Malwarebytes Endpoints API

openapi: 3.2.0
info:
  title: Malwarebytes Endpoints API
  version: 1.0.0
  description: 'Operations tagged Endpoints across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Endpoints
  description: '## Endpoints Introduction


    An Endpoint is a device which has the ThreatDown Endpoint Agent installed. Currently, there are available Endpoint Agents for Windows, macOS, and Linux. Refer to the installation guide for more information on registering a new Endpoint.


    Using the Endpoint API, you can search your registered endpoints and retrieve their last known status. The API allows you to perform advanced queries and offers grouping capabilities so that you can perform deep analysis of your company''s devices and the found threats, such as Detections or Suspicious Activities.


    You can scan, isolate, remediate, and reboot your endpoints remotely through the Job APIs.


    ## How to deploy an endpoint agent


    **Endpoint software can be installed in the following ways**:


    - Active Directory (AD) Group Policy

    - System Center Configuration Manager (SCCM)

    - Third-party deployment tools

    - Manually on the endpoints

    - Discovery & Deployment Tool


    Once the installation is complete, the endpoints will be displayed in the console.


    You can retrieve installers for your account through the `Installers` APIs.

    '
paths:
  /nebula/v1/endpoints/{id}:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: Delete a machine from the console
      summary: Delete a machine
      security:
      - client_credentials:
        - write
      - user_permissions:
        - endpoints.delete
      status:
        outage:
        - auth
        - search_stateful
      parameters:
      - name: id
        required: true
        in: path
        description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type:
              - object
              - 'null'
              title: Delete endpoint request
              properties:
                unregister_isolated:
                  type: boolean
                  title: Force delete isolated endpoints
      responses:
        '200':
          description: Successful response
      tags:
      - Endpoints
      operationId: api.v2.nebula.delete.endpoint
    get:
      description: Retrieve a single ID by its universally unique identifier.
      summary: Get endpoint
      security:
      - client_credentials:
        - read
      - user_permissions:
        - endpoints.view
      status:
        outage:
        - auth
      parameters:
      - name: id
        required: true
        in: path
        description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      - name: populate_diag_info
        required: false
        in: query
        schema:
          type: boolean
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                type: object
                title: The Get Endpoint By Id Body 200 Schema
                required:
                - id
                - policy_id
                - group_id
                - name
                - online
                - is_deleted
                properties:
                  id:
                    type: string
                    title: ID of the endpoint (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
                    pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                    examples:
                    - 9256034b-7967-4253-a5d9-260663e4fa4f
                  policy_id:
                    type: string
                    title: ID of the policy (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
                    pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                    examples:
                    - 9256034b-7967-4253-a5d9-260663e4fa4f
                  group_id:
                    type: string
                    title: ID of the group (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
                    pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                    examples:
                    - 9256034b-7967-4253-a5d9-260663e4fa4f
                  name:
                    type: string
                    title: The Name of the endpoint
                  online:
                    type: boolean
                    title: Whether the endpoint is online or not
                  is_deleted:
                    type: boolean
                    title: Whether the endpoint was deleted
                  os_architecture:
                    type: string
                    title: OS architecture
                  os_platform:
                    type: string
                    title: OS platform
                  os_release_name:
                    type: string
                    title: OS release name
                  last_seen_at:
                    type: string
                    title: The last time the endpoint checked in as online (max 1 per hour) (Ex. "2020-03-23T17:23:17.860482Z")
                    pattern: ^\d{4}-[0-1]\d-[0-3]\d[(t|T)\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:(z|Z)|[+-]\d{2}:\d{2})$
                    examples:
                    - '2020-03-23T17:23:17.860482Z'
                  tags:
                    type: object
                    title: Tags for this machine
                    additionalProperties: true
                  stats:
                    type: object
                    additionalProperties: true
                  diag_info:
                    type: object
                    title: Information on diagnostic logs
                    properties:
                      has_diag_logs:
                        type: boolean
                        title: Indicates whether diagnostic logs are available
      tags:
      - Endpoints
      operationId: api.v2.nebula.get.endpoint.id
  /nebula/v1/endpoints:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: "Use this endpoint to mark machines as deleted.\nThis API endpoint allows you to specify queries instead of explicitly specifying endpoint ids.\n\n> **Be extremely cautious**: If you don't specify any constraint, all your endpoints will match the search and be deleted. For example, the following payload:\n```json\n    \"queries\": [{}]\n```\nwill select all the machines in your account. Always test the result of your query using the [Search endpoints APIs](#operation/api.v2.nebula.post.endpoints)\n\nIf you want to mark all of your `Mac Os` endpoints as deleted across two of your manages sites, and on all your endpoints for a certain account with policy matching the string `serious policy`, do the following:\n\n```json\n    \"queries\": [{ \n        \"os_info.os_platform\": \"Mac Os\"\n    }, {\n        \"policy_name\": \"serious policy\"    \n    }]\n```\nThe constraints accepted are the same accepted by the search endpoints route. Refer to `POST -> /endpoints` for more information about the constraints accepted.\n"
      summary: Delete multiple machines
      security:
      - client_credentials:
        - write
      - user_permissions:
        - endpoints.delete
      status:
        outage:
        - auth
        - search_stateful
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: Delete in bulk
              required:
              - queries
              properties:
                queries:
                  type: array
                  title: Groups
                  items:
                    type: object
                    title: Group items
                    allOf:
                    - type: object
                      title: Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.
                      properties:
                        name_multi_search:
                          type: string
                          title: Search either alias, host name of fully qualified host name
                        machine_id:
                          type: string
                          title: Filter the search to the endpoints with specified id
                        is_isolated:
                          type: boolean
                          title: Indicates whether the endpoints are isolated or not
                        is_software_update_available:
                          type: boolean
                          title: Indicates whether the agent has an available update
                        has_alerts:
                          type: boolean
                          title: Indicates whether the endpoint needs attention
                        alerts.codes:
                          type: string
                          title: Alert codes
                        suspicious_activity_found:
                          type: boolean
                          title: Filter the search to the endpoints that have open suspicious activities
                        reboot_required:
                          type: boolean
                          title: Filter the search to the endpoints needing a reboot
                        infection_found:
                          type: boolean
                          title: Filter the search to the endpoints with one or more security threats found
                        policy_id:
                          type: string
                          title: Filter the search to the endpoints with specified policy (id)
                        policy_name:
                          type: string
                          title: Filter the search to the endpoints with specified policy (name)
                        policy_etag:
                          type: string
                          title: Filter the search to the endpoints with specified policy etag
                        domain_name:
                          type: string
                          title: Filter the search to the endpoints with specified domain name
                        engine_version:
                          type: string
                          title: Filter the search to the endpoints with specified engine version
                        last_user:
                          type: string
                          title: Last user that logged into the machine
                        last_user.keyword:
                          type: string
                          title: Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field.
                        alias:
                          type: string
                          title: Aliases for the machine
                        plugins.siem.reboot_reason:
                          type: string
                          title: Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin
                        plugins.siem.plugin_version:
                          type: string
                          title: Filter the search to the endpoints with specified SIEM plugin version
                        plugins.siem.alerts.codes:
                          type: string
                          title: Filter the search to the endpoints with specified SIEM alerts
                        plugins.browser_phishing_protection.plugin_version:
                          type: string
                          title: Filter the search to the endpoints with specified Browser Phishing Protection plugin version
                        plugins.browser_phishing_protection.alerts.codes:
                          type: string
                          title: Filter the search to the endpoints with specified Browser Phishing Protection alerts
                        plugins.incident_response.reboot_reason:
                          type: string
                          title: Filter the search to the endpoints with specified reboot reason, as reported by IR plugin
                        plugins.incident_response.plugin_version:
                          type: string
                          title: Filter the search to the endpoints with specified IR plugin version
                        plugins.incident_response.alerts.codes:
                          type: string
                          title: Filter the search to the endpoints with specified IR plugin alerts
                        plugins.endpoint_detection_and_response.reboot_reason:
                          type: string
                          title: Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin
                        plugins.endpoint_detection_and_response.plugin_version:
                          type: string
                          title: Filter the search to the endpoints with specified EDR plugin version
                        plugins.endpoint_detection_and_response.alerts.codes:
                          type: string
                          title: Filter the search to the endpoints with specified EDR plugin alerts
                        plugins.endpoint_protection.reboot_reason:
                          type: string
                          title: Filter the search to the endpoints with specified reboot reason, as reported by EP plugin
                        plugins.endpoint_protection.update_package_version:
                          type: string
                          title: Filter the search to the endpoints with specified EP update package version
                        plugins.endpoint_protection.update_package_version.keyword:
                          type: string
                          title: Filter the search to the endpoints with wildcard EP update package version
                        plugins.endpoint_protection.component_package_version:
                          type: string
                          title: Filter the search to the endpoints with specified EP component package version
                        plugins.endpoint_protection.sdk_version:
                          type: string
                          title: Filter the search to the endpoints with specified EP SDK version
                        plugins.endpoint_protection.plugin_version:
                          type: string
                          title: Filter the search to the endpoints with specified EP plugin version
                        plugins.endpoint_protection.alerts.codes:
                          type: string
                          title: Filter the search to the endpoints with specified EP plugin alerts
                        plugins.asset_manager.reboot_reason:
                          type: string
                          title: Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin
                        plugins.asset_manager.plugin_version:
                          type: string
                          title: Filter the search to the endpoints with specified asset manager plugin version
                        plugins.asset_manager.alerts.codes:
                          type: string
                          title: Filter the search to the endpoints with specified asset manager alerts
                        fully_qualified_host_name:
                          type: string
                          title: Filter the search to the endpoints with specified, fully qualified host name
                        host_name:
                          type: string
                          title: Filter the search to the endpoints with specified host name
                        os_info.os_release_name:
                          type: string
                          title: Filter the search to the endpoints with specified release name of OS
                        os_info.os_release_name.keyword:
                          type: string
                          title: Filter the search to the endpoints with specified release name of OS
                        os_info.os_architecture:
                          type: string
                          title: Filter the search to the endpoints with specified OS architecture
                        os_info.os_platform:
                          type: string
                          title: Filter the search to the endpoints with specified OS
                        os_info.os_version:
                          type: string
                          title: Filter the search to the endpoints with specified OS version
                        os_info.os_type:
                          type: string
                          title: Filter the search to the endpoints with specified OS type
                        nics.description:
                          type: string
                          title: Filter the search to the endpoints with specified NICS description
                        nics.mac_address:
                          type: string
                          title: Filter the search to the endpoints with specified NICS MAC address
                        nics.ips:
                          type: string
                          title: Filter the search to the endpoints with specified ips
                        group_name.keyword:
                          type: string
                          title: Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field.
                        policy_name.keyword:
                          type: string
                          title: Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field.
                        host_name.keyword:
                          type: string
                          title: Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field.
                        fully_qualified_host_name.keyword:
                          type: string
                          title: Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field.
                        engine_version.keyword:
                          type: string
                          title: Filter the search by specified engine version.
                        engine_version_gt:
                          type: string
                          title: Filter the search by engine version greater than specified value.
                        engine_version_gte:
                          type: string
                          title: Filter the search by engine version greater than or equal to specified value.
                        engine_version_lt:
                          type: string
                          title: Filter the search by engine version less than specified value.
                        engine_version_lte:
                          type: string
                          title: Filter the search by engine version less than or equal to specified value.
                        protection_status:
                          type: string
                          title: Protection status of the endpoint(s)
                          pattern: (^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)
                        domain_name.keyword:
                          type: string
                          title: Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field.
                        group_id:
                          type: string
                          title: Filter the search by group id
                        group_name:
                          type: string
                          title: Filter the search by group's name
                        source_location.city:
                          type: string
                          title: Source location city filter
                        source_location.country:
                          type: string
                          title: Source location country filter
                        source_location.country_iso:
                          type: string
                          title: Source location country_iso filter
                        source_location.continent:
                          type: string
                          title: Source location continent filter
                        source_location.time_zone:
                          type: string
                          title: Source location time_zone filter
                        source_location.postal_code:
                          type: string
                          title: Source location postal_code filter
                        source_location.subdivisions:
                          type: string
                          title: Source location subdivisions filter
                        source_location.is_anonymous_proxy:
                          type: boolean
                          title: Source location is_anonymous_proxy filter
                        machine_ip:
                          type: string
                          title: machine_ip filter
                        serial_number:
                          type: string
                          title: Serial number filter
                        serial_number.keyword:
                          type: string
                          title: Serial number filter
                        object_guid:
                          type: string
                          title: object_guid filter
                        is_deleted:
                          type:
                          - boolean
                          - 'null'
                          default: false
                          title: is_deleted filter
                        vulnerabilities_found_total_gt:
                          type: number
                          title: vulnerabilities_found_total_gt
                        vulnerabilities_found_total_lt:
                          type: number
                          title: vulnerabilities_found_total_lt
                        vulnerabilities_found_total_gte:
                          type: number
                          title: vulnerabilities_found_total_gte
                        vulnerabilities_found_total_lte:
                          type: number
                          title: vulnerabilities_found_total_lte
                        connected:
                          type: boolean
                          title: connected
                        sort_field:
                          type: string
                          title: Sort field
                          enum:
                          - at
                          - nics.ips
                          - nics.mac_address
                          - nics.description
                          - os_info.os_type
                          - os_info.os_version
                          - os_info.os_platform
                          - os_info.os_architecture
                          - os_info.os_release_name
                          - host_name
                          - fully_qualified_host_name
                          - plugins.asset_manager.plugin_version
                          - plugins.asset_manager.reboot_reason
                          - plugins.endpoint_protection.plugin_version
                          - plugins.endpoint_protection.sdk_version
                          - plugins.endpoint_protection.component_package_version
                          - plugins.endpoint_protection.update_package_version
                          - plugins.endpoint_protection.reboot_reason
                          - plugins.endpoint_detection_and_response.plugin_version
                          - plugins.endpoint_detection_and_response.reboot_reason
                          - plugins.incident_response.plugin_version
                          - plugins.incident_response.reboot_reason
                          - plugins.siem.plugin_version
                          - plugins.browser_phishing_protection.plugin_version
                          - plugins.siem.reboot_reason
                          - engine_version
                          - domain_name
                          - policy_etag
                          - account_id
                          - group_id
                          - root_group_id
                          - group_name
                          - policy_name
                          - policy_id
                          - deleted_at
                          - created_at
                          - marked_for_deletion
                          - is_deleted
                          - last_day_seen
                          - last_scanned_at
                          - last_user
                          - tags.alias
                          - name_multi_search
                          - machine_ip
                          - serial_number
                          - object_guid
                          - vulnerabilities_found.critical
                          - vulnerabilities_found.high
                          - vulnerabilities_found.medium
                          - vulnerabilities_found.low
                          - vulnerabilities_found.none
                          - vulnerabilities_found.total
                          - os_patches_available
                          - last_assets_scan_at
                          - connected
                        multi_sort:
                          type: array
                          title: The multi_sort schema
                          items:
                            type: object
                            title: Sort field and direction
                            properties:
                              field:
                                type: string
                                title: Sort field
                                enum:
                                - at
                                - nics.ips
                                - nics.mac_address
                                - nics.description
                                - os_info.os_type
                                - os_info.os_version
                                - os_info.os_platform
                                - os_info.os_architecture
                                - os_info.os_release_name
                                - host_name
                                - fully_qualified_host_name
                                - plugins.asset_manager.plugin_version
                                - plugins.asset_manager.reboot_reason
                                - plugins.endpoint_protection.plugin_version
                                - plugins.endpoint_protection.sdk_version
                                - plugins.endpoint_protection.component_package_version
                                - plugins.endpoint_protection.update_package_version
                                - plugins.endpoint_protection.reboot_reason
                                - plugins.endpoint_detection_and_response.plugin_version
                                - plugins.endpoint_detection_and_response.reboot_reason
                                - plugins.incident_response.plugin_version
                                - plugins.incident_response.reboot_reason
                                - plugins.siem.plugin_version
                                - plugins.browser_phishing_protection.plugin_version
                                - plugins.siem.reboot_reason
                                - engine_version
                                - domain_name
                                - policy_etag
                                - account_id
                                - group_id
                                - root_group_id
                                - group_name
                                - policy_name
                                - policy_id
                                - deleted_at
                                - created_at
                                - marked_for_deletion
                                - is_deleted
                                - last_day_seen
                                - last_scanned_at
                                - last_user
                                - tags.alias
                                - name_multi_search
                                - machine_ip
                                - serial_number
                                - object_guid
                                - vulnerabilities_found.critical
                                - vulnerabilities_found.high
                                - vulnerabilities_found.medium
                                - vulnerabilities_found.low
                                - vulnerabilities_found.none
                                - vulnerabilities_found.total
                                - os_patches_available
                                - last_assets_scan_at
                                - connected
                              direction:
                                type: string
                                title: Direction
                                enum:
                                - asc
                                - desc
                              missing:
                                type: string
                                title: Missing values sorting
                                enum:
                                - _first
                                - _last
                        populate:
                          type: object
                          title: Specify whether you need to populate the server's response with additional data, like account info or last task
                          properties:
                            last_job:
                              type: boolean
                              title: The last_job data
                            account:
                              type: boolean
                              title: The account data
                            default_group:
                              type: boolean
                              title: Specify whether the group is default
     

# --- truncated at 32 KB (619 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-endpoints-api-openapi.yml