.org","toAddresses":"example@example.com, another@example.com","recipientAddress":"example@example.com","receivedTime":"2020-06-09T17:42:59Z","sentTime":"2020-06-09T17:42:59Z","internetMessageId":"<5edfca1c.1c69fb81.4b055.8fd5@mx.google.com>","remediationStatus":"Auto Remediated","attackType":"Extortion","attackStrategy":"Name Impersonation","returnPath":"support@secure-reply.org","replyToEmails":["reply-to@example.com"],"ccEmails":["cc@example.com"],"senderIpAddress":"100.101.102.103","impersonatedParty":"None / Others","attackVector":"Text","attachmentNames":["attachment.pdf"],"attachmentCount":0,"urls":["https://www.google.com/"],"urlCount":0,"summaryInsights":["Bitcoin Topics","Personal Information Theft","Unusual Sender"],"remediationTimestamp":"2020-06-09T17:42:59Z","isRead":true,"attackedParty":"VIP","autoRemediated":true,"postRemediated":false}],"pageNumber":1,"nextPageNumber":2}
+  - path: /v1/threats/184712ab-6d8b-47b3-89d3-a314efef79e2
+    methods: ['GET']
+    query_params:
+      pageNumber: 2
+      pageSize: 1
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {"threatId":"184712ab-6d8b-47b3-89d3-a314efef79e2","messages":[],"pageNumber":2,"nextPageNumber":3}
@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.1.0"
+  changes:
+    - description: Initial release.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1
@@ -0,0 +1,5 @@
+{"campaignId":"01J3MT8VZGEK1QGJN6F6W92C31","firstReported":"2024-07-03T12:38:12Z","lastReported":"2024-07-01T03:16:47Z","messageId":"01J3MT8VZHVKSHDQK8P335G9ZC","subject":"Congratulations! You've been selected for a free vacation","fromName":"John","fromAddress":"alias@example.com","recipientName":"Alias","recipientAddress":"alias@example.com","judgementStatus":"unknown","overallStatus":"removed","attackType":"Malicious: Ransomware"}
+{"campaignId":"01J3MT8VZQBRN5A4FAWVJGJWR4","firstReported":"2024-07-15T15:07:13Z","lastReported":"2024-07-01T22:20:42Z","messageId":"01J3MT8VZRZJARZNMJW6TPH25A","subject":"","fromName":"Alias","fromAddress":"smith@example.com","recipientName":"Bob","recipientAddress":"bob@example.com","judgementStatus":"suspicious","overallStatus":"unavailable","attackType":"Harmful: Virus"}
+{"campaignId":"01J3MT8VZT678BPS160CRECBNQ","firstReported":"2024-07-02T10:04:28Z","lastReported":"2024-07-08T07:11:58Z","messageId":"01J3MT8VZV8Y5HYYYKHZE4E9WD","subject":"Important: Update your payment information","fromName":"John","fromAddress":"john@example.com","recipientName":"Alias","recipientAddress":"bob@example.com","judgementStatus":"safe","overallStatus":"deleted","attackType":"Malicious: Adware"}
+{"campaignId":"01J3MT8VZX2W7MFVXMNK9791QF","firstReported":"2024-07-05T23:35:57Z","lastReported":"2024-07-09T16:05:26Z","messageId":"01J3MT8VZYWJR7NKQVBKJJ627V","subject":"Urgent: Your account has been compromised","fromName":"Smith","fromAddress":"alias@example.com","recipientName":"Smith","recipientAddress":"alias@example.com","judgementStatus":"blocked","overallStatus":"gone","attackType":"Destructive: Worm"}
+{"campaignId":"01J3MT8W012JT003AF61K57M45","firstReported":"2024-07-08T19:51:09Z","lastReported":"2024-07-08T00:06:38Z","messageId":"01J3MT8W02XJ71G915KN4HSXA4","subject":"Claim your free iPhone now","fromName":"Smith","fromAddress":"alias@example.com","recipientName":"John","recipientAddress":"alias@example.com","judgementStatus":"unknown","overallStatus":"absent","attackType":"Destructive: Worm"}