Malwarebytes Grid API

openapi: 3.2.0
info:
  title: Malwarebytes Grid API
  version: 1.0.0
  description: 'Operations tagged Grid across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Grid
  description: "# Grid Introduction\n\nUsing the following API, you can search endpoints, detections, software inventory, vulnerabilities, rid rules, os-patches, device control events and dns logs. This API allows to perform filtering, sorting, grouping and aggregating of data by specifying constraints based on the field type.\n\nAvailable constraints for searching based on value type\n\n| Value Type | Constraints |\n| --- |----|\n| Simple String | equals, not_equals, contains, not_contains |\n| String (with enum) | equals, not_equals |\n| String/UUID (entity reference) | equals, not_equals |\n| Version | equals, not_equals |\n| Number | gt, lt, gte, lte |\n| Timestamp | start, end |\n| IP | ip |\n| Boolean | equals, not_equals |\n\nGrid API also supports compound constraints that can be constructed with the keywords **allOf**, **anyOf**, **noneOf**\n\nExample of compound constraint:\n\n```json\n{\n\"constraints\": [\n  {\n    \"allOf\": [\n      {\n        \"field\": \"agent.host_name\",\n        \"operator\": \"contains\",\n        \"value\": \"a\"\n      },\n      {\n          \"field\": \"machine.is_deleted\",\n          \"operator\": \"equals\",\n          \"value\": false\n      },\n      {\n        \"anyOf\": [\n          {\n            \"field\": \"agent.os_info.os_platform\",\n            \"operator\": \"equals\",\n            \"value\": \"Linux\"\n          },\n          {\n            \"field\": \"agent.os_info.os_platform\",\n            \"operator\": \"equals\",\n            \"value\": \"MacOS\"\n          }\n        ]\n      }\n    ]\n  }\n]\n}\n```\nIn this example all the records that contain **a** in the ***agent.host_name***, have ***machine.is_deleted*** set to false and whose ***os_platform*** is equal to **either** ***Linux*** or ***MacOS*** will be returned.\n"
paths:
  /nebula/v1/grid/action-logs/export:
    servers:
    - url: https://api.threatdown.com
    post:
      description: Export action logs
      summary: Export action logs
      simple_schema: action-log-export-grid-simple
      security:
      - client_credentials:
        - execute
      - user_permissions:
        - activityLogs.view
      status:
        outage:
        - auth
        - search_stateless
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: Action Log export request
              allOf:
              - type: object
                title: Base Export Schema
                required:
                - groups
                - select
                - format
                properties:
                  format:
                    type: string
                    title: The output file
                    enum:
                    - csv
                    - xlsx
                    - html
                    - ods
                    - txt
                    - rtf
                    - json
                  download:
                    type: boolean
                    title: Whether to instruct the client to download the response as a file. Only clients like browsers are supported
                  type:
                    type: string
                    title: The encoding of the output
                    enum:
                    - string
                    - base64
                    - binary
                    default: string
                  select:
                    type: array
                    title: Which fields to select from the response
                    items:
                      type: object
                      title: Field
                      required:
                      - field
                      - newField
                      properties:
                        newField:
                          type: string
                          title: the new value
                        field:
                          type: string
                          title: The response field to map to a new value
                  groups:
                    type: array
                    title: List of queries
                    items:
                      type: object
              - properties:
                  select:
                    items:
                      properties:
                        field:
                          type: string
                          title: Action Log Select Fields
                          enum:
                          - logged_at
                          - action_type
                          - action_source
                          - resource_type
                          - resource_id
                          - resource_name
                          - affected_property_names
                          - account_id
                          - parent_account_id
                          - account_name
                          - machine_id
                          - user_id
                          - user_name
                          - user_email
                          - user_mode
                          - ip_address
                  groups:
                    items:
                      title: List of queries to fetch action logs
                      allOf:
                      - type: object
                        allOf:
                        - properties:
                            constraints:
                              type: array
                              items:
                                title: Action Log Constraints
                                type: object
                                required:
                                - field
                                anyOf:
                                - title: String (Equals, Not Equals) Constraints
                                  required:
                                  - operator
                                  - value
                                  properties:
                                    field:
                                      type: string
                                      oneOf:
                                      - title: Action Log String Fields
                                        type: string
                                        enum:
                                        - account_name
                                        - user_name
                                        - user_email
                                        - user_mode
                                        - resource_name
                                        - affected_property_names
                                      - title: Action Log Enum String Fields
                                        type: string
                                        enum:
                                        - action_type
                                        - action_source
                                        - resource_type
                                      - title: Action Log UID String Fields
                                        type: string
                                        enum:
                                        - document_id
                                        - resource_id
                                        - account_id
                                        - parent_account_id
                                        - machine_id
                                        - user_id
                                      - title: Action Log IP Fields
                                        type: string
                                        enum:
                                        - ip_address
                                    operator:
                                      type: string
                                      description: Operator to apply to the constraint
                                      enum:
                                      - equals
                                      - not_equals
                                    value:
                                      type:
                                      - string
                                      - array
                                      title: Value to search
                                      items:
                                        type: string
                                  if:
                                    properties:
                                      field:
                                        title: Action Log UID String Fields
                                        type: string
                                        enum:
                                        - document_id
                                        - resource_id
                                        - account_id
                                        - parent_account_id
                                        - machine_id
                                        - user_id
                                  then:
                                    properties:
                                      value:
                                        type:
                                        - string
                                        - array
                                        format: uuid
                                        items:
                                          type: string
                                          format: uuid
                                - title: String (Contains, Not Contains) Constraints
                                  required:
                                  - operator
                                  - value
                                  properties:
                                    field:
                                      type: string
                                      oneOf:
                                      - title: Action Log String Fields
                                        type: string
                                        enum:
                                        - account_name
                                        - user_name
                                        - user_email
                                        - user_mode
                                        - resource_name
                                        - affected_property_names
                                    operator:
                                      type: string
                                      description: Operator to apply to the constraint
                                      enum:
                                      - contains
                                      - not_contains
                                    value:
                                      type:
                                      - string
                                      - array
                                      title: Value to search
                                      items:
                                        type: string
                                - title: Date (start, end) Constraints
                                  properties:
                                    field:
                                      oneOf:
                                      - title: Action Log Date Fields
                                        type: string
                                        enum:
                                        - logged_at
                                  oneOf:
                                  - minProperties: 1
                                    title: Specify Date Range
                                    not:
                                      anyOf:
                                      - required:
                                        - operator
                                      - required:
                                        - value
                                    properties:
                                      start:
                                        type: string
                                        format: date-time
                                        title: Start Date
                                      end:
                                        type: string
                                        format: date-time
                                        title: End Date
                                  - title: Specify Exact Date
                                    not:
                                      anyOf:
                                      - required:
                                        - start
                                      - required:
                                        - end
                                    required:
                                    - operator
                                    - value
                                    properties:
                                      operator:
                                        type: string
                                        enum:
                                        - equals
                                      value:
                                        type:
                                        - string
                                        - array
                                        format: date-time
                                        title: Value to search
                                        items:
                                          format: date-time
                                - title: IP Constraints
                                  properties:
                                    field:
                                      oneOf:
                                      - title: Action Log IP Fields
                                        type: string
                                        enum:
                                        - ip_address
                                    operator:
                                      type: string
                                      enum:
                                      - ip
                                    value:
                                      type:
                                      - string
                                      - array
                                      title: Value to search
                                      items:
                                        type: string
                                - title: Field Exists/Not Exists Constraints
                                  required:
                                  - operator
                                  properties:
                                    field:
                                      type: string
                                      oneOf:
                                      - title: Action Log String Fields
                                        type: string
                                        enum:
                                        - account_name
                                        - user_name
                                        - user_email
                                        - user_mode
                                        - resource_name
                                        - affected_property_names
                                      - title: Action Log Enum String Fields
                                        type: string
                                        enum:
                                        - action_type
                                        - action_source
                                        - resource_type
                                      - title: Action Log UID String Fields
                                        type: string
                                        enum:
                                        - document_id
                                        - resource_id
                                        - account_id
                                        - parent_account_id
                                        - machine_id
                                        - user_id
                                    operator:
                                      type: string
                                      description: Operator to apply to the constraint
                                      enum:
                                      - exists
                                      - not_exists
                            aggregations:
                              items:
                                type: string
                                title: Action log aggregation fields
                                enum:
                                - action_type
                                - action_source
                                - resource_type
                                - resource_id
                                - resource_name
                                - account_id
                                - parent_account_id
                                - account_name
                                - machine_id
                                - user_id
                                - user_name
                                - user_email
                                - user_mode
                                - ip_address
                            sort_field:
                              type: string
                              title: Action Log Sort Fields
                              enum:
                              - logged_at
                              - action_type
                              - action_source
                              - resource_type
                              - resource_name
                              - account_name
                              - user_name
                              - user_email
                              - user_mode
                              - ip_address
                        - type: object
                          title: Base Search Schema
                          properties:
                            aggregations:
                              type: array
                              title: The fields onto which you can perform aggregations
                              items:
                                type: string
                                title: The Items Schema
                            page_size:
                              type: number
                              title: The page size. If you just need to aggregate, set it to 0
                              minimum: 0
                              maximum: 2000
                            sort_field:
                              title: Sort Fields
                              type: string
                            sort_order:
                              type: string
                              title: Whether sorting should be ascending or descending
                              enum:
                              - asc
                              - desc
                            aggregate_by_account:
                              type: boolean
                              title: Indicates whether aggregations should be scoped by account
                            next_cursor:
                              type: string
                              title: The pagination cursor for next set of results. For further documentation, check Pagination section.
                              examples:
                              - eyJzdGFydF9pbmRleCI6MTAwfQ==
      responses:
        '200':
          description: Successful response
      tags:
      - Grid
      operationId: api.nebula.grid.export.action-logs
  /nebula/v1/grid/action-logs/export/async:
    servers:
    - url: https://api.threatdown.com
    post:
      description: Export action logs
      summary: Export action logs asynchronously
      simple_schema: action-log-export-grid-simple
      security:
      - client_credentials:
        - execute
      - user_permissions:
        - activityLogs.view
      status:
        outage:
        - auth
        - search_stateless
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: Action Log export request
              allOf:
              - type: object
                title: Base Export Schema
                required:
                - groups
                - select
                - format
                properties:
                  format:
                    type: string
                    title: The output file
                    enum:
                    - csv
                    - xlsx
                    - html
                    - ods
                    - txt
                    - rtf
                    - json
                  download:
                    type: boolean
                    title: Whether to instruct the client to download the response as a file. Only clients like browsers are supported
                  type:
                    type: string
                    title: The encoding of the output
                    enum:
                    - string
                    - base64
                    - binary
                    default: string
                  select:
                    type: array
                    title: Which fields to select from the response
                    items:
                      type: object
                      title: Field
                      required:
                      - field
                      - newField
                      properties:
                        newField:
                          type: string
                          title: the new value
                        field:
                          type: string
                          title: The response field to map to a new value
                  groups:
                    type: array
                    title: List of queries
                    items:
                      type: object
              - properties:
                  select:
                    items:
                      properties:
                        field:
                          type: string
                          title: Action Log Select Fields
                          enum:
                          - logged_at
                          - action_type
                          - action_source
                          - resource_type
                          - resource_id
                          - resource_name
                          - affected_property_names
                          - account_id
                          - parent_account_id
                          - account_name
                          - machine_id
                          - user_id
                          - user_name
                          - user_email
                          - user_mode
                          - ip_address
                  groups:
                    items:
                      title: List of queries to fetch action logs
                      allOf:
                      - type: object
                        allOf:
                        - properties:
                            constraints:
                              type: array
                              items:
                                title: Action Log Constraints
                                type: object
                                required:
                                - field
                                anyOf:
                                - title: String (Equals, Not Equals) Constraints
                                  required:
                                  - operator
                                  - value
                                  properties:
                                    field:
                                      type: string
                                      oneOf:
                                      - title: Action Log String Fields
                                        type: string
                                        enum:
                                        - account_name
                                        - user_name
                                        - user_email
                                        - user_mode
                                        - resource_name
                                        - affected_property_names
                                      - title: Action Log Enum String Fields
                                        type: string
                                        enum:
                                        - action_type
                                        - action_source
                                        - resource_type
                                      - title: Action Log UID String Fields
                                        type: string
                                        enum:
                                        - document_id
                                        - resource_id
                                        - account_id
                                        - parent_account_id
                                        - machine_id
                                        - user_id
                                      - title: Action Log IP Fields
                                        type: string
                                        enum:
                                        - ip_address
                                    operator:
                                      type: string
                                      description: Operator to apply to the constraint
                                      enum:
                                      - equals
                                      - not_equals
                                    value:
                                      type:
                                      - string
                                      - array
                                      title: Value to search
                                      items:
                                        type: string
                                  if:
                                    properties:
                                      field:
                                        title: Action Log UID String Fields
                                        type: string
                                        enum:
                                        - document_id
                                        - resource_id
                                        - account_id
                                        - parent_account_id
                                        - machine_id
                                        - user_id
                                  then:
                                    properties:
                                      value:
                                        type:
                                        - string
                                        - array
                                        format: uuid
                                        items:
                                          type: string
                                          format: uuid
                                - title: String (Contains, Not Contains) Constraints
                                  required:
                                  - operator
                                  - value
                                  properties:
                                    field:
                                      type: string
                                      oneOf:
                                      - title: Action Log String Fields
                                        type: string
                                        enum:
                                        - account_name
                                        - user_name
                                        - user_email
                                        - user_mode
                                        - resource_name
                                        - affected_property_names
                                    operator:
                                      type: string
                                      description: Operator to apply to the constraint
                                      enum:
                                      - contains
                                      - not_contains
                                    value:
                                      type:
                                      - string
                                      - array
                                      title: Value to search
                                      items:
                                        type: string
                                - title: Date (start, end) Constraints
                                  properties:
                                    field:
                                      oneOf:
                                      - title: Action Log Date Fields
                                        type: string
                                        enum:
                                        - logged_at
                                  oneOf:
                                  - minProperties: 1
                                    title: Specify Date Range
                                    not:
                                      anyOf:
                                      - required:
                                        - operator
                                      - required:
                                        - value
                                    properties:
                                      start:
                                        type: string
                                        format: date-time
                                        title: Start Date
                                      end:
                                        type: string
                                        format: date-time
                                        title: End Date
                                  - title: Specify Exact Date
                                    not:
                                      anyOf:
                                      - required:
                                        - start
                                      - required:
                                        - end
                                    required:
                                    - operator
                                    - value
                                    properties:
                                      operator:
                                        type: string
                                        enum:
                                        - equals
                                      value:
                                        type:
                                        - string
                                        - array
                                        format: date-time
                                        title: Value to search
                                        items:
                                          format: date-time
                                - title: IP Constraints
           

# --- truncated at 32 KB (3653 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-grid-api-openapi.yml