Malwarebytes Events API
An event is a general term for a threat that has occurred, remediation or other action taken on a threat, and other endpoint-related activity.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Events API
version: 1.0.0
description: 'Operations tagged Events across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Events
description: An event is a general term for a threat that has occurred, remediation or other action taken on a threat, and other endpoint-related activity.
paths:
/nebula/v1/events:
servers:
- url: https://api.threatdown.com
get:
description: Retrieve events associated with your account.
summary: Retrieve events
security:
- client_credentials:
- read
- user_permissions:
- events.view
- activityLogs.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
- name: search_string
required: false
in: query
description: Search with events with event string.
schema:
type: string
- name: machine_id
required: false
in: query
description: Search with machine_id
schema:
type: string
- name: start
required: false
in: query
description: Timestamp to filter since event times.
schema:
type: string
- name: end
required: false
in: query
description: Timestamp to filter until event times.
schema:
type: string
- name: severity_flags
required: false
in: query
description: Filter with severity flag
schema:
type: number
enum:
- 0
- 1
- 2
- 4
- 8
- name: source
required: false
in: query
description: Filter by event source
schema:
type: number
enum:
- 1
- 2
- 3
- 4
- 5
- 6
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Collection of events
required:
- events
- total_count
- next_cursor
properties:
events:
type: array
title: List of events
items:
type: object
additionalProperties: true
title: Event
properties:
id:
type: string
title: ID
machine_id:
type: string
title: Endpoint ID
user_id:
type: string
title: User ID
source:
type:
- integer
- string
title: Source
source_name:
type: string
title: Source name
type:
type:
- integer
- string
title: Type
type_name:
type: string
title: Type name
friendly_type:
type: string
title: Friendly name of type
severity:
type:
- integer
- string
title: Severity
severity_name:
type: string
title: Severity name
details:
type:
- object
- array
additionalProperties: true
title: Details
properties:
message:
type: string
title: Message
filename:
type: string
title: Filename
name:
type: string
title: Name
user_email:
type: string
title: User email
user_name:
type: string
title: User name
user_role:
type: string
title: User role
timestamp:
type: string
title: Timestamp
examples:
- '2020-03-10T00:00:18.247444Z'
total_count:
type: integer
title: Total Count
description: Total count of results.
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
tags:
- Events
operationId: api.nebula.get.events
/oneview/v1/accounts/{account_id}/events:
servers:
- url: https://api.threatdown.com
get:
description: An event is a record of activity on your account, such as found a threat, completed a scan, or removed endpoint agent. Retrieve events associated with your account.
summary: Retrieve events
security:
- client_credentials:
- read
- user_permissions:
- events.view
- activityLogs.view
status:
outage:
- auth
parameters:
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
- name: search_string
required: false
in: query
description: Search with events with event string.
schema:
type: string
- name: machine_id
required: false
in: query
description: Search with machine_id
schema:
type: string
- name: start
required: false
in: query
description: Timestamp to filter since event times.
schema:
type: string
- name: end
required: false
in: query
description: Timestamp to filter until event times.
schema:
type: string
- name: severity_flags
required: false
in: query
description: Filter with severity flag
schema:
type: number
enum:
- 0
- 1
- 2
- 4
- 8
- name: source
required: false
in: query
description: Filter by event source
schema:
type: number
enum:
- 1
- 2
- 3
- 4
- 5
- 6
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Collection of events
required:
- events
- total_count
- next_cursor
properties:
events:
type: array
title: List of events
items:
type: object
additionalProperties: true
title: Event
properties:
id:
type: string
title: ID
machine_id:
type: string
title: Endpoint ID
user_id:
type: string
title: User ID
source:
type:
- integer
- string
title: Source
source_name:
type: string
title: Source name
type:
type:
- integer
- string
title: Type
type_name:
type: string
title: Type name
friendly_type:
type: string
title: Friendly name of type
severity:
type:
- integer
- string
title: Severity
severity_name:
type: string
title: Severity name
details:
type:
- object
- array
additionalProperties: true
title: Details
properties:
message:
type: string
title: Message
filename:
type: string
title: Filename
name:
type: string
title: Name
user_email:
type: string
title: User email
user_name:
type: string
title: User name
user_role:
type: string
title: User role
timestamp:
type: string
title: Timestamp
examples:
- '2020-03-10T00:00:18.247444Z'
total_count:
type: integer
title: Total Count
description: Total count of results.
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
tags:
- Events
operationId: api.rmm.get.events
components:
securitySchemes:
client_credentials:
type: oauth2
flows:
clientCredentials:
tokenUrl: /token
scopes:
read: Read data of your Nebula account
write: Write data, such as groups, policies, exclusions. Create Webhook subscriptions
execute: Issue jobs on your endpoints, like Scan, Reboot or Isolate.
user_permissions:
type: http
scheme: bearer
x-refined-from:
- malwarebytes-threatdown-nebula-openapi.json
- malwarebytes-threatdown-oneview-openapi.json