Configure Abnormal Cloud Email Security for Arctic Wolf monitoring

You can configure Abnormal Cloud Email Security® to send the necessary logs to Arctic Wolf® for security monitoring.

以下のリソースが必要です。

  • Administrator access to the Abnormal Portal
  • (Optional) アカウント乗っ取り（ATO） Protection license, to receive ATO alerts

Create API token

  1. Sign in to the Abnormal Portal.
  2. Click Settings > Integrations.
  3. In the API Token Management section, click + Create New Token.
  4. For the integration type, select REST API, and then click Next.
  5. For the token scope, select Tenant (Single Tenant), set the tenant name to your organization, and then click Next.
  6. For token access, select these options:

    • Access type — Custom Access

    • API endpoints — Threats — Read Access, Cases — Read Access, and Audit Logs — Read Sensitive Access

  7. Set the token name.

    For example, Arctic Wolf monitoring token or Arctic Wolf AR token, as appropriate.

  8. For the token expiration period, select the value that meets your organizational security requirements.
  9. In the IP Safelist field, add the Arctic Wolf Cloud Sensors IP address ranges.
  10. Click Create Token.
  11. Copy the token value to a safe, encrypted location to provide to Arctic Wolf later.
  12. Click Done.

Provide Abnormal Security credentials to Arctic Wolf

  1. Arctic Wolf Unified Portal にサインインします。
  2. ナビゲーションメニューで、［データ収集］ > ［クラウドセンサ］をクリックします。
  3. Click Add Account +.
  4. On the Add Account page, click Abnormal Security.
  5. Configure these settings:

    • Account Name — Enter a unique and descriptive name for the account.

    • Access Token — Enter the API token value from Create API token.
    • Host — Select the appropriate option for your region:

      • US — api.abnormalplatform.com

      • EU — eu.rest.abnormalsecurity.com

    • Credential Expiry — Enter the credential expiration date, if applicable.

  6. Click Test and submit credentials.