Malwarebytes Case Management API
The Case Management APIs are for managing Managed Detection and Response (MDR) and Managed Threat Hunting (MTH) cases.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Case Management API
version: 1.0.0
description: 'Operations tagged Case Management across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Case Management
description: The Case Management APIs are for managing Managed Detection and Response (MDR) and Managed Threat Hunting (MTH) cases.
paths:
/nebula/v1/casemgmt/cases/comments:
servers:
- url: https://api.threatdown.com
get:
description: Get cases comments
summary: Get cases comments
security:
- client_credentials:
- read
- user_permissions:
- mss.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: region
required: false
in: query
description: Region
schema:
type: string
enum:
- us
- emea
- secops
- name: caseId
required: false
in: query
description: ID of Case
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: array
title: Case comments response
examples:
- - comment: null
lastEditorId: null
lastEditorFullName: null
fileId: 1002
fileType: null
fileName: null
isDeleted: false
creatorUserId: Automation
creatorFullName: null
id: 1002
type: 4
caseId: 56
isFavorite: false
modificationTimeUnixTimeInMs: 1725537349316
creationTimeUnixTimeInMs: 1725537349316
alertIdentifier: f7099fbd-1e1e-54dc-a8fb-dddef362f715
items:
- type: object
properties:
comment:
type: string
title: comment
default: ''
lastEditorId:
type: string
title: lastEditorId
default: ''
lastEditorFullName:
type: string
title: lastEditorFullName
default: ''
fileId:
type: number
title: fileId
default: 0
fileType:
type: string
title: fileType
default: ''
fileName:
type: string
title: fileName
default: ''
isDeleted:
type: boolean
title: isDeleted
default: false
creatorUserId:
type: string
title: creatorUserId
default: ''
creatorFullName:
type: string
title: creatorFullName
default: ''
alertIdentifier:
type: string
title: alertIdentifier
default: ''
id:
type: number
title: id
default: 0
type:
type: number
title: type
default: 0
caseId:
type: number
title: caseId
default: 0
isFavorite:
type: boolean
title: isFavorite
default: false
modificationTimeUnixTimeInMs:
type: number
title: modificationTimeUnixTimeInMs
default: 0
creationTimeUnixTimeInMs:
type: number
title: creationTimeUnixTimeInMs
default: 0
tags:
- Case Management
operationId: api.nebula.casemgmt.cases.comments.get
post:
description: Post cases comments
summary: Post cases comments
security:
- client_credentials:
- write
- user_permissions:
- mss.manage
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: region
required: true
in: query
description: Region
schema:
type: string
enum:
- us
- emea
- secops
requestBody:
content:
application/json:
schema:
type: object
title: Post Case Comments
required:
- caseId
- alertIdentifier
properties:
caseId:
type: number
title: caseId
alertIdentifier:
type: string
title: alertIdentifier
base64Blob:
type: string
title: base64Blob
fileType:
type: string
title: fileType
fileName:
type: string
title: fileName
comment:
type: string
title: comment
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: object
title: Post cases comments response
examples:
- comment: null
lastEditorId: null
lastEditorFullName: null
fileId: 1013
fileType: null
fileName: null
isDeleted: false
creatorUserId: Automation
creatorFullName: null
id: 1013
type: 4
caseId: 71
isFavorite: false
modificationTimeUnixTimeInMs: 1725968640120
creationTimeUnixTimeInMs: 1725968640120
alertIdentifier: (DE) MALWARE.AI.40000000000_6940B0D9-7A3D-5132-BDBE-BFFD23100ED3
properties:
comment:
type: string
lastEditorId:
type: string
lastEditorFullName:
type: string
fileId:
type: integer
fileType:
type: string
fileName:
type: string
isDeleted:
type: boolean
creatorUserId:
type: string
creatorFullName:
type: string
id:
type: integer
type:
type: integer
caseId:
type: integer
isFavorite:
type: boolean
modificationTimeUnixTimeInMs:
type: integer
creationTimeUnixTimeInMs:
type: integer
alertIdentifier:
type: string
tags:
- Case Management
operationId: api.nebula.casemgmt.cases.comments.post
/nebula/v1/casemgmt/cases/file:
servers:
- url: https://api.threatdown.com
get:
description: Get cases file
summary: Get cases file
security:
- client_credentials:
- read
- user_permissions:
- mss.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: region
required: false
in: query
description: Region
schema:
type: string
enum:
- us
- emea
- secops
- name: caseId
required: false
in: query
description: ID of Case
schema:
type: string
- name: fileId
required: false
in: query
description: ID of File (Evidence ID)
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: string
title: Case file response
tags:
- Case Management
operationId: api.nebula.casemgmt.cases.file.get
/nebula/v1/casemgmt/cases/overview:
servers:
- url: https://api.threatdown.com
get:
description: Get cases overview
summary: Get cases overview
security:
- client_credentials:
- read
- user_permissions:
- mss.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: region
required: false
in: query
description: Region
schema:
type: string
enum:
- us
- emea
- secops
- name: caseId
required: false
in: query
description: ID of Case
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: object
title: Case overview response
examples:
- id: 56
creationTimeUnixTimeInMs: 1712752654954
modificationTimeUnixTimeInMs: 1725621115026
name: '(DE) Roh-Det : Trojan.MBAMTest'
priority: -1
isImportant: false
isIncident: false
startTimeUnixTimeInMs: 1712752702240
endTimeUnixTimeInMs: 1712752702240
assignedUser: a57505c2-5722-46e7-a48d-9be35eab21b3
description: null
isTestCase: false
type: 0
stage: Triage
environment: rFmzqNuFQ MSP - Rohin MDR 23c7cf8b-8336-43c2-82f5-853ec1e8c77f
status: 2
incidentId: null
tags: []
alertCards:
- id: 1147
creationTimeUnixTimeInMs: 1712752655013
modificationTimeUnixTimeInMs: 1712753155482
identifier: (DE) TROJAN.MBAMTEST_F7099FBD-1E1E-54DC-A8FB-DDDEF362F715
status: 1
name: (DE) TROJAN.MBAMTEST
priority: -1
workflowsStatus: 0
slaExpirationUnixTime: null
slaCriticalExpirationUnixTime: null
startTime: 1712752654479
endTime: 1712752654479
alertGroupIdentifier: '(DE) Roh-Det : Trojan.MBAMTestDm9dcjlFtCDNdnPLPIFOnsVICG0SSdpGUjBZv16LRLI=_d5f61ec2-c5a5-4a77-8ac1-2e945af34b90'
eventsCount: 1
title: (DE) TROJAN.MBAMTEST
ruleGenerator: '(DE) Roh-Det : Trojan.MBAMTest'
deviceProduct: Nebula
deviceVendor: Malwarebytes
playbookAttached: null
playbookRunCount: 0
isManualAlert: false
sla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
fieldsGroups: []
sourceUrl: null
sourceRuleUrl: null
siemAlertId: null
- id: 1150
creationTimeUnixTimeInMs: 1712752656390
modificationTimeUnixTimeInMs: 1712753155482
identifier: (DE) EXPLOIT_6CFD4680-B796-5867-AE89-5D458F9BD784
status: 1
name: (DE) EXPLOIT
priority: -1
workflowsStatus: 0
slaExpirationUnixTime: null
slaCriticalExpirationUnixTime: null
startTime: 1712752654792
endTime: 1712752654792
alertGroupIdentifier: '(DE) Roh-Det : exploit/dABfai6Wvrd8qF9KVQbUm4gtUoufyW+w0jydVP4XMk=_0d5510de-41b4-4f59-8af4-aeb7f0d6c8f6'
eventsCount: 1
title: (DE) EXPLOIT
ruleGenerator: '(DE) Roh-Det : exploit'
deviceProduct: Nebula
deviceVendor: Malwarebytes
playbookAttached: null
playbookRunCount: 0
isManualAlert: false
sla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
fieldsGroups: []
sourceUrl: null
sourceRuleUrl: null
siemAlertId: null
- id: 1151
creationTimeUnixTimeInMs: 1712752656785
modificationTimeUnixTimeInMs: 1712753155482
identifier: (DE) RANSOMWARE.SCRIPT_259CF705-6EC6-53C7-889A-150EDEA3F54C
status: 1
name: (DE) RANSOMWARE.SCRIPT
priority: -1
workflowsStatus: 0
slaExpirationUnixTime: null
slaCriticalExpirationUnixTime: null
startTime: 1712752654883
endTime: 1712752654883
alertGroupIdentifier: '(DE) Roh-Det : ransomware.scriptVF1KEvOwxSsd+oBQtb3ejxdVqFP1wPn0QkHKk9wqpbU=_0a660865-9c60-4bf9-8b7e-6d2c8a708542'
eventsCount: 1
title: (DE) RANSOMWARE.SCRIPT
ruleGenerator: '(DE) Roh-Det : ransomware.script'
deviceProduct: Nebula
deviceVendor: Malwarebytes
playbookAttached: null
playbookRunCount: 0
isManualAlert: false
sla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
fieldsGroups: []
sourceUrl: null
sourceRuleUrl: null
siemAlertId: null
- id: 1152
creationTimeUnixTimeInMs: 1712752702820
modificationTimeUnixTimeInMs: 1712753155482
identifier: (DE) TROJAN.MBAMTEST_08E0B2F2-DBE4-5A05-BDD0-4D2D6DB51843
status: 1
name: (DE) TROJAN.MBAMTEST
priority: -1
workflowsStatus: 0
slaExpirationUnixTime: null
slaCriticalExpirationUnixTime: null
startTime: 1712752702240
endTime: 1712752702240
alertGroupIdentifier: '(DE) Roh-Det : Trojan.MBAMTestOiDuUIAKA7iFZUhTraRGsycSGJwPpaJkuWH9HJRyoDs=_b031eded-9dc0-4434-94fc-aa37080074ca'
eventsCount: 1
title: (DE) TROJAN.MBAMTEST
ruleGenerator: '(DE) Roh-Det : Trojan.MBAMTest'
deviceProduct: Nebula
deviceVendor: Malwarebytes
playbookAttached: null
playbookRunCount: 0
isManualAlert: false
sla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
fieldsGroups: []
sourceUrl: null
sourceRuleUrl: null
siemAlertId: null
- id: 1148
creationTimeUnixTimeInMs: 1712752655618
modificationTimeUnixTimeInMs: 1712753155482
identifier: (DE) TROJAN.MBAMTEST_B51E80C8-B790-50E4-8CBF-0053A7E00D42
status: 1
name: (DE) TROJAN.MBAMTEST
priority: -1
workflowsStatus: 0
slaExpirationUnixTime: null
slaCriticalExpirationUnixTime: null
startTime: 1712752654559
endTime: 1712752654559
alertGroupIdentifier: '(DE) Roh-Det : Trojan.MBAMTestpcDwx3p0RzHE2VIDDcxpkQqOYQoP/FRZzQGEIcmShCU=_c883249d-320a-473e-b22a-319bfdb33b15'
eventsCount: 1
title: (DE) TROJAN.MBAMTEST
ruleGenerator: '(DE) Roh-Det : Trojan.MBAMTest'
deviceProduct: Nebula
deviceVendor: Malwarebytes
playbookAttached: null
playbookRunCount: 0
isManualAlert: false
sla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
fieldsGroups: []
sourceUrl: null
sourceRuleUrl: null
siemAlertId: null
- id: 1149
creationTimeUnixTimeInMs: 1712752656010
modificationTimeUnixTimeInMs: 1712753155482
identifier: (DE) TROJAN.MBAMTEST_6CD3644B-81A6-5318-91AA-7589EA8B6AA4
status: 1
name: (DE) TROJAN.MBAMTEST
priority: -1
workflowsStatus: 0
slaExpirationUnixTime: null
slaCriticalExpirationUnixTime: null
startTime: 1712752654674
endTime: 1712752654674
alertGroupIdentifier: '(DE) Roh-Det : Trojan.MBAMTestKQK/CII8WWRWIr6/TsaqUpVe9+9hMI1Ng0aWbRRbHKc=_569a6ac7-949f-4e6f-bd64-9d940e3dba85'
eventsCount: 1
title: (DE) TROJAN.MBAMTEST
ruleGenerator: '(DE) Roh-Det : Trojan.MBAMTest'
deviceProduct: Nebula
deviceVendor: Malwarebytes
playbookAttached: null
playbookRunCount: 0
isManualAlert: false
sla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
fieldsGroups: []
sourceUrl: null
sourceRuleUrl: null
siemAlertId: null
isOverflowCase: false
isManualCase: false
slaExpirationUnixTime: null
slaCriticalExpirationUnixTime: null
stageSlaExpirationUnixTimeInMs: null
stageSlaCriticalExpirationUnixTimeInMs: null
canOpenIncident: false
sla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
stageSla:
slaExpirationTime: null
criticalExpirationTime: null
expirationStatus: 2
remainingTimeSinceLastPause: null
relatedAlertTicketId: null
properties:
id:
type: integer
creationTimeUnixTimeInMs:
type: integer
modificationTimeUnixTimeInMs:
type: integer
name:
type: string
priority:
type: integer
isImportant:
type: boolean
isIncident:
type: boolean
startTimeUnixTimeInMs:
type: integer
endTimeUnixTimeInMs:
type: integer
assignedUser:
type: string
description:
type: string
isTestCase:
type: boolean
type:
type: integer
stage:
type: string
environment:
type: string
status:
type: integer
incidentId:
type: integer
tags:
type: array
items:
- type: string
alertCards:
type: array
items:
- type: object
properties:
id:
type: integer
creationTimeUnixTimeInMs:
type: integer
modificationTimeUnixTimeInMs:
type: integer
identifier:
type: string
status:
type: integer
name:
type: string
priority:
type: integer
workflowsStatus:
type: integer
slaExpirationUnixTime:
type: integer
slaCriticalExpirationUnixTime:
type: integer
startTime:
type: integer
endTime:
type: integer
alertGroupIdentifier:
type: string
eventsCount:
type: integer
title:
type: string
ruleGenerator:
type: string
deviceProduct:
type: string
deviceVendor:
type: string
playbookAttached:
type: string
playbookRunCount:
type: integer
isManualAlert:
type: boolean
sla:
type: object
fieldsGroups:
type: array
items:
- type: object
properties:
order:
type: integer
groupName:
type: string
isIntegration:
type: boolean
isHighlight:
type: boolean
items:
type: array
items:
- type: object
sourceUrl:
type: string
sourceRuleUrl:
type: string
siemAlertId:
type: string
isOverflowCase:
type: boolean
isManualCase:
type: boolean
slaExpirationUnixTime:
type: integer
slaCriticalExpirationUnixTime:
type: integer
stageSlaExpirationUnixTimeInMs:
type: integer
stageSlaCriticalExpirationUnixTimeInMs:
type: integer
canOpenIncident:
type: boolean
sla:
type: object
stageSla:
type: object
relatedAlertTicketId:
type: string
tags:
- Case Management
operationId: api.nebula.casemgmt.cases.overview.get
/nebula/v1/casemgmt/cases/wall:
servers:
- url: https://api.threatdown.com
get:
description: Get cases wall
summary: Get cases wall
security:
- client_credentials:
- read
- user_permissions:
- mss.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: region
required: false
in: query
description: Region
schema:
type: string
enum:
- us
- emea
- secops
- name: caseId
required: false
in: query
description: ID of Case
schema:
type: string
responses:
'200':
description: Successful response
tags:
- Case Management
operationId: api.nebula.casemgmt.cases.wall.get
/nebula/v1/casemgmt/multiplexer/cases:
servers:
- url: https://api.threatdown.com
get:
description: Get multiplexer cases
summary: Get multiplexer cases
security:
- client_credentials:
- read
- user_permissions:
- mss.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: timeFilter
required: false
in: query
description: time filter
schema:
type: string
enum:
- custom
- last_day
- last_2_days
- last_3_days
- last_week
- last_2_weeks
- last_month
- last_3_months
- last_6_months
- last_year
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: object
title: Multiplexer cases response
examples:
- secops:
results:
- id: 2456
title: '(DE) Chronicle_DEMO : Trojan.MBAMTest'
time: '2024-08-19T10:00:23.544Z'
closingTime: null
tags:
- WEB DETECTION
- TROJAN
- SUSPICIOUS
products:
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
- Nebula
alertNames: []
ticketIds:
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||fec957fb-8404-57e2-bfc7-98382f9adc99
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||11b8f173-a966-5f40-9be3-98fb142a0bfd
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||77035722-2187-5219-ad26-5774768ac69c
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||d6c9defd-769f-5c3b-a9d9-d5cc2c2def3b
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||c679f20f-2d8d-54b5-95c1-be6d5c333984
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||2eacbaa8-f975-50fc-bac0-4193a560e46a
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||3568072
- 23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||3568074
eventNames: []
sources: []
destinations: []
artificats: []
ports: []
outcomes:
- deleted
- found
- restored
- detected
userAssigned: '@Analyst'
isImportant: false
isIncident: false
involvedSuspiciousEntity: false
isCaseClosed: false
en
# --- truncated at 32 KB (215 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-case-management-api-openapi.yml