abnormal-security-cases

# Abnormal Security Abuse Mailbox Cases ## Overview Abnormal Security's Abuse Mailbox automatically processes user-reported suspicious emails. When users forward or report emails to a designated abuse mailbox address, Abnormal analyzes the reported message and creates a case with an AI-generated judgment. This skill covers case lifecycle, triage workflows, remediation actions, and bulk operations. ## Anti-triggers - **A compromised mailbox rather than a reported email** — sign-in anomalies, new inbox rules, and session revocation have no surface on this server at all; investigate identity in the M365 tenant, use `cipp-users`. - **Threats Abnormal found on its own** — no user reported them, so no case exists; use `Abnormal Security Threats`. - **User-reported phishing in a different platform** — IRONSCALES runs its own report-to-incident loop from its Outlook and Gmail add-ins, with separate IDs and its own classification verbs; use `IRONSCALES Incidents`. - **A user who reported a simulated phish** — campaign reporting rates belong to the training platform; use `KnowBe4 Phishing`. ## Case Lifecycle ``` User Reports Email | v Case Created (status: Open) | v AI Analysis (judgment generated) | +---> Malicious ---> Auto-Remediate (if configured) | +---> Suspicious ---> Analyst Review Required | +---> Spam ---> Auto-Dismiss (if configured) | +---> Safe -...