Malwarebytes MDR API
The MDR API from Malwarebytes — 2 operation(s) for mdr.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes MDR API
version: 1.0.0
description: 'Operations tagged MDR across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: MDR
paths:
/nebula/v1/mdr/config:
servers:
- url: https://api.threatdown.com
post:
description: Configure managed service (MDR/MTH/MXDR) settings
summary: Configure managed settings
security:
- client_credentials:
- write
- user_permissions:
- mss.manage
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: MDR configuration object
additionalProperties: true
properties:
primary_contact:
type: object
properties:
user_id:
type: string
title: User ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
phone:
type: string
title: Phone number
email:
type: string
title: Email
secondary_contact:
type:
- object
- 'null'
properties:
user_id:
type: string
title: User ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
phone:
type: string
title: Phone number
email:
type: string
title: Email
tertiary_contact:
type:
- object
- 'null'
properties:
user_id:
type: string
title: User ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
phone:
type: string
title: Phone number
email:
type: string
title: Email
endpoint_isolation:
title: Endpoint isolation
type: boolean
identity_response_authorization:
type: object
title: Identity response authorization
properties:
mode:
type: string
enum:
- full
- partial
- 'no'
config:
type: object
properties:
disable_identity:
type: boolean
reset_password:
type: boolean
force_password_update:
type: boolean
revoke_session:
type: boolean
remove_identity_from_groups:
type: boolean
enforce_mfa:
type: boolean
additional_recipients:
type:
- array
- 'null'
title: Additional recipients
items:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
collaboration_method:
title: Collaboration method
type: string
enum:
- Do it for me
- Notify only
- Collaborate
- MTH / Managed Threat Hunting
- XDR
is_trial:
title: Is trial
type: boolean
responses:
'200':
description: Successful response
tags:
- MDR
operationId: api.nebula.mdr.config.post
get:
description: Get managed service (MDR/MTH/MXDR) settings
summary: Get managed settings
security:
- client_credentials:
- read
- user_permissions:
- mss.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: MDR configuration object
additionalProperties: true
properties:
primary_contact:
type: object
properties:
user_id:
type: string
title: User ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
phone:
type: string
title: Phone number
email:
type: string
title: Email
secondary_contact:
type:
- object
- 'null'
properties:
user_id:
type: string
title: User ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
phone:
type: string
title: Phone number
email:
type: string
title: Email
tertiary_contact:
type:
- object
- 'null'
properties:
user_id:
type: string
title: User ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
phone:
type: string
title: Phone number
email:
type: string
title: Email
endpoint_isolation:
title: Endpoint isolation
type: boolean
identity_response_authorization:
type: object
title: Identity response authorization
properties:
mode:
type: string
enum:
- full
- partial
- 'no'
config:
type: object
properties:
disable_identity:
type: boolean
reset_password:
type: boolean
force_password_update:
type: boolean
revoke_session:
type: boolean
remove_identity_from_groups:
type: boolean
enforce_mfa:
type: boolean
additional_recipients:
type:
- array
- 'null'
title: Additional recipients
items:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
collaboration_method:
title: Collaboration method
type: string
enum:
- Do it for me
- Notify only
- Collaborate
- MTH / Managed Threat Hunting
- XDR
is_trial:
title: Is trial
type: boolean
tags:
- MDR
operationId: api.nebula.mdr.config.get
/oneview/v1/sites/{id}/mdr:
servers:
- url: https://api.threatdown.com
get:
description: Get a site's MDR settings
summary: Get site MDR settings
security:
- client_credentials:
- read
- user_permissions:
- mss.view
status:
outage:
- auth
- ov
parameters:
- name: id
required: true
in: path
description: Valid OneView site ID (Ex. "30616562663436302D643733312D346238622D623338332D613031343538363566383333")
schema:
type: string
pattern: ^[A-Fa-f0-9]+$
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: object
title: MDR site configuration payload
description: Response payload for fetching MDR site configuration
examples:
- mdrEnabled: true
primaryContactId: '6263666230393563383834616534303833376361633835336465653132643431'
primaryContactPhone: (111) 111 - 5555
endpointIsolation: true
isTrial: false
consent: true
remediationType: DoItForMe
product: mdr
required:
- mdrEnabled
properties:
mdrEnabled:
type: boolean
title: MDR enabled
description: Enable or disable mdr environment.
examples:
- true
- false
primaryContactId:
type: string
title: MDR Primary Contact Id
description: The id of primary contact for an MDR environment.
examples:
- '6263666230393563383834616534303833376361633835336465653132643431'
primaryContactPhone:
type: string
title: Primary Contact Phone number
description: The phone number of the primary contact.
examples:
- (111) 111 - 5555
endpointIsolation:
type: boolean
title: Endpoint Isolation
description: Allow MDR Analysts to isolate a suspected infected endpoint.
examples:
- true
- false
isTrial:
type: boolean
title: Is the subscription for the site a trial or paid.
description: Is the environment a trial environment.
examples:
- true
- false
consent:
type: boolean
title: Accept Managed Services agreement
description: https://www.threatdown.com/legal/managed-services-agreement/.
examples:
- true
- false
remediationType:
type: string
title: Remediation Type
description: The type of remediation for the site.
examples:
- DoItForMe
- Collaborate
- NotifyOnly
- MTH / Managed Threat Hunting
product:
type: string
title: Product Type
description: The type of MDR product associated with the site.
examples:
- mdr
- mth
tags:
- MDR
operationId: api.v2.oneview.get.mdr.siteconfig.id
post:
description: Set a site's MDR settings
summary: Set site MDR settings
security:
- client_credentials:
- read
- user_permissions:
- mss.manage
status:
outage:
- auth
- ov
parameters:
- name: id
required: true
in: path
description: Valid OneView site ID (Ex. "30616562663436302D643733312D346238622D623338332D613031343538363566383333")
schema:
type: string
pattern: ^[A-Fa-f0-9]+$
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: object
title: MDR configuration request payload
description: Payload for setting MDR configuration for a given site
examples:
- primaryContactId: '6263666230393563383834616534303833376361633835336465653132643431'
primaryContactPhone: (111) 111 - 1111
mdrEnabled: true
consent: true
remediationType: NotifyOnly
product: mdr
endpointIsolation: false
- primaryContactId: '6263666230393563383834616534303833376361633835336465653132643431'
primaryContactPhone: (111) 111 - 1111
secondaryContact: '6263666230393563383834616534303833376361633835336465653132643431'
secondaryContactPhone: (222) 222 - 2222
tertiaryContact: null
tertiaryContactPhone: null
mdrEnabled: true
consent: true
remediationType: NotifyOnly
product: mdr
endpointIsolation: true
required:
- primaryContactId
- primaryContactPhone
- mdrEnabled
- region
- consent
- remediationType
- product
- endpointIsolation
properties:
primaryContactId:
type: string
title: Primary contact Id
description: Id of primary contact.
examples:
- '6263666230393563383834616534303833376361633835336465653132643431'
primaryContactPhone:
type: string
title: Primary contact phone number
description: Phone number of the primary contact.
examples:
- (111) 111 - 1111
secondaryContactId:
type: string
title: Secondary contact Id
description: Id of secondary contact.
examples:
- '6263666230393563383834616534303833376361633835336465653132643431'
secondaryContactPhone:
type: string
title: Secondary contact phone number
description: Phone number of the secondary contact.
examples:
- (222) 222 - 2222
tertiaryContactId:
type: string
title: Tertiary contact Id
description: Id of tertiary contact.
examples:
- '6263666230393563383834616534303833376361633835336465653132643431'
tertiaryContactPhone:
type: string
title: Tertiary contact phone number
description: Phone number of the tertiary contact.
examples:
- (333) 333 - 3333
mdrEnabled:
type: boolean
title: MDR enabled
description: MDR is enabled or disabled for a given site.
default: true
examples:
- true
- false
region:
type: string
title: MDR environment region
description: Region where MDR environment is. Select emea for GDPR compliance
examples:
- emea
- americas
- sec_ops
enum:
- emea
- americas
- sec_ops
consent:
type: boolean
title: Consent
description: Set to true to give consent to MDR analysts. Setting to false will not allow us to manage your endpoints
default: true
examples:
- true
- false
remediationType:
type: string
title: Remediation type
description: Set the type of remediation for a given site.
default: DoItForMe
examples:
- DoItForMe
- Collaborate
- NotifyOnly
enum:
- DoItForMe
- Collaborate
- NotifyOnly
product:
type: string
title: Product type
description: Set the product type, MDR or Managed Threat Hunting (MTH)
default: mdr
examples:
- mdr
- mth
enum:
- mdr
- mth
endpointIsolation:
type: boolean
title: Endpoint Isolation
description: Allow our MDR analysts to isolate an endpoint upon suspicious activity.
default: true
examples:
- true
- false
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: object
title: MDR site configuration payload
description: Response payload for fetching MDR site configuration
examples:
- mdrEnabled: true
primaryContactId: '6263666230393563383834616534303833376361633835336465653132643431'
primaryContactPhone: (111) 111 - 5555
endpointIsolation: true
isTrial: false
consent: true
remediationType: DoItForMe
product: mdr
required:
- mdrEnabled
properties:
mdrEnabled:
type: boolean
title: MDR enabled
description: Enable or disable mdr environment.
examples:
- true
- false
primaryContactId:
type: string
title: MDR Primary Contact Id
description: The id of primary contact for an MDR environment.
examples:
- '6263666230393563383834616534303833376361633835336465653132643431'
primaryContactPhone:
type: string
title: Primary Contact Phone number
description: The phone number of the primary contact.
examples:
- (111) 111 - 5555
endpointIsolation:
type: boolean
title: Endpoint Isolation
description: Allow MDR Analysts to isolate a suspected infected endpoint.
examples:
- true
- false
isTrial:
type: boolean
title: Is the subscription for the site a trial or paid.
description: Is the environment a trial environment.
examples:
- true
- false
consent:
type: boolean
title: Accept Managed Services agreement
description: https://www.threatdown.com/legal/managed-services-agreement/.
examples:
- true
- false
remediationType:
type: string
title: Remediation Type
description: The type of remediation for the site.
examples:
- DoItForMe
- Collaborate
- NotifyOnly
- MTH / Managed Threat Hunting
product:
type: string
title: Product Type
description: The type of MDR product associated with the site.
examples:
- mdr
- mth
tags:
- MDR
operationId: api.v2.oneview.post.mdr.siteconfig.id
components:
securitySchemes:
client_credentials:
type: oauth2
flows:
clientCredentials:
tokenUrl: /token
scopes:
read: Read data of your Nebula account
write: Write data, such as groups, policies, exclusions. Create Webhook subscriptions
execute: Issue jobs on your endpoints, like Scan, Reboot or Isolate.
user_permissions:
type: http
scheme: bearer
x-refined-from:
- malwarebytes-threatdown-nebula-openapi.json
- malwarebytes-threatdown-oneview-openapi.json