Malwarebytes Device Control API

openapi: 3.2.0
info:
  title: Malwarebytes Device Control API
  version: 1.0.0
  description: 'Operations tagged Device Control across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Device Control
  description: 'The Device Control feature manages access to USB storage drives. Activity is logged every time a USB device is blocked or restricted to read-only.


    Use the Device Control APIs to export device control activity, obtain information about a specific device control event, search for device control events, and view device control activity grouped by a selected parameter.


    If your endpoints are running Endpoint Agent version 2.0.0.81 or newer, you can utilize the APIs that manage the Allowlist, or exclusions, for Device Control. The Allowlist provides the ability to override policy controls and prevent certain USB devices from being blocked by Device Control.'
paths:
  /nebula/v1/devicecontrol/exclusions:
    servers:
    - url: https://api.threatdown.com
    post:
      description: Create a device exclusion.
      summary: Create a device exclusion
      security:
      - client_credentials:
        - write
      - user_permissions:
        - deviceControl.createAllowlistRule
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: Create Device Exclusion
              additionalProperties: true
              required:
              - enabled
              - exclude_from
              - account_level
              properties:
                vendor:
                  type: string
                  title: Device Vendor
                product:
                  type: string
                  title: Product
                serial:
                  type: string
                  title: Device Serial Number
                value:
                  type: string
                  title: String value
                  examples:
                  - '%PROGRAMDATA%'
                enabled:
                  type: boolean
                  title: Enable
                comment:
                  type: string
                  title: Comment
                exclude_from:
                  type: object
                  title: Exclusion applied to
                  properties:
                    exploit_protection:
                      type:
                      - boolean
                      - 'null'
                      title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
                    malware_protection:
                      type:
                      - boolean
                      - 'null'
                      title: Protects against malware infections and zero-day threats
                    ransomware_protection:
                      type:
                      - boolean
                      - 'null'
                      title: Detects and blocks ransomware threats using advanced behavior analysis
                    suspicious_activity:
                      type:
                      - boolean
                      - 'null'
                      title: Uses advanced machine learning to identify suspicious processes that require additional review
                    website_protection:
                      type:
                      - boolean
                      - 'null'
                      title: Blocks network traffic from malicious websites and IP addresses
                    bruteforce_protection:
                      type:
                      - boolean
                      - 'null'
                      title: Bruteforce attack protection on RDP, IMAP and so on.
                account_level:
                  type: boolean
                  title: Account level
                policy_ids:
                  type: array
                  title: IDs of Policies
                  items:
                    type: string
                    title: ID of the Policy
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Device Exclusion response schema
                type: object
                additionalProperties: true
                allOf:
                - type: object
                  title: Create Device Exclusion
                  additionalProperties: true
                  required:
                  - enabled
                  - exclude_from
                  - account_level
                  properties:
                    vendor:
                      type: string
                      title: Device Vendor
                    product:
                      type: string
                      title: Product
                    serial:
                      type: string
                      title: Device Serial Number
                    value:
                      type: string
                      title: String value
                      examples:
                      - '%PROGRAMDATA%'
                    enabled:
                      type: boolean
                      title: Enable
                    comment:
                      type: string
                      title: Comment
                    exclude_from:
                      type: object
                      title: Exclusion applied to
                      properties:
                        exploit_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
                        malware_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Protects against malware infections and zero-day threats
                        ransomware_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Detects and blocks ransomware threats using advanced behavior analysis
                        suspicious_activity:
                          type:
                          - boolean
                          - 'null'
                          title: Uses advanced machine learning to identify suspicious processes that require additional review
                        website_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Blocks network traffic from malicious websites and IP addresses
                        bruteforce_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Bruteforce attack protection on RDP, IMAP and so on.
                    account_level:
                      type: boolean
                      title: Account level
                    policy_ids:
                      type: array
                      title: IDs of Policies
                      items:
                        type: string
                        title: ID of the Policy
                properties:
                  id:
                    type: string
                    title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
                    pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                    examples:
                    - 9256034b-7967-4253-a5d9-260663e4fa4f
                  type:
                    type: integer
                    title: '16: Device Control Exclusion'
                    const: 16
                  created_at:
                    type: string
                    title: Created at
                  updated_at:
                    type: string
                    title: Updated at
                  created_by:
                    type: string
                    title: Created by
                  updated_by:
                    type: string
                    title: Updated by
      tags:
      - Device Control
      operationId: api.nebula.post.device.exclusions
    get:
      description: Get all device exclusions.
      summary: Get all device exclusions
      security:
      - client_credentials:
        - read
      - user_permissions:
        - deviceControl.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      - name: next_cursor
        required: false
        in: query
        description: The pagination cursor for next set of results. For further documentation, check Pagination section.
        schema:
          type: string
      - name: search_string
        required: false
        in: query
        description: Search with exclusion string.
        schema:
          type: string
      - name: policy_ids
        required: false
        in: query
        description: Search with exclusion policy ids.
        schema:
          type: string
      - name: type
        required: false
        in: query
        description: Search with exclusion type
        schema:
          type: number
      - name: since
        required: false
        in: query
        description: Timestamp to filter since exclusion times.
        schema:
          type: string
      - name: until
        required: false
        in: query
        description: Timestamp to filter until exclusion times.
        schema:
          type: string
      - name: sort_by
        required: false
        in: query
        description: Field to sort results with.
        schema:
          type: string
          enum:
          - enabled
          - value
          - created_at
          - updated_at
          - created_by
          - updated_by
          - type
      - name: sort_order
        required: false
        in: query
        description: Sorting direction
        schema:
          type: string
          enum:
          - asc
          - desc
      - name: populate_risk
        required: false
        in: query
        description: Populate risk fields on exclusions
        schema:
          type: boolean
      - name: risk
        required: false
        in: query
        description: Filter exclusions by risk level (validated by Retina)
        schema:
          type: string
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Device exclusion response schema
                type: object
                additionalProperties: true
                properties:
                  exclusions:
                    type: array
                    title: Exclusions
                    items:
                      title: Device Exclusion response schema
                      type: object
                      additionalProperties: true
                      allOf:
                      - type: object
                        title: Create Device Exclusion
                        additionalProperties: true
                        required:
                        - enabled
                        - exclude_from
                        - account_level
                        properties:
                          vendor:
                            type: string
                            title: Device Vendor
                          product:
                            type: string
                            title: Product
                          serial:
                            type: string
                            title: Device Serial Number
                          value:
                            type: string
                            title: String value
                            examples:
                            - '%PROGRAMDATA%'
                          enabled:
                            type: boolean
                            title: Enable
                          comment:
                            type: string
                            title: Comment
                          exclude_from:
                            type: object
                            title: Exclusion applied to
                            properties:
                              exploit_protection:
                                type:
                                - boolean
                                - 'null'
                                title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
                              malware_protection:
                                type:
                                - boolean
                                - 'null'
                                title: Protects against malware infections and zero-day threats
                              ransomware_protection:
                                type:
                                - boolean
                                - 'null'
                                title: Detects and blocks ransomware threats using advanced behavior analysis
                              suspicious_activity:
                                type:
                                - boolean
                                - 'null'
                                title: Uses advanced machine learning to identify suspicious processes that require additional review
                              website_protection:
                                type:
                                - boolean
                                - 'null'
                                title: Blocks network traffic from malicious websites and IP addresses
                              bruteforce_protection:
                                type:
                                - boolean
                                - 'null'
                                title: Bruteforce attack protection on RDP, IMAP and so on.
                          account_level:
                            type: boolean
                            title: Account level
                          policy_ids:
                            type: array
                            title: IDs of Policies
                            items:
                              type: string
                              title: ID of the Policy
                      properties:
                        id:
                          type: string
                          title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
                          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                          examples:
                          - 9256034b-7967-4253-a5d9-260663e4fa4f
                        type:
                          type: integer
                          title: '16: Device Control Exclusion'
                          const: 16
                        created_at:
                          type: string
                          title: Created at
                        updated_at:
                          type: string
                          title: Updated at
                        created_by:
                          type: string
                          title: Created by
                        updated_by:
                          type: string
                          title: Updated by
                  total_count:
                    type: integer
                    title: Total Count
                    description: Total count of results.
                  next_cursor:
                    type: string
                    title: The pagination cursor for next set of results. For further documentation, check Pagination section.
                    examples:
                    - eyJzdGFydF9pbmRleCI6MTAwfQ==
      tags:
      - Device Control
      operationId: api.nebula.get.device.exclusions
  /nebula/v1/devicecontrol/exclusions/bulk:
    servers:
    - url: https://api.threatdown.com
    post:
      description: Create device exclusions in bulk.
      summary: Create device exclusions in bulk
      security:
      - client_credentials:
        - write
      - user_permissions:
        - deviceControl.createAllowlistRule
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type: array
              title: Create Device Exclusion Bulk
              items:
                allOf:
                - type: object
                  title: Create Device Exclusion
                  additionalProperties: true
                  required:
                  - enabled
                  - exclude_from
                  - account_level
                  properties:
                    vendor:
                      type: string
                      title: Device Vendor
                    product:
                      type: string
                      title: Product
                    serial:
                      type: string
                      title: Device Serial Number
                    value:
                      type: string
                      title: String value
                      examples:
                      - '%PROGRAMDATA%'
                    enabled:
                      type: boolean
                      title: Enable
                    comment:
                      type: string
                      title: Comment
                    exclude_from:
                      type: object
                      title: Exclusion applied to
                      properties:
                        exploit_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
                        malware_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Protects against malware infections and zero-day threats
                        ransomware_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Detects and blocks ransomware threats using advanced behavior analysis
                        suspicious_activity:
                          type:
                          - boolean
                          - 'null'
                          title: Uses advanced machine learning to identify suspicious processes that require additional review
                        website_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Blocks network traffic from malicious websites and IP addresses
                        bruteforce_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Bruteforce attack protection on RDP, IMAP and so on.
                    account_level:
                      type: boolean
                      title: Account level
                    policy_ids:
                      type: array
                      title: IDs of Policies
                      items:
                        type: string
                        title: ID of the Policy
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Device Exclusion response schema bulk
                type: object
                additionalProperties: true
                properties:
                  errors:
                    type: array
                    title: List of Errors
                    items:
                      type: string
                  created:
                    type: array
                    title: Created Exclusions
                    items:
                      allOf:
                      - title: Device Exclusion response schema
                        type: object
                        additionalProperties: true
                        allOf:
                        - type: object
                          title: Create Device Exclusion
                          additionalProperties: true
                          required:
                          - enabled
                          - exclude_from
                          - account_level
                          properties:
                            vendor:
                              type: string
                              title: Device Vendor
                            product:
                              type: string
                              title: Product
                            serial:
                              type: string
                              title: Device Serial Number
                            value:
                              type: string
                              title: String value
                              examples:
                              - '%PROGRAMDATA%'
                            enabled:
                              type: boolean
                              title: Enable
                            comment:
                              type: string
                              title: Comment
                            exclude_from:
                              type: object
                              title: Exclusion applied to
                              properties:
                                exploit_protection:
                                  type:
                                  - boolean
                                  - 'null'
                                  title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
                                malware_protection:
                                  type:
                                  - boolean
                                  - 'null'
                                  title: Protects against malware infections and zero-day threats
                                ransomware_protection:
                                  type:
                                  - boolean
                                  - 'null'
                                  title: Detects and blocks ransomware threats using advanced behavior analysis
                                suspicious_activity:
                                  type:
                                  - boolean
                                  - 'null'
                                  title: Uses advanced machine learning to identify suspicious processes that require additional review
                                website_protection:
                                  type:
                                  - boolean
                                  - 'null'
                                  title: Blocks network traffic from malicious websites and IP addresses
                                bruteforce_protection:
                                  type:
                                  - boolean
                                  - 'null'
                                  title: Bruteforce attack protection on RDP, IMAP and so on.
                            account_level:
                              type: boolean
                              title: Account level
                            policy_ids:
                              type: array
                              title: IDs of Policies
                              items:
                                type: string
                                title: ID of the Policy
                        properties:
                          id:
                            type: string
                            title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
                            pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                            examples:
                            - 9256034b-7967-4253-a5d9-260663e4fa4f
                          type:
                            type: integer
                            title: '16: Device Control Exclusion'
                            const: 16
                          created_at:
                            type: string
                            title: Created at
                          updated_at:
                            type: string
                            title: Updated at
                          created_by:
                            type: string
                            title: Created by
                          updated_by:
                            type: string
                            title: Updated by
      tags:
      - Device Control
      operationId: api.nebula.post.device.exclusions.bulk
  /nebula/v1/devicecontrol/exclusions/{id}:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: Delete a device exclusion.
      summary: Delete a device exclusion
      security:
      - client_credentials:
        - write
      - user_permissions:
        - deviceControl.deleteAllowlistRule
      status:
        outage:
        - auth
      parameters:
      - name: id
        required: true
        in: path
        description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: Successful response
      tags:
      - Device Control
      operationId: api.nebula.delete.device.exclusions
    get:
      description: Get a device exclusion.
      summary: Get a device exclusion
      security:
      - client_credentials:
        - read
      - user_permissions:
        - deviceControl.view
      status:
        outage:
        - auth
      parameters:
      - name: id
        required: true
        in: path
        description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Device Exclusion response schema
                type: object
                additionalProperties: true
                allOf:
                - type: object
                  title: Create Device Exclusion
                  additionalProperties: true
                  required:
                  - enabled
                  - exclude_from
                  - account_level
                  properties:
                    vendor:
                      type: string
                      title: Device Vendor
                    product:
                      type: string
                      title: Product
                    serial:
                      type: string
                      title: Device Serial Number
                    value:
                      type: string
                      title: String value
                      examples:
                      - '%PROGRAMDATA%'
                    enabled:
                      type: boolean
                      title: Enable
                    comment:
                      type: string
                      title: Comment
                    exclude_from:
                      type: object
                      title: Exclusion applied to
                      properties:
                        exploit_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
                        malware_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Protects against malware infections and zero-day threats
                        ransomware_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Detects and blocks ransomware threats using advanced behavior analysis
                        suspicious_activity:
                          type:
                          - boolean
                          - 'null'
                          title: Uses advanced machine learning to identify suspicious processes that require additional review
                        website_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Blocks network traffic from malicious websites and IP addresses
                        bruteforce_protection:
                          type:
                          - boolean
                          - 'null'
                          title: Bruteforce attack protection on RDP, IMAP and so on.
                    account_level:
                      type: boolean
                      title: Account level
                    policy_ids:
                      type: array
                      title: IDs of Policies
                      items:
                        type: string
                        title: ID of the Policy
                properties:
                  id:
                    type: string
                    title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
                    pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                    examples:
         

# --- truncated at 32 KB (436 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-device-control-api-openapi.yml