Malwarebytes Firewall Management API
The Firewall Management API from Malwarebytes — 20 operation(s) for firewall management.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Firewall Management API
version: 1.0.0
description: 'Operations tagged Firewall Management across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Firewall Management
paths:
/nebula/v1/firewall/policies:
servers:
- url: https://api.threatdown.com
post:
description: Create a new firewall policy
summary: Create a new firewall policy
security:
- client_credentials:
- write
- user_permissions:
- firewall.createPolicy
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Create firewall policy
required:
- name
- allow_store
- enabled
allOf:
- type: object
title: Firewall policy
properties:
name:
type: string
title: Firewall policy name
description:
type: string
title: Firewall policy description
allow_store:
type: boolean
title: Allow store
enabled:
type: boolean
title: Enabled controls if the agent is sent the Firewall plugin.
profiles:
type: array
title: Profiles
items:
type: object
title: Firewall profile
properties:
type:
type: number
title: Firewall profile type(1=Domain, 2=Private, 4=Public)
enum:
- 1
- 2
- 4
firewall_enabled:
type: boolean
title: Firewall enabled
inbound_mode:
type: string
title: Inbound mode
enum:
- ALLOW
- BLOCK
- BLOCK_ALL
outbound_mode:
type: string
title: Outbound mode
enum:
- ALLOW
- BLOCK
report_frequency:
type: number
title: Report frequency in minutes
minimum: 5
default: 60
maximum: 1440
- properties:
policies:
type: array
title: Policy IDs
items:
type: string
format: uuid
rulesets:
type: array
title: Ruleset IDs
items:
type: string
format: uuid
responses:
'200':
description: response schema
content:
application/json:
schema:
title: Get firewall policy response
type: object
required:
- id
allOf:
- type: object
title: Firewall policy
properties:
name:
type: string
title: Firewall policy name
description:
type: string
title: Firewall policy description
allow_store:
type: boolean
title: Allow store
enabled:
type: boolean
title: Enabled controls if the agent is sent the Firewall plugin.
profiles:
type: array
title: Profiles
items:
type: object
title: Firewall profile
properties:
type:
type: number
title: Firewall profile type(1=Domain, 2=Private, 4=Public)
enum:
- 1
- 2
- 4
firewall_enabled:
type: boolean
title: Firewall enabled
inbound_mode:
type: string
title: Inbound mode
enum:
- ALLOW
- BLOCK
- BLOCK_ALL
outbound_mode:
type: string
title: Outbound mode
enum:
- ALLOW
- BLOCK
report_frequency:
type: number
title: Report frequency in minutes
minimum: 5
default: 60
maximum: 1440
- properties:
id:
type: string
title: Firewall policy ID
rulesets:
type: array
title: Rulesets
items:
title: Get firewall ruleset response
type: object
required:
- id
allOf:
- title: Firewall ruleset
type: object
properties:
name:
type: string
title: Firewall ruleset name
description:
type: string
title: Firewall ruleset description
- properties:
id:
type: string
title: Firewall rule ID
created_at:
type: string
title: Created at
format: date-time
updated_at:
type: string
title: Updated at
format: date-time
deleted_at:
type: string
title: Deleted at
format: date-time
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
deleted_by:
type: string
title: Deleted by
account_id:
type: string
title: Account ID
format: uuid
parent_account_id:
type: string
title: Parent account ID
format: uuid
etag:
type: string
title: ETag
rules:
type: array
title: Rules
items:
type: object
title: Get firewall rule response
required:
- id
allOf:
- type: object
title: Firewall rule
properties:
name:
type: string
title: Firewall rule name
description:
type: string
title: Firewall rule description
program:
type: string
title: Firewall rule program
action:
type: string
title: Firewall rule action
enum:
- ALLOW
- BLOCK
direction:
type: string
title: Firewall rule direction
enum:
- IN
- OUT
enabled:
type: boolean
title: Enabled
location:
type: number
title: Location
local_addresses:
type: array
title: Local addresses
items:
anyOf:
- type: string
description: local IPv4 address
format: ipv4
- type: string
description: local explicit IPv4 range
pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
- type: string
description: local CIDR IPv4 range
pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$
- type: string
description: IPv6 address
format: ipv6
- type: string
description: IPv6 range CIDR
pattern: ^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$
- type: string
description: explicit IPv6 range
pattern: ^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\.){3}[0-9]{1,3}))$
- type: string
const: LocalSubnet
local_ports:
type: array
title: Local ports
items:
type: string
remote_addresses:
type: array
title: Remote addresses
items:
type: string
remote_ports:
type: array
title: Remote ports
items:
type: string
protocol:
type:
- integer
- 'null'
description: Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)
enum:
- 0
- 1
- 2
- 6
- 17
- 41
- 43
- 44
- 47
- 50
- 51
- 58
- 59
- 60
- 112
- 113
- 115
- 256
service:
type: string
os_type:
type: integer
description: The OS type to which the rule applies. (1=workstation, 2=server, 3=both)
enum:
- 1
- 2
- 3
- properties:
id:
type: string
title: Firewall rule ID
created_at:
type: string
title: Created at
format: date-time
updated_at:
type: string
title: Updated at
format: date-time
deleted_at:
type: string
title: Deleted at
format: date-time
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
deleted_by:
type: string
title: Deleted by
account_id:
type: string
title: Account ID
format: uuid
parent_account_id:
type: string
title: Parent account ID
format: uuid
etag:
type: string
title: ETag
is_default:
type: boolean
title: Indicated whether the rule is default
edge_traversal:
type: integer
title: Edge traversal
icmp_types:
type: string
description: ICMP types
is_default:
type: boolean
title: Indicated whether the ruleset is default
internal_name:
type: string
title: Internal name
policies:
type: array
items:
type: object
created_at:
type: string
title: Created at
format: date-time
updated_at:
type: string
title: Updated at
format: date-time
deleted_at:
type: string
title: Deleted at
format: date-time
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
deleted_by:
type: string
title: Deleted by
account_id:
type: string
title: Account ID
format: uuid
parent_account_id:
type: string
title: Parent account ID
format: uuid
tags:
- Firewall Management
operationId: api.nebula.post.firewall.policy
get:
description: Get firewall policies
summary: Get firewall policies
security:
- client_credentials:
- read
- user_permissions:
- firewall.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: page_size
required: false
in: query
schema:
type: number
- name: next_cursor
required: false
in: query
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get firewall policies response
properties:
total:
type: number
title: Total number of firewall policies
policies:
type: array
title: Firewall policies
items:
title: Get firewall policy response
type: object
required:
- id
allOf:
- type: object
title: Firewall policy
properties:
name:
type: string
title: Firewall policy name
description:
type: string
title: Firewall policy description
allow_store:
type: boolean
title: Allow store
enabled:
type: boolean
title: Enabled controls if the agent is sent the Firewall plugin.
profiles:
type: array
title: Profiles
items:
type: object
title: Firewall profile
properties:
type:
type: number
title: Firewall profile type(1=Domain, 2=Private, 4=Public)
enum:
- 1
- 2
- 4
firewall_enabled:
type: boolean
title: Firewall enabled
inbound_mode:
type: string
title: Inbound mode
enum:
- ALLOW
- BLOCK
- BLOCK_ALL
outbound_mode:
type: string
title: Outbound mode
enum:
- ALLOW
- BLOCK
report_frequency:
type: number
title: Report frequency in minutes
minimum: 5
default: 60
maximum: 1440
- properties:
id:
type: string
title: Firewall policy ID
rulesets:
type: array
title: Rulesets
items:
title: Get firewall ruleset response
type: object
required:
- id
allOf:
- title: Firewall ruleset
type: object
properties:
name:
type: string
title: Firewall ruleset name
description:
type: string
title: Firewall ruleset description
- properties:
id:
type: string
title: Firewall rule ID
created_at:
type: string
title: Created at
format: date-time
updated_at:
type: string
title: Updated at
format: date-time
deleted_at:
type: string
title: Deleted at
format: date-time
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
deleted_by:
type: string
title: Deleted by
account_id:
type: string
title: Account ID
format: uuid
parent_account_id:
type: string
title: Parent account ID
format: uuid
etag:
type: string
title: ETag
rules:
type: array
title: Rules
items:
type: object
title: Get firewall rule response
required:
- id
allOf:
- type: object
title: Firewall rule
properties:
name:
type: string
title: Firewall rule name
description:
type: string
title: Firewall rule description
program:
type: string
title: Firewall rule program
action:
type: string
title: Firewall rule action
enum:
- ALLOW
- BLOCK
direction:
type: string
title: Firewall rule direction
enum:
- IN
- OUT
enabled:
type: boolean
title: Enabled
location:
type: number
title: Location
local_addresses:
type: array
title: Local addresses
items:
anyOf:
- type: string
description: local IPv4 address
format: ipv4
- type: string
description: local explicit IPv4 range
pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
- type: string
description: local CIDR IPv4 range
pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$
- type: string
description: IPv6 address
format: ipv6
- type: string
description: IPv6 range CIDR
pattern: ^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$
- type: string
description: explicit IPv6 range
pattern: ^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\.){3}[0-9]{1,3}))$
- type: string
const: Lo
# --- truncated at 32 KB (554 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-firewall-management-api-openapi.yml