When talking about the Data Structure of AbuseHQ, we refer to the data that can be influenced by you and will, in turn, influence your setup and capabilities down the line. Don’t worry—most things can be adjusted later. Nevertheless, it’s worth taking a moment upfront to plan.
AbuseHQ has four hierarchy layers:
These layers relate to one another in a structured hierarchy, as shown in the graphic (not included here).
When an abuse report comes in—such as an ARF feedback loop or a bulk report from Shadowserver—it can lead to one or many Events. AbuseHQ automatically splits these up correctly, so you always have a clear and consistent view of what’s happening.
A Case is a container for related Events. Whether a new Case is created or an Event is attached to an existing Case is determined by:
AbuseHQ Agents and Automation primarily operate on the Case level in daily workflows.
The Contract layer is optional and flexible. You may use it in some situations and skip it in others.
While the term “Contract” is used for naming consistency, this layer could also represent:
💬 Not sure if you should use this layer? Reach out via chat or email [email protected] for real-world examples from other customers.
At the top of the hierarchy is the Subscriber. You might call them customers or clients—AbuseHQ calls them Subscribers.
Subscriber information is required.
Without it, no Cases will be created, and incoming emails will be discarded into the mailbox.
One of the most essential parts of AbuseHQ is the Subscriber Resolver. This component ensures that:
If an Event can’t be resolved, it won’t trigger a Case or attach to one.
Why is this important? Because AbuseHQ’s goal is to help solve your customers’ problems, and without knowing who the Subscriber is, that’s impossible.
📌 Example: As a Cable Provider, you may only know that an IP address sent spam at a given time. The Subscriber Resolver maps that IP and timestamp to the correct Subscriber ID.
Being able to resolve Events into Cases and assign them to the right Subscriber and Contract is powerful. But sometimes you need additional data to influence your workflows.
For example:
You can enrich this data via API.
This information can be provided using the API Subscriber Resolver or the X-Header Resolver.
When talking about the Data Structure of AbuseHQ, we refer to the data that can be influenced by you and will, in turn, influence your setup and capabilities down the line. Don’t worry—most things can be adjusted later. Nevertheless, it’s worth taking a moment upfront to plan.
AbuseHQ has four hierarchy layers:
These layers relate to one another in a structured hierarchy, as shown in the graphic (not included here).
When an abuse report comes in—such as an ARF feedback loop or a bulk report from Shadowserver—it can lead to one or many Events. AbuseHQ automatically splits these up correctly, so you always have a clear and consistent view of what’s happening.
A Case is a container for related Events. Whether a new Case is created or an Event is attached to an existing Case is determined by:
AbuseHQ Agents and Automation primarily operate on the Case level in daily workflows.
The Contract layer is optional and flexible. You may use it in some situations and skip it in others.
While the term “Contract” is used for naming consistency, this layer could also represent:
💬 Not sure if you should use this layer? Reach out via chat or email [email protected] for real-world examples from other customers.
At the top of the hierarchy is the Subscriber. You might call them customers or clients—AbuseHQ calls them Subscribers.
Subscriber information is required.
Without it, no Cases will be created, and incoming emails will be discarded into the mailbox.
One of the most essential parts of AbuseHQ is the Subscriber Resolver. This component ensures that:
If an Event can’t be resolved, it won’t trigger a Case or attach to one.
Why is this important? Because AbuseHQ’s goal is to help solve your customers’ problems, and without knowing who the Subscriber is, that’s impossible.
📌 Example: As a Cable Provider, you may only know that an IP address sent spam at a given time. The Subscriber Resolver maps that IP and timestamp to the correct Subscriber ID.
Being able to resolve Events into Cases and assign them to the right Subscriber and Contract is powerful. But sometimes you need additional data to influence your workflows.
For example:
You can enrich this data via API.
This information can be provided using the API Subscriber Resolver or the X-Header Resolver.