Malwarebytes

Malwarebytes Grid API

# Grid Introduction Using the following API, you can search endpoints, detections, software inventory, vulnerabilities, rid rules, os-patches, device control events and dns logs. This API allows to perform filtering, sorting, grouping and aggregating of data by specifying constraints based on the field type. Available constraints for searching based on value type | Value Type | Constraints | | --- |----| | Simple String | equals, not_equals, contains, not_contains | | String (with enum) | equals, not_equals | | String/UUID (entity reference) | equals, not_equals | | Version | equals, not_equals | | Number | gt, lt, gte, lte | | Timestamp | start, end | | IP | ip | | Boolean | equals, not_equals | Grid API also supports compound constraints that can be constructed with the keywords **allOf**, **anyOf**, **noneOf** Example of compound constraint: ```json { "constraints": [ { "allOf": [ { "field": "agent.host_name", "operator": "contains", "value": "a" }, { "field": "machine.is_deleted", "operator": "equals", "value": false }, { "anyOf": [ { "field": "agent.os_info.os_platform", "operator": "equals", "value": "Linux" }, { "field": "agent.os_info.os_platform", "operator": "equals", "value": "MacOS" } ] } ] } ] } ``` In this example all the records that contain **a** in the ***agent.host_name***, have ***machine.is_deleted*** set to false and whose ***os_platform*** is equal to **either** ***Linux*** or ***MacOS*** will be returned.

GitHub OpenAPI

Operations 112

POST /nebula/v1/grid/action-logs/export Export action logs #
POST /nebula/v1/grid/action-logs/export/async Export action logs asynchronously #
POST /nebula/v1/grid/action-logs/search Search action logs #
POST /nebula/v1/grid/action-logs/search-groupby Search grouped action logs #
POST /nebula/v1/grid/ai-domains/export Export AI domain activity #
POST /nebula/v1/grid/ai-domains/export/async Export AI domain activity (async) #
POST /nebula/v1/grid/ai-domains/search Search AI domain activity #
POST /nebula/v1/grid/ai-domains/search-groupby Group-by AI domain activity #
POST /nebula/v1/grid/assets/software/export Export software assets #
POST /nebula/v1/grid/assets/software/export/async Export software assets asynchronously #
POST /nebula/v1/grid/assets/software/search Search software assets #
POST /nebula/v1/grid/assets/software/search-groupby Search grouped software assets #
POST /nebula/v1/grid/cve/export Export CVEs #
POST /nebula/v1/grid/cve/export/async Export CVEs asynchronously #
POST /nebula/v1/grid/cve/search Search CVEs #
POST /nebula/v1/grid/cve/search-groupby Search grouped CVEs #
POST /nebula/v1/grid/cve/events/export Export historical CVEs #
POST /nebula/v1/grid/cve/events/search Search historical CVEs #
POST /nebula/v1/grid/cve/events/search-groupby Search grouped historical CVEs #
POST /nebula/v1/grid/detections/export Export detections #
POST /nebula/v1/grid/detections/export/async Export detections asynchronously #
POST /nebula/v1/grid/detections/search Search detections #
POST /nebula/v1/grid/detections/search-groupby Search grouped detections #
POST /nebula/v1/grid/device-control/export Export device control events #
POST /nebula/v1/grid/device-control/export/async Export device control events asynchronously #
POST /nebula/v1/grid/device-control/search Search device control events #
POST /nebula/v1/grid/device-control/search-groupby Search grouped device control events #
POST /nebula/v1/grid/dns/export Export DNS activity #
POST /nebula/v1/grid/dns/export/async Export DNS activity asynchronously #
POST /nebula/v1/grid/dns/search Search DNS activity #
POST /nebula/v1/grid/dns/search-groupby Search grouped DNS activity #
POST /nebula/v1/grid/endpoints/export/async Export endpoints asynchronously #
POST /nebula/v1/grid/endpoints/export Export endpoints #
POST /nebula/v1/grid/endpoints/search Search endpoints #
POST /nebula/v1/grid/endpoints/search-groupby Search grouped endpoints #
POST /nebula/v1/grid/events/export Export events #
POST /nebula/v1/grid/events/export/async Export events asynchronously #
POST /nebula/v1/grid/events/search Search events #
POST /nebula/v1/grid/events/search-groupby Search events groupby #
POST /nebula/v1/grid/firewall/export Export firewall activity #
POST /nebula/v1/grid/firewall/search Search firewall activity #
POST /nebula/v1/grid/firewall/search-groupby Search grouped firewall activity #
POST /nebula/v1/grid/jobs/bulk Issue jobs #
POST /nebula/v1/grid/os-patches/export Export OS Patches #
POST /nebula/v1/grid/os-patches/export/async Export OS Patches asynchronously #
POST /nebula/v1/grid/os-patches/search Search OS Patches #
POST /nebula/v1/grid/os-patches/search-groupby Search grouped OS Patches #
POST /nebula/v1/grid/rid/export Export RID rules #
POST /nebula/v1/grid/rid/export/async Export RID rules asynchronously #
POST /nebula/v1/grid/rid/search Search RID rules #
POST /nebula/v1/grid/rid/search-groupby Search grouped RID rules #
POST /nebula/v1/grid/xdr-alerts/export Export XDR Alerts #
POST /nebula/v1/grid/xdr-alerts/export/async Export XDR Alerts asynchronously #
POST /nebula/v1/grid/xdr-alerts/search Search XDR Alerts #
POST /nebula/v1/grid/xdr-alerts/search-groupby Search grouped XDR Alerts #
POST /oneview/v1/grid/action-logs/export Export action logs #
POST /oneview/v1/grid/action-logs/export/async Export action logs asynchronously #
POST /oneview/v1/grid/action-logs/search Search action logs #
POST /oneview/v1/grid/action-logs/search-groupby Search grouped action logs #
POST /oneview/v1/grid/ai-domains/export Placeholder. Please extend this #
POST /oneview/v1/grid/ai-domains/export/async Placeholder. Please extend this #
POST /oneview/v1/grid/ai-domains/search Placeholder. Please extend this #
POST /oneview/v1/grid/ai-domains/search-groupby Placeholder. Please extend this #
POST /oneview/v1/grid/assets/software/export Export software assets #
POST /oneview/v1/grid/assets/software/export/async Export software assets asynchronously #
POST /oneview/v1/grid/assets/software/search Search software assets #
POST /oneview/v1/grid/assets/software/search-groupby Search grouped software assets #
POST /oneview/v1/grid/cve/export Export CVEs #
POST /oneview/v1/grid/cve/export/async Export CVEs asynchronously #
POST /oneview/v1/grid/cve/search Search CVEs #
POST /oneview/v1/grid/cve/search-groupby Search grouped CVEs #
POST /oneview/v1/grid/cve/events/export Placeholder. Please extend this #
POST /oneview/v1/grid/cve/events/search Placeholder. Please extend this #
POST /oneview/v1/grid/cve/events/search-groupby Placeholder. Please extend this #
POST /oneview/v1/grid/detections/export Export detections #
POST /oneview/v1/grid/detections/export/async Export detections asynchronously #
POST /oneview/v1/grid/detections/search Search detections #
POST /oneview/v1/grid/detections/search-groupby Search grouped detections #
POST /oneview/v1/grid/device-control/export Export device control events #
POST /oneview/v1/grid/device-control/export/async Export device control events asynchronously #
POST /oneview/v1/grid/device-control/search Search device control events #
POST /oneview/v1/grid/device-control/search-groupby Search grouped device control events #
POST /oneview/v1/grid/dns/export Export DNS activity #
POST /oneview/v1/grid/dns/export.async Export DNS activity asynchronously #
POST /oneview/v1/grid/dns/search Search DNS activity #
POST /oneview/v1/grid/dns/search-groupby Search grouped DNS activity #
DELETE /oneview/v1/grid/endpoints Delete endpoints across accounts #
POST /oneview/v1/grid/endpoints/export Export endpoints #
POST /oneview/v1/grid/endpoints/export/async Export endpoints asynchronously #
POST /oneview/v1/grid/endpoints/search Search endpoints #
POST /oneview/v1/grid/endpoints/search-groupby Search grouped endpoints #
POST /oneview/v1/grid/events/export Export events #
POST /oneview/v1/grid/events/export/async Export events asynchronously #
POST /oneview/v1/grid/events/search Search events #
POST /oneview/v1/grid/events/search-groupby Search events groupby #
POST /oneview/v1/grid/firewall/export Export firewall activity #
POST /oneview/v1/grid/firewall/search Search firewall activity #
POST /oneview/v1/grid/firewall/search-groupby Search grouped firewall activity #
POST /oneview/v1/grid/groups/{id}/machines Move endpoints between groups across accounts #
POST /oneview/v1/grid/jobs/bulk Issue jobs to endpoints across accounts #
POST /oneview/v1/grid/os-patches/export Export OS Patches #
POST /oneview/v1/grid/os-patches/export/async Export OS Patches asynchronously #
POST /oneview/v1/grid/os-patches/search Search OS Patches #
POST /oneview/v1/grid/os-patches/search-groupby Search grouped OS Patches #
POST /oneview/v1/grid/rid/export Export RID rules #
POST /oneview/v1/grid/rid/export/async Export RID rules async #
POST /oneview/v1/grid/rid/search Search RID rules #
POST /oneview/v1/grid/rid/search-groupby Search grouped RID rules #
POST /oneview/v1/grid/xdr-alerts/export Export XDR Alerts #
POST /oneview/v1/grid/xdr-alerts/export/async Export XDR Alerts asynchronously #
POST /oneview/v1/grid/xdr-alerts/search Search XDR Alerts #
POST /oneview/v1/grid/xdr-alerts/search-groupby Search grouped XDR Alerts #

Documentation

📖
Documentation
https://api.threatdown.com/nebula/v1/docs
📖
APIReference
https://api.threatdown.com/nebula/v1/docs
📖
Documentation
https://cloud.malwarebytes.com/api/v2/oneview/docs

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-grid-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/malwarebytes-grid-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

malwarebytes-grid-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Malwarebytes Grid API
  version: 1.0.0
  x-logo:
    altText: ThreatDown logo
    url: https://assets.threatdown.com/hermes/ThreatDown_Horizontal_Navy.png
    backgroundColor: '#FFFFFF'
  description: 'Operations tagged Grid across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:


# --- truncated at 32 KB (3650 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-grid-api-openapi.yml