Cybereason Malops API
The Malops API from Cybereason — 2 operation(s) for malops.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cybereason-malops-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Cybereason Authentication Malops API
version: 23.x
description: 'Cybereason EDR/XDR REST API. Exposes Malop investigation, hunting
via Visual Search, sensor management, isolation rules, custom
detection rules, reputation lists, threat-intel lookups, malware
queries, and remediation actions against a Cybereason tenant.
Best-effort spec derived from publicly indexed Cybereason API
documentation references (api-doc.cybereason.com URI/endpoints
pages, docs.cybereason.com 23.2 docs, Cortex XSOAR / Demisto
Cybereason integration, and the open-source CybereasonAPI
PowerShell module). Cybereason''s primary API documentation is
customer/partner-gated; the operational surface modelled here
matches the publicly described endpoints.
Authentication is performed via a POST to /login.html which
returns a JSESSIONID cookie used on subsequent calls. JWT
authentication is also supported on version 20.1+ deployments.
'
contact:
name: Cybereason Nest
url: https://nest.cybereason.com/documentation/api-documentation
license:
name: Proprietary
servers:
- url: https://{tenant}.cybereason.net
description: Cybereason tenant
variables:
tenant:
default: example
description: Your Cybereason tenant hostname prefix.
security:
- SessionCookie: []
tags:
- name: Malops
paths:
/rest/detection/inbox:
post:
tags:
- Malops
summary: Query the Malop inbox
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/MalopInboxRequest'
responses:
'200':
description: Malop inbox results
content:
application/json:
schema:
$ref: '#/components/schemas/MalopInboxResponse'
/rest/crimes/unified:
post:
tags:
- Malops
summary: Query unified Malops
requestBody:
required: true
content:
application/json:
schema:
type: object
responses:
'200':
description: Malop list
content:
application/json:
schema:
type: object
components:
schemas:
MalopInboxResponse:
type: object
properties:
data:
type: object
properties:
malops:
type: array
items:
type: object
properties:
guid:
type: string
displayName:
type: string
severity:
type: string
status:
type: string
creationTime:
type: integer
format: int64
lastUpdateTime:
type: integer
format: int64
MalopInboxRequest:
type: object
properties:
startTime:
type: integer
format: int64
endTime:
type: integer
format: int64
statusFilter:
type: array
items:
type: string
enum:
- Active
- ToReview
- Closed
- Reopened
- FalsePositive
- UnderInvestigation
securitySchemes:
SessionCookie:
type: apiKey
in: cookie
name: JSESSIONID
description: Session cookie returned by POST /login.html.
BearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: Available on Cybereason 20.1+ for token-based access.
externalDocs:
description: Cybereason API documentation
url: https://nest.cybereason.com/documentation/api-documentation