EDR customers can use Flight Recorder to search event data captured on endpoints that have suspicious activity monitoring enabled. Use these APIs to search through files, registry, processes, networking activity, and suspicious activities. This information can be used to investigate or identify indicators of compromise.
openapi: 3.2.0
info:
title: Malwarebytes Flight Recorder API
version: 1.0.0
description: 'Operations tagged Flight-recorder across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Flight-recorder
description: "EDR customers can use Flight Recorder to search event data captured on endpoints that have suspicious activity monitoring enabled. \n\nUse these APIs to search through files, registry, processes, networking activity, and suspicious activities. This information can be used to investigate or identify indicators of compromise. "
paths:
/nebula/v1/flight-recorder/chart:
servers:
- url: https://api.threatdown.com
post:
description: Search occurrence of suspicious activity. Wildcards are not supported.
summary: Search occurrence of suspicious activity
security:
- client_credentials:
- read
- user_permissions:
- edr.view
status:
outage:
- auth
- edr
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Flight Recorder chart request
required:
- advanced_filters
oneOf:
- required:
- time_range
- required:
- time_window
properties:
time_range:
type: string
title: Time range
enum:
- 7d
- 3d
- 24h
- 12h
- 6h
- 3h
- 1h
- 30m
time_window:
type: object
title: Time window
properties:
gte:
type: string
title: Time window greater than or equal to date
format: date-time
lte:
type: string
title: Time window lower than or equal to date
format: date-time
advanced_filters:
type: array
title: Advanced flight recorder filters
items:
items:
type: object
properties:
or:
type: array
title: Filter with or
items:
type: object
properties:
eq:
type: array
title: Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
neq:
type: array
title: Not Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
contains:
type: array
title: Contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
not_contains:
type: array
title: not_contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
starts_with:
type: array
title: starts_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
ends_with:
type: array
title: ends_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
and:
type: array
title: Filter with and
items:
type: object
properties:
eq:
type: array
title: Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
neq:
type: array
title: Not Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
contains:
type: array
title: Contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
not_contains:
type: array
title: not_contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
starts_with:
type: array
title: starts_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
ends_with:
type: array
title: ends_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
responses:
'200':
description: response schema
content:
application/json:
schema:
type: array
title: Flight Recorder chart result
items:
type: object
title: Collection items
properties:
date:
type: string
title: Date
examples:
- '2020-06-01T07:00:00.000Z'
bucket:
type: integer
title: Bucket
process:
type: integer
title: Process
filesystem:
type: integer
title: Filesystem
script_activity:
type: integer
title: script_activity
network:
type: integer
title: Network
registry:
type: integer
title: Registry
system_event:
type: integer
title: System event
other:
type: integer
title: Other
tags:
- Flight-recorder
operationId: api.nebula.post.flightrecorder.chart
/nebula/v1/flight-recorder/endpoints:
servers:
- url: https://api.threatdown.com
post:
description: Search suspicious activity receiving impact information on an endpoint. Wildcards are not supported.
summary: Search suspicious activity receiving impact information on an endpoint
security:
- client_credentials:
- read
- user_permissions:
- edr.view
status:
outage:
- auth
- edr
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Flight Recorder endpoints request
oneOf:
- required:
- time_range
- required:
- time_window
properties:
advanced_filters:
type: array
title: Advanced flight recorder filters. REQUIRED field
items:
items:
type: object
properties:
or:
type: array
title: Filter with or
items:
type: object
properties:
eq:
type: array
title: Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
neq:
type: array
title: Not Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
contains:
type: array
title: Contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
not_contains:
type: array
title: not_contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
starts_with:
type: array
title: starts_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
ends_with:
type: array
title: ends_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
and:
type: array
title: Filter with and
items:
type: object
properties:
eq:
type: array
title: Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
neq:
type: array
title: Not Equal operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
contains:
type: array
title: Contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
not_contains:
type: array
title: not_contains operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
starts_with:
type: array
title: starts_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- machine_id
- pc_hostname
- process_id
- process_name
- process_path
- remote_port
- user
- type: string
title: Value to compare
ends_with:
type: array
title: ends_with operator
items:
- type: string
title: Field name
enum:
- command_line
- contacted_domains
- contacted_ips
- hash.md5
- hash.sha1
- hash.sha256
- hash.sha512
- pc_hostname
- pr
# --- truncated at 32 KB (211 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-flight-recorder-api-openapi.yml