Connect Abnormal Security to Conduit

This walkthrough connects Abnormal Security (email security) to Conduit. You generate an API token in the Abnormal portal, then add it as an organization connection in Conduit. Once connected, any MCP client your organization uses can call Abnormal Security tools through Conduit’s gateway.

Menu labels can change

The Abnormal Security steps below reflect the portal flow at time of writing; menu labels can shift between releases. If a label differs, see this Abnormal Security API setup guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• An Abnormal Security portal login with access to Settings > Integrations > API.

Step 1 — Create an API token in Abnormal Security

1. Sign in to the Abnormal Security portal. Expected: the Abnormal dashboard.
2. Generate an API token under Settings > Integrations > API (see this setup guide for a walkthrough of the token flow). Expected: a token value you can copy.
3. Copy the token.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, regenerate it in the Abnormal portal first; the exposed token becomes useless immediately.

Step 2 — Connect Abnormal Security in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Abnormal Security in the catalog (under Security) and click Connect. Expected: a credential form with a single API Token field.
3. Paste the Abnormal Security API token from Step 1 into the API Token field.
4. Click Connect. Expected: Conduit validates the token against the Abnormal Security API immediately and shows a green Connected status. A bad token is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Abnormal Security connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Abnormal Security tool, such as listing recent threats. You should get real data back, and the call appears in your audit log with the correct user, vendor (abnormal-security), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Abnormal Security API token. Generate one in the Abnormal portal under Settings > Integrations > API.”	The token is wrong, expired, revoked, or was copied incompletely. Generate a fresh token at Settings > Integrations > API and re-connect.
Connect fails with “Abnormal Security returned HTTP <status>.”	Abnormal answered with a non-auth error — usually a transient vendor-side issue. Wait and retry; if it persists, check Abnormal’s status.
Tool calls return 403 “no credentials for vendor”	Abnormal Security isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a token.
Vendor health shows yellow/degraded	Conduit’s health check sees Abnormal responding slowly. Usually a transient vendor-side load spike — recovers automatically.
Need to rotate the token	Generate a new token in the Abnormal portal under Settings > Integrations > API, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.