Abnormal AI

Abnormal AI Dashboard Aggregations API

APIs to manage Dashboard metrics

GitHub OpenAPI

Operations 15

GET /aggregations/attack_frequency Retrieve the frequency of specific attack types for a given period. #
GET /aggregations/attack_stopped Retrieve aggregated counts of distinct attack types that were successfully stopped, including current and previous periods. #
GET /aggregations/attack_strategy_breakdown Retrieve the breakdown of attacks based on their strategy. #
GET /aggregations/attack_vector_breakdown Retrieve the breakdown of attacks based on their vectors. #
GET /aggregations/attacker_origin Retrieve the origin countries of attackers for a given period. #
GET /aggregations/dashboard_summary Retrieve an aggregated summary of multiple security data points for the dashboard. #
GET /aggregations/most_impersonated_employee Retrieve the most impersonated employees for a specified period. #
GET /aggregations/most_impersonated_employee_non_vip Retrieve the most impersonated non-VIP employees for a specified period. #
GET /aggregations/most_impersonated_employee_vip Retrieve the most impersonated VIP employees for a specified period. #
GET /aggregations/most_impersonated_vendor Retrieve a list of the most impersonated vendors in attacks. #
GET /aggregations/recipient_employees Retrieve a list of the employees who were recipients of attacks, based on their job titles. #
GET /aggregations/recipient_employees_non_vip Retrieve a list of the non-VIP employees who were recipients of attacks, based on their job titles. #
GET /aggregations/recipient_employees_vip Retrieve a list of the VIP employees who were recipients of attacks, based on their job titles. #
GET /aggregations/sender_impersonation_breakdown Retrieve a breakdown of attacks based on sender impersonation. #

Documentation

📖
APIReference
https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/openapi/abnormal-dashboard-aggregations-api-openapi.yml

Other Resources

🔗
Swagger
https://api.swaggerhub.com/apis/abnormal-security/abx/1.4.3

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/abnormal-dashboard-aggregations-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

abnormal-dashboard-aggregations-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Abnormal Security Client Dashboard Aggregations API
  version: 1.4.3
  description: 'This is the specification for Abnormal Security Client API which can be used for managing security threats detected by Abnormal Security.

    <h2>Who is this API for?</h2>

    This API is for managing threats to an organization identified by Abnormal Security. The organization should be integrated with Abnormal Security and enabled for real-time detection of malicious emails.

    <h2> Integration Steps </h2>

    Go to `https://portal.abnormalsecurity.com/home/settings/integrations` & click on `Abnormal REST API`

    <h3> Step 1: Generating the authentication token </h3>


    Retrieve your authentication token via the <a href="https://portal.abnormalsecurity.com/home/settings/integrations">Abnormal portal</a>. You will use this token to view and modify your Abnormal-detected threats and cases.


    Keep the token safe, as it grants access to sensitive threat data related to your organization. Store it in a secure place, such as an encrypted password vault, and do not share it unless absolutely necessary. If you feel that the token has been compromised, please contact your Account Manager immediately.


    Once obtained, the token can be used in a request from any HTTP client, such as cURL:

    <pre> curl -H "Authorization: Bearer  << ACCESS_TOKEN >>" https://api.abnormalplatform.com/v1/threats </pre>


    <h3> Step 2: IP allowlisting </h3>


    IP allowlisting ensures that API access is only possible from IP addresses explicitly belonging to your organization. It prevents users from unauthorized networks to access your Abnormal SOAR data. This second layer of security helps keep your data safe from unauthorized users, and protects you in the event of a token compromise.


    To allowlist your organization''s IPs, please provide enter into the <a href="https://portal.abnormalsecurity.com/home/settings/integrations">Abnormal portal</a> specific IPv4 / IPv6 addresses, or a range of addresses using a <a href="https://www.ipaddressguide.com/cidr"> CIDR block</a>.


    <h3> Step 3: Try it out with Test Data </h3>


    To confirm that <b>Steps 1 & 2</b> have been configured properly, send a request to the server with the following header set:


    <pre> curl -H "Authorization: Bearer  << ACCESS_TOKEN >>" <b>-H "Mock-Data: True"</b> https://api.abnormalplatform.com/v1/threats </pre>


    The server should respond with a body payload similar to the examples specified in this documentation.


    <h3> Note for EU Customers </h3>


    If you''re a customer in the EU, you''ll need to make API requests to our EU host `https://eu.rest.abnormalsecurity.com`. If you''d like to test the API through SwaggerHub, you''ll find both the default host and the EU host in the Servers dropdown menu below.

    '
  termsOfService: https://legal.abnormalsecurity.com/legal-hub/abnormal-security-api-terms-of-service-6feee5e3
  contact:
    name: Abnormal Security Support
    email: support@abnormalsecurity.com
servers:
- url: https://api.abnormalplatform.com/v1
  description: Production Server for managing threats
- url: https://eu.rest.abnormalsecurity.com/v1
  description: EU Production Server for managing threats.
security:
- BearerAuth: []
tags:
- name: Dashboard Aggregations
  description: APIs to manage Dashboard metrics
paths:
  /aggregations/attack_frequency:
    get:
      operationId: v1_aggregations_attack_frequency_retrieve
      summary: Retrieve the frequency of specific attack types for a given period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_frequency` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attacks by frequency based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackFrequencyResponse'
          description: A summary of attack frequencies. Represents the count of specific attack types for each reported timestamp.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attack_stopped:
    get:
      operationId: v1_aggregations_attack_stopped_retrieve
      summary: Retrieve aggregated counts of distinct attack types that were successfully stopped, including current and previous periods.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_stopped` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attacks stopped based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackStoppedResponse'
          description: A summary of stopped attacks. Represents the count of attacks stopped for each attack type.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attack_strategy_breakdown:
    get:
      operationId: v1_aggregations_attack_strategy_breakdown_retrieve
      summary: Retrieve the breakdown of attacks based on their strategy.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_strategy_breakdown` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attack strategy breakdown based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackStrategyBreakdownResponse'
          description: A breakdown of attacks based on their strategy.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attack_vector_breakdown:
    get:
      operationId: v1_aggregations_attack_vector_breakdown_retrieve
      summary: Retrieve the breakdown of attacks based on their vectors.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attack_vector_breakdown` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attack vector breakdown based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackVectorBreakdownResponse'
          description: A breakdown of attacks based on their vectors.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attacker_origin:
    get:
      operationId: v1_aggregations_attacker_origin_retrieve
      summary: Retrieve the origin countries of attackers for a given period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/attacker_origin` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attacker origins based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackerOriginResponse'
          description: A summary of attacker origins based on geographical regions and countries.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/dashboard_summary:
    get:
      operationId: v1_aggregations_dashboard_summary_retrieve
      summary: Retrieve an aggregated summary of multiple security data points for the dashboard.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/dashboard_summary` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the dashboard summary based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/DashboardSummary'
          description: An aggregated list of security data points.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_employee:
    get:
      operationId: v1_aggregations_most_impersonated_employee_retrieve
      summary: Retrieve the most impersonated employees for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_employee` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters impersonated employees based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedEmployeeResponse'
          description: A list of the most impersonated employees and related statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_employee_non_vip:
    get:
      operationId: v1_aggregations_most_impersonated_employee_non_vip_retrieve
      summary: Retrieve the most impersonated non-VIP employees for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_employee_non_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters impersonated non-VIP employees based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedEmployeeNonVIPResponse'
          description: A list of the most impersonated non-VIP employees and related statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_employee_vip:
    get:
      operationId: v1_aggregations_most_impersonated_employee_vip_retrieve
      summary: Retrieve the most impersonated VIP employees for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_employee_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters impersonated VIP employees based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedEmployeeVIPResponse'
          description: A list of the most impersonated VIP employees and related statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_vendor:
    get:
      operationId: v1_aggregations_most_impersonated_vendor_retrieve
      summary: Retrieve a list of the most impersonated vendors in attacks.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/most_impersonated_vendor` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the most impersonated vendor data based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedVendorResponse'
          description: A list of the most impersonated vendors in attacks.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/recipient_employees:
    get:
      operationId: v1_aggregations_recipient_employees_retrieve
      summary: Retrieve a list of the employees who were recipients of attacks, based on their job titles.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/recipient_employees` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the recipient employees data based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecipientEmployeeResponse'
          description: A list of the employees who were recipients of attacks, based on their job titles.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/recipient_employees_non_vip:
    get:
      operationId: v1_aggregations_recipient_employees_non_vip_retrieve
      summary: Retrieve a list of the non-VIP employees who were recipients of attacks, based on their job titles.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/recipient_employees_non_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the recipient non-VIP employees data based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecipientEmployeeNonVIPResponse'
          description: A list of the non-VIP employees who were recipients of attacks, based on their job titles.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/recipient_employees_vip:
    get:
      operationId: v1_aggregations_recipient_employees_vip_retrieve
      summary: Retrieve a list of the VIP employees who were recipients of attacks, based on their job titles.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/recipient_employees_vip` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the recipient VIP employees data based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecipientEmployeeVIPResponse'
          description: A list of the VIP employees who were recipients of attacks, based on their job titles.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/sender_impersonation_breakdown:
    get:
      operationId: v1_aggregations_sender_impersonation_breakdown_retrieve
      summary: Retrieve a breakdown of attacks based on sender impersonation.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/sender_impersonation_breakdown` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters sender impersonation breakdown based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SenderImpersonationResponse'
          description: A breakdown of attacks based on sender impersonation.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/trending_attacks:
    get:
      operationId: v1_aggregations_trending_attacks_retrieve
      summary: Retrieve the list of trending attacks for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently the only keys that are supported for `/trending_attacks` are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters trending attacks based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrendingAttacksResponse'
          description: A list of trending attacks and related statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
components:
  schemas:
    AttackerOrigin:
      type: object
      properties:
        regionName:
          type: string
          description: The geographical region name.
          example: Asia
        attackCount:
          type: integer
          description: The count of attacks originating from the specified region.
          example: 1000
        countries:
          type: array
          items:
            $ref: '#/components/schemas/Country'
      required:
      - attackCount
      - countries
      - regionName
    SenderImpersonationResponse:
      type: object
      properties:
        sender_impersonation_breakdown:
          type: array
          items:
            $ref: '#/components/schemas/SenderImpersonationBreakdown'
          description: List detailing the breakdown of attacks by impersonated sender, along with the count for each impersonated sender type.
      required:
      - sender_impersonation_breakdown
    RecipientEmployeeResponse:
      type: object
      properties:
        recipient_employees:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployee'
          description: List detailing the recipient employees, their job titles, and the attack counts against them for the current and previous periods.
      required:
      - recipient_employees
    AttackVectorBreakdownResponse:
      type: object
      properties:
        attack_vector_breakdown:
          type: array
          items:
            $ref: '#/components/schemas/AttackVectorBreakdown'
          description: List detailing the breakdown of attacks by vector, along with the count for each vector.
      required:
      - attack_vector_breakdown
    RecipientEmployeeVIPResponse:
      type: object
      properties:
        recipient_employees_vip:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployeeVIP'
          description: List detailing the recipient VIP employees, their job titles, and the attack counts against them for the current and previous periods.
      required:
      - recipient_employees_vip
    MostImpersonatedEmployeeVIPResponse:
      type: object
      properties:
        most_impersonated_employee_vip:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedEmployeeVIP'
          description: List detailing the names of the most impersonated VIP employees, along with the current and previous attack count for each.
      required:
      - most_impersonated_employee_vip
    AttackVectorBreakdown:
      type: object
      properties:
        attackVector

# --- truncated at 32 KB (48 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/openapi/abnormal-dashboard-aggregations-api-openapi.yml