Abnormal Security Connector

Abnormal Security integrates with Bloo using the pull method via the Abnormal REST API. Once configured, Bloo collects, normalizes, and monitors Abnormal Security threat logs to help identify suspicious activity within your workspace in real time.

Before You Begin — Prerequisites

You'll need the following from your Abnormal Security account before configuring the connector in Bloo.

Requirement	Where to Get It	Notes
Abnormal Security Account	Sign in at portal.abnormalsecurity.com	Must have access to Settings > Integrations
Access Token	Generated from the Abnormal REST API card (Step 1 below)	Shown only once — copy and store it securely

ℹ For reference, see the Abnormal Security REST API documentation at abnormalsecurity.com.

Step 1 — Generate an Access Token in Abnormal Security

Follow these steps inside your Abnormal Security account to generate the access token Bloo needs.

1. Sign in to the Abnormal Security platform at

   https://portal.abnormalsecurity.com

1. Click Settings in the left menu under the Manage section, then click Integrations.

1. Scroll down to Additional Integrations and click + Connect on the Abnormal REST API card.

1. Copy and securely store the Access Token shown on the integration page. This is the token you will paste into Bloo.

⚠ Important: The Access Token is shown only once on this screen. Copy it now and store it securely — treat it like a password. You cannot retrieve it again after leaving this page.

1. In the IP Safelist field, enter the IP address of your Bloo Datasource. If you are unsure of this, contact Bloo support.
2. Click Save on the Abnormal Security integration page to confirm your IP Safelist entry.

Step 2 — Configure the Connector in Bloo

With the Access Token from Step 1, set up the connector on the Datasource page in Bloo.

1. In Bloo, navigate to the Datasource page and click Add Datasource.
2. Search for and select Abnormal Security.
3. Fill in the configuration fields as described below.

Field	Description	Example
Connector Name	A unique display name for this connector instance in Bloo.	AbnormalSec-Prod
API Key	Paste the Access Token generated in Step 1.	Paste from Step 1


1. Click Save. The connector proceeds directly to validation.

✓ Go to Collection Status in Bloo and verify the Abnormal Security connector shows status Active.

Related: How to Configure Connectors, Collection Status