> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Linking Abnormal Security as a source

Canonical URL: https://posthog.com/docs/data-pipelines/sources/abnormal-security

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://us.posthog.com` or `https://app.posthog.com` (app host for links).

## On this page

- [Adding a data source](#adding-a-data-source)
- [Available tables](#available-tables)
- [Regions](#regions)
- [Configuration](#configuration)
- [Supported tables](#supported-tables)

**Beta release**

This source is currently in **beta**. It works end to end, but you may still hit rough edges. [Let us know](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) if you do.

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d)

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

`npx @posthog/wizard warehouse`

![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)

![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you

Sync your Abnormal Security (Abnormal AI) threat campaigns, account takeover cases, and vendor cases into the PostHog data warehouse.

## Adding a data source

1.  Go to the [sources tab](https://app.posthog.com/data-management/sources) of the data pipeline section in PostHog.
2.  Click **\+ New source** and then click **Link** next to Abnormal Security (Abnormal AI).
3.  In Abnormal Security, go to **Settings → Integrations → Abnormal REST API** and create an API token. If your account restricts API access by IP, allow PostHog's outbound IP addresses.
4.  Back in PostHog, enter your **API token**, select your **Region** (US or EU), then click **Next**.
5.  Select the tables you want to sync, set the sync method and frequency, then click **Import**.

Once the syncs are complete, you can start using Abnormal Security data in PostHog.

## Available tables

| Table | Description | Sync method |
| --- | --- | --- |
| `threats` | Email threat campaigns with recipient counts and a sample of messages | Full refresh |
| `cases` | Account takeover cases | Incremental or full refresh |
| `vendor_cases` | Vendor cases with security insights and a timeline of events | Incremental or full refresh |

**Incremental** tables sync only new or updated records on each run. **Full refresh** tables reload all data on each sync.

The `threats` table contains one row per campaign, including recipient counts and up to 10 sample messages as returned by the API. Threats use full refresh because campaign details have no reliable timestamp for incremental syncing.

The `cases` and `vendor_cases` tables are **disabled by default**. Enable them from the table selection step during setup. Both tables require an **Account Takeover license** from Abnormal Security.

## Regions

Abnormal Security supports **US** and **EU** regions. Select your region when configuring the source. Dedicated account hosts are not supported.

## Configuration

| Option | Type | Required |
| --- | --- | --- |
| `API token` | password | Yes |
| `Region` | select | Yes |

## Supported tables

| Table | Description | Sync method | Incremental field | Primary key |
| --- | --- | --- | --- | --- |
| `threats` | Email threat campaigns detected by Abnormal, with recipient counts and a limited sample of messages. | Full refresh | — | — |
| `cases` | Account takeover cases detected by Abnormal. This table requires an Account Takeover license. | Incremental, Full refresh | last\_modified | — |
| `vendor_cases` | Vendor cases with security insights and a timeline of related events. | Incremental, Full refresh | lastModifiedTime | — |