Abnormal Security Integration

Send Abnormal Security Threat Logs to Realm

This guide walks you through connecting Abnormal Security to Realm. The integration uses a polling-based approach — Realm Cloud periodically queries the Abnormal Security API to retrieve threat and case data, then forwards it through your data pipeline to your configured destination.

WARNING: IP Allowlisting Required Before This Integration Will Work

Abnormal Security restricts API access by IP address. Realm's poller IPs must be added to your Abnormal Security allow list before any data can be collected. API calls from un-allowlisted IPs are silently rejected — the integration will appear to configure successfully in Realm but will return no data.

Do not proceed past this point until you have completed the IP Allowlisting section below. Contact Realm Support to obtain the current list of Realm Cloud IP addresses to allowlist.

Prerequisites

• An active Abnormal Security account with administrator access
• Access to the Realm Security console
• Realm IP addresses added to your Abnormal Security allow list — this is mandatory and must be completed before configuring the integration (see IP Allowlisting below)

IP Allowlisting

Abnormal Security's REST API enforces IP-based access control. Only requests originating from allowlisted IP addresses are permitted. Because Realm Cloud polls the Abnormal API on your behalf, Realm's egress IPs must be added to your allow list or all API requests will be blocked.

Step 1: Obtain the Realm Cloud IP addresses

Contact Realm Support and request the current list of Realm Cloud egress IP addresses. Provide your organization name and that you are setting up the Abnormal Security integration.

Step 2: Add the IPs to your Abnormal Security allow list

1. Log in to the Abnormal Security Portal.
2. Navigate to Settings > Integrations.
3. Select REST API from the list of available integrations.
4. Locate the IP Allowlist section on the REST API configuration page.
5. Enter each Realm Cloud IP address provided by Realm Support.
6. Save your changes.

Note: If you do not see an IP Allowlist field on the REST API page, contact Abnormal Security support to confirm whether IP restrictions are enforced for your account tier and how to configure them.

Once all Realm IPs are saved to the allow list, proceed to generate an API token below.

Generate an API Token in Abnormal Security

1. Log in to the Abnormal Security Portal.
2. Navigate to Settings > Integrations.
3. Select REST API from the list of available integrations.
4. Click Generate Token to create a new API token.

Important: Copy and save the API token immediately — you will not be able to view it again. You will need to enter this token in the Realm Security console.

5. Note the Base URL displayed on the integrations page — this is the URL of the Abnormal Security API (e.g., https://api.abnormalsecurity.com). You will need this when configuring the integration in Realm.

Note: For more details on the Abnormal Security API, refer to the Abnormal Security API documentation.

Configure the Integration in Realm

1. Create a new Source.

   Name: Abnormal Security
   Format: Abnormal Security

2. Add a new Input feed.

   Type: Abnormal Security
   API Token: <your Abnormal Security API token>
   Base URL: <your Abnormal Security API URL>
   Desired Resources: <the API resources to collect>

Once saved, the Realm poller will begin retrieving threat and case event data from the Abnormal Security API at regular intervals. The data is converted to JSON and forwarded through your data pipeline to your configured destination (e.g., SIEM).