Cybereason Authentication API
The Authentication API from Cybereason — 2 operation(s) for authentication.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cybereason-authentication-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Cybereason Authentication API
version: 23.x
description: 'Cybereason EDR/XDR REST API. Exposes Malop investigation, hunting
via Visual Search, sensor management, isolation rules, custom
detection rules, reputation lists, threat-intel lookups, malware
queries, and remediation actions against a Cybereason tenant.
Best-effort spec derived from publicly indexed Cybereason API
documentation references (api-doc.cybereason.com URI/endpoints
pages, docs.cybereason.com 23.2 docs, Cortex XSOAR / Demisto
Cybereason integration, and the open-source CybereasonAPI
PowerShell module). Cybereason''s primary API documentation is
customer/partner-gated; the operational surface modelled here
matches the publicly described endpoints.
Authentication is performed via a POST to /login.html which
returns a JSESSIONID cookie used on subsequent calls. JWT
authentication is also supported on version 20.1+ deployments.
'
contact:
name: Cybereason Nest
url: https://nest.cybereason.com/documentation/api-documentation
license:
name: Proprietary
servers:
- url: https://{tenant}.cybereason.net
description: Cybereason tenant
variables:
tenant:
default: example
description: Your Cybereason tenant hostname prefix.
security:
- SessionCookie: []
tags:
- name: Authentication
paths:
/login.html:
post:
tags:
- Authentication
summary: Log in and obtain a JSESSIONID cookie
security: []
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- username
- password
properties:
username:
type: string
password:
type: string
responses:
'200':
description: 'Login successful (Set-Cookie: JSESSIONID)'
headers:
Set-Cookie:
schema:
type: string
'302':
description: Redirect on successful login
'401':
description: Invalid credentials
/logout:
get:
tags:
- Authentication
summary: Log out the current session
responses:
'200':
description: Logged out
components:
securitySchemes:
SessionCookie:
type: apiKey
in: cookie
name: JSESSIONID
description: Session cookie returned by POST /login.html.
BearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: Available on Cybereason 20.1+ for token-based access.
externalDocs:
description: Cybereason API documentation
url: https://nest.cybereason.com/documentation/api-documentation