abnormal-security-messages

# Abnormal Security Message Analysis ## Overview Abnormal Security provides deep message analysis capabilities beyond basic threat detection. This skill covers message retrieval, header inspection, attachment analysis, sender authentication results, and delivery context. Use it when performing forensic analysis of specific emails or investigating delivery patterns. ## Anti-triggers - **Where a message went, or why it never arrived** — Abnormal sees messages only as evidence attached to a detected threat. It has no delivery pipeline, no queue, and no bounce record, so "trace this email" questions belong to the gateway: use `Mimecast Message Tracking`. - **Removing the message from inboxes, or putting it back** — that is the remediation surface; use `Abnormal Security Threats`. - **Inspecting a message a gateway is holding** — everything Abnormal can show was already delivered. Pre-delivery holds are `SpamTitan Quarantine` or `Proofpoint Quarantine`. ## Message Field Reference These are **response** fields describing what Abnormal reports about a message. They are not tool parameters — the only parameters the message tools accept are `threatId` and `messageId`. Availability varies by message and by tenant configuration; treat any single field as best-effort. ### Core Message Fields | Field | Type | Description | |-------|------|-------------| | `abxMessageId` | string | Abnormal's identifier for the message, as returned in the `abnormal_messages_list` resp...