Malwarebytes Notifications API

openapi: 3.2.0
info:
  title: Malwarebytes Notifications API
  version: 1.0.0
  description: 'Operations tagged Notifications across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Notifications
  description: 'This API offers a powerful tool to create notification subscriptions. There are different categories of notifications,

    for each category different constraints and output fields can be specified. Please see the documentation below for the

    category descriptions.


    Notifications can be delivered by email or webhooks. In both cases, it''s possible to choose the output fields, but the

    value could be different for the two methods. In the email, some values are mapped to friendly names, as in the Nebula

    Console. For webhooks the values are the raw level ones. Here''s a list of the mapped values.


    | Output field | Email values                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Webhook values                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |

    |--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

    | role         | Super Admin<br>Admin<br>Read Only User                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | SuperAdmin<br>Admin<br>ReadOnlyUser                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |

    | os_platform  | Windows<br>MacOS<br>Linux                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | 1<br>2<br>3                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |

    | category     | Malware<br>PUP<br>PUM<br>Exploit<br>Ransomware<br>Remote<br>Website<br>Vulnerable Driver                                                                                                                                                                                                                                                                                                                                                                                                                                              | MALWARE<br>PUP<br>PUM<br>AE<br>ARW<br>RID<br>MWAC<br>VULNERABLE_DRIVER                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |

    | status       | Blocked<br>Found<br>Quarantined<br>Deleted<br>Restored                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | blocked<br>found<br>quarantined<br>deleted<br>restored                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |

    | threat_name  | Malicious Website                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | web                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |

    | command      | Scan<br>Restart<br>Restart<br>Remediate<br>Isolate<br>Remove isolation<br>Refresh Endpoint & Software Info<br>Check for protection updates<br>Check for software updates<br>Install software updates<br>Generate diagnostic logs<br>Delete active block rule<br>Upload file for analysis<br>Remove endpoint isolation<br>Isolate<br>Remediated endpoint<br>Endpoint logging level changed<br>Delete from quarantine<br>Restore from quarantine<br>Refresh policy<br>Apply OS Patch<br>Update Installed Software<br>Uninstall Software | command.threat.scan<br>command.service.restart<br>command.asset.reboot<br>command.threat.scan.remediate<br>command.edr.isolation<br>command.edr.unlock<br>command.asset.refresh<br>command.protection.update.now<br>command.machine.update.now<br>command.machine.plugin.updateparts<br>command.service.diag<br>command.bfp.rules.delete<br>command.edr.fileupload<br>command.edr.unlock.force<br>command.edr.lock<br>command.sequence.remediate<br>command.logging.level.set<br>command.threat.quarantine.remove<br>command.threat.quarantine.restore<br>command.policy.refresh<br>command.asset.patch<br>command.asset.updatesoftware<br>command.asset.uninstallsoftware |

    '
paths:
  /nebula/v1/notifications/subscriptions/change-owner:
    servers:
    - url: https://api.threatdown.com
    put:
      description: Change notification owner.
      summary: Change notification owner
      security:
      - client_credentials:
        - write
      - user_permissions:
        - notifications.editOthers
      status:
        outage:
        - auth
        - webhooks_subscriptions
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: change notification owner request
              required:
              - subscriptions
              - owner
              properties:
                subscriptions:
                  type: array
                  minLength: 1
                  items:
                    type: string
                    title: notification ID
                    pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
                owner:
                  title: the new owner of the subscription
                  type: string
      responses:
        '202':
          description: response schema
          content:
            application/json: {}
      tags:
      - Notifications
      operationId: api.v2.nebula.change-owner.notification
  /nebula/v1/notifications/subscriptions:
    servers:
    - url: https://api.threatdown.com
    post:
      description: Create notification subscription.
      summary: Create notification
      security:
      - client_credentials:
        - write
      - user_permissions:
        - notifications.createOwn
      status:
        outage:
        - auth
        - webhooks_subscriptions
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: The create notification Body
              required:
              - name
              - category
              - delivery
              properties:
                name:
                  title: Notification name. Must be unique
                  type: string
                description:
                  title: Notification description
                  type: string
                  default: ''
                category:
                  title: The category of the events to be notified
                  type: string
                delivery: {}
                conditions:
                  title: Filters the events that will be notified. It depends on category
                  type: object
                aggregation:
                  title: Aggregate multiple events in a single notifications
                  type: object
                  properties:
                    interval:
                      title: Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation
                      type: integer
                      minimum: 10
                      maximum: 86400
                enabled:
                  title: enable/disable notification
                  type: boolean
                  default: true
                owner:
                  title: the identifier of the owner of the subscription. Not available for read-only users
                  type: string
              anyOf:
              - title: Detections
                properties:
                  category:
                    enum:
                    - threat_detections
                  delivery:
                    anyOf:
                    - allOf:
                      - title: Notification delivery schema
                        type: object
                        required:
                        - type
                        anyOf:
                        - title: Webhook delivery
                          required:
                          - url
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - webhook
                            url:
                              title: Webhook url
                              type: string
                              format: uri
                            custom_headers:
                              title: Custom headers that will be included in the request
                              type: object
                              additionalProperties:
                                type: string
                            max_retries:
                              title: Maximum number of retries if the delivery is not successful
                              type: number
                            secret_token:
                              title: The secret token that will be used to sign the message
                              type: string
                        - title: Email delivery
                          required:
                          - recipients
                          - subject
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - email
                            recipients:
                              title: Recipients list
                              type: array
                              minItems: 1
                              items:
                                type: string
                                format: email
                            subject:
                              title: The subject of the email
                              type: string
                            display_table:
                              title: Display table with the records in the email (only for aggregated notifications)
                              type: boolean
                        - title: Slack delivery
                          required:
                          - channels
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - slack
                            channels:
                              title: Slack channels list
                              type: array
                              minItems: 1
                              items:
                                type: string
                        - title: MS Teams delivery
                          required:
                          - conversations
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - teams
                            conversations:
                              title: MS Teams conversations IDs
                              type: array
                              minItems: 1
                              items:
                                type: string
                        - title: Mobile push notification delivery
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - mobile
                      - properties:
                          output_fields:
                            title: Detections output fields
                            type: array
                            minItems: 1
                            items:
                              type: string
                              enum:
                              - account_id
                              - account_name
                              - os_release_name
                              - os_platform
                              - os_type
                              - os_version
                              - category
                              - type
                              - path
                              - status
                              - scanned_at
                              - reported_at
                              - resource_created_at
                              - resource_modified_at
                              - threat_name
                              - affected_application
                              - process_name
                              - machine_id
                              - machine_name
                              - machine_ip
                              - group_id
                              - group_name
                              - policy_id
                              - policy_name
                              - nics
                              - md5
                              - sha256
                              - engine_version
                              - last_user
                              - active_directory_ou
                              - id
                    - type: array
                      items:
                        title: Notification delivery schema
                        type: object
                        required:
                        - type
                        anyOf:
                        - title: Webhook delivery
                          required:
                          - url
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - webhook
                            url:
                              title: Webhook url
                              type: string
                              format: uri
                            custom_headers:
                              title: Custom headers that will be included in the request
                              type: object
                              additionalProperties:
                                type: string
                            max_retries:
                              title: Maximum number of retries if the delivery is not successful
                              type: number
                            secret_token:
                              title: The secret token that will be used to sign the message
                              type: string
                        - title: Email delivery
                          required:
                          - recipients
                          - subject
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - email
                            recipients:
                              title: Recipients list
                              type: array
                              minItems: 1
                              items:
                                type: string
                                format: email
                            subject:
                              title: The subject of the email
                              type: string
                            display_table:
                              title: Display table with the records in the email (only for aggregated notifications)
                              type: boolean
                        - title: Slack delivery
                          required:
                          - channels
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - slack
                            channels:
                              title: Slack channels list
                              type: array
                              minItems: 1
                              items:
                                type: string
                        - title: MS Teams delivery
                          required:
                          - conversations
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - teams
                            conversations:
                              title: MS Teams conversations IDs
                              type: array
                              minItems: 1
                              items:
                                type: string
                        - title: Mobile push notification delivery
                          properties:
                            type:
                              title: Delivery method
                              type: string
                              enum:
                              - mobile
                  output_fields:
                    title: Detections output fields
                    type: array
                    minItems: 1
                    items:
                      type: string
                      enum:
                      - account_id
                      - account_name
                      - os_release_name
                      - os_platform
                      - os_type
                      - os_version
                      - category
                      - type
                      - path
                      - status
                      - scanned_at
                      - reported_at
                      - resource_created_at
                      - resource_modified_at
                      - threat_name
                      - affected_application
                      - process_name
                      - machine_id
                      - machine_name
                      - machine_ip
                      - group_id
                      - group_name
                      - policy_id
                      - policy_name
                      - nics
                      - md5
                      - sha256
                      - engine_version
                      - last_user
                      - active_directory_ou
                      - id
                  aggregation:
                    properties:
                      group_by:
                        type: array
                        title: If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value
                        items:
                          type: string
                          enum:
                          - account_id
                          - account_name
                          - affected_application
                          - category
                          - group_id
                          - group_name
                          - machine_id
                          - machine_ip
                          - machine_name
                          - os_platform
                          - os_release_name
                          - path
                          - policy_id
                          - policy_name
                          - process_name
                          - status
                          - threat_name
                          - type
                  conditions:
                    type: object
                    additionalProperties: false
                    properties:
                      or:
                        type: array
                        minItems: 1
                        items:
                          type: object
                          additionalProperties: false
                          properties:
                            and:
                              type: array
                              minItems: 1
                              items:
                                type: object
                                additionalProperties: false
                                properties:
                                  eq:
                                    type: array
                                    anyOf:
                                    - title: '0: "category". 1: "MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"'
                                      items:
                                      - const: category
                                      additionalItems:
                                        title: Filter events by detection category
                                        type: string
                                        enum:
                                        - MALWARE
                                        - PUP
                                        - PUM
                                        - AE
                                        - ARW
                                        - MWAC
                                        - RID
                                        - VULNERABLE_DRIVER
                                    - title: '0: "action". 1: "blocked", "deleted", "deletedAutoPrune", "found", "quarantined", "restored"'
                                      items:
                                      - const: action
                                      additionalItems:
                                        title: Filter events by action
                                        type: string
                                        enum:
                                        - blocked
                                        - deleted
                                        - deletedAutoPrune
                                        - found
                                        - quarantined
                                        - restored
                                    - title: '0: "threat_name". 1: string'
                                      items:
                                      - const: threat_name
                                      additionalItems:
                                        title: Filter events by threat_name
                                        type: string
                                    - title: '0: "os_platform". 1: "1"(Windows), "2"(MacOS), "3"(Linux), "4"(Android), "3"(IOS), "3"(ChromeOS)'
                                      items:
                                      - const: os_platform
                                      additionalItems:
                                        title: Filter events by OS platform
                                        type: number
                                        enum:
                                        - 1
                                        - 2
                                        - 3
                                        - 4
                                        - 5
                                        - 6
                                    - title: '0: "rtp". 1: true, false'
                                      items:
                                      - const: rtp
                                      - title: Filter events by real time protection
                                      additionalItems: false
                                      if:
                                        items:
                                        - const: rtp
                                      then:
                                        items:
                                        - const: rtp
                                        - type: boolean
                                    - title: '0: "type". 1: "application", "exploit", "extension", "file", "folder", "InboundConnection", "module", "OutboundConnection", "process", "reg_key", "reg_value"'
                                      items:
                                      - const: type
                                      additionalItems:
                                        title: Filter events by type
                                        type: string
                                        enum:
                                        - application
                                        - exploit
                                        - extension
                                        - file
                                        - folder
                                        - InboundConnection
                                        - module
                                        - OutboundConnection
                                        - process
                                        - reg_key
                                        - reg_value
                                    - title: '0: "machine_id". 1: string'
                                      items:
                                      - const: machine_id
                                      additionalItems:
              

# --- truncated at 32 KB (10052 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-notifications-api-openapi.yml