A policy is a set of configurations that determine how the endpoint agent monitors your endpoints, such as protection and scan settings. Once a policy has been created, it needs to be assigned to a group in order to take affect. Endpoints will use the policy assigned to the group they belong to.
openapi: 3.2.0
info:
title: Malwarebytes Policies API
version: 1.0.0
description: 'Operations tagged Policies across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Policies
description: A policy is a set of configurations that determine how the endpoint agent monitors your endpoints, such as protection and scan settings. Once a policy has been created, it needs to be assigned to a group in order to take affect. Endpoints will use the policy assigned to the group they belong to.
paths:
/nebula/v1/policies/{id}:
servers:
- url: https://api.threatdown.com
delete:
description: Delete policy.
summary: Delete policy
security:
- client_credentials:
- write
- user_permissions:
- policies.delete
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
responses:
'200':
description: Successful response
tags:
- Policies
operationId: api.nebula.delete.policy
get:
description: Get policy by id.
summary: Get policy by id
security:
- client_credentials:
- read
- user_permissions:
- policies.view
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: populate
required: false
in: query
schema:
type: string
pattern: ^(groups|exclusions)([,](groups|exclusions))*$
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
additionalProperties: true
title: Policy
properties:
id:
type: string
title: Id
examples:
- 3606af9f-f539-426c-be76-6f9bc18531e2
account_id:
type: string
title: Account id
examples:
- 1b8d7513-3336-45fe-8d6f-db43bc9c9613
etag:
type: string
title: Etag
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.
examples:
- 4d3ae3923cca7cf30bd712f4d8188bb9
name:
type: string
title: Name
examples:
- Default Policy
expire_endpoints:
type:
- number
- 'null'
title: Expire endpoints
examples:
- 230
contents:
type: object
title: Policy Contents
created_at:
type: string
title: Policy created at
examples:
- '2020-02-13T17:09:20.741145Z'
updated_at:
type: string
title: Policy updated at
examples:
- '2020-02-13T17:09:22.532969Z'
migrated_at:
type: string
title: Policy migrated at
examples:
- '2020-02-13T17:09:22.532969Z'
is_default:
type: boolean
title: Is default
deny_edit:
type: boolean
title: Deny edit
groups:
type: array
title: Groups
items:
type: object
title: Group
additionalProperties: true
properties:
id:
type: string
title: The Id of the group
account_id:
type: string
title: The account id to which this group belong
name:
type: string
title: The neame of the group
machines_count:
type: integer
title: Count of machines
policy_id:
type: string
title: Policy id associated to the group
policy_name:
type: string
title: Policy name
updated_at:
type: string
title: Updated at
examples:
- '2017-04-06T20:26:07.345213Z'
is_default:
type: boolean
title: Default
schedule_ids:
type: array
title: Array of schedule ids
items:
type: string
title: Schedule Id
parent_id:
type: string
title: Parent id
root_id:
type: string
title: Root id
ou_object_id:
type:
- string
- 'null'
title: Ou object id
child_group_count:
type: integer
title: Child group count
exclusions:
type: array
title: Exclusions
items:
title: Exclusion from server
type: object
additionalProperties: true
properties:
id:
type: string
title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
etag:
type: string
title: Etag
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.
examples:
- c87998228b2f7511bb1616f686d06bae
type:
type: integer
title: '1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line'
examples:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 13
- 14
- 17
value:
type: string
title: String value
examples:
- '%PROGRAMDATA%'
enabled:
type: boolean
title: Enable
comment:
type: string
title: Comment
created_at:
type: string
title: Created at
updated_at:
type: string
title: Updated at
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
exclude_from:
type: object
title: Exclusion applied to
properties:
exploit_protection:
type:
- boolean
- 'null'
title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
malware_protection:
type:
- boolean
- 'null'
title: Protects against malware infections and zero-day threats
ransomware_protection:
type:
- boolean
- 'null'
title: Detects and blocks ransomware threats using advanced behavior analysis
suspicious_activity:
type:
- boolean
- 'null'
title: Uses advanced machine learning to identify suspicious processes that require additional review
website_protection:
type:
- boolean
- 'null'
title: Blocks network traffic from malicious websites and IP addresses
bruteforce_protection:
type:
- boolean
- 'null'
title: Bruteforce attack protection on RDP, IMAP and so on.
friendly_name:
type: string
title: Friendly name
examples:
- File by MD5 hash
account_level:
type: boolean
title: Account level
policies:
type: array
title: Policies
items:
type: object
title: Policy
properties:
id:
type: string
title: ID of policy (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
additionalProperties: true
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 20da4613-5fa5-4460-9016-963d2c4f6753
name:
type: string
title: Name of policy
secret_hash:
type: string
title: Secret hash of the policy
secret_allow_site_override:
type: boolean
title: Allow secret override
quarantine_retention_duration:
type:
- integer
- 'null'
minimum: 0
title: Quarantine retention duration
description: Number of days to retain quarantined items. 0 means no retention.
tags:
- Policies
operationId: api.nebula.get.policy.id
put:
description: Update policy.
summary: Update policy
security:
- client_credentials:
- read
- write
- user_permissions:
- policies.edit
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: The Put Policy Request
required:
- name
- contents
- etag
properties:
contents:
type: object
additionalProperties: true
title: Policy contents
properties:
policy:
type: object
additionalProperties: true
title: Policy
examples:
- startup_options:
timeout: '60000'
toggle_on: true
sirius_update_schedule: FREQ=DAILY
updates:
pause_until: '2020-04-10T14:55:00+03:00'
endpoint_interface_options:
allow_run_threat_scan: true
show_threat_scan_shortcuts: true
limit_endpoint_agent_control: true
show_tray_icon: 'true'
show_windows_contextmenu: true
display_rtp_events: true
endpoint_tamper_protection:
uninstall_password: $2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK
protect_service: true
properties:
updates:
type: object
additionalProperties: true
title: Software Updates
examples:
- pause_until: '2020-04-10T14:55:00+03:00'
properties:
pause_until:
type:
- string
- 'null'
title: While paused, prevents ThreatDown software from updating (Windows Only)
examples:
- '2020-04-10T14:55:00+03:00'
protect_service:
type: boolean
title: Prevents ThreatDown services and processes from being stopped (Windows 10 only)
examples:
- true
startup_options:
type: object
additionalProperties: true
title: Allow services additional time to start
examples:
- timeout: '60000'
toggle_on: true
properties:
timeout:
type:
- integer
- string
title: Adjust the timeout period for all services, milliseconds. Max 10min.
examples:
- 60000
toggle_on:
type: boolean
title: Provide all services with additional time to initiate
examples:
- false
sirius_update_schedule:
type: string
title: How often agent should be updated
examples:
- FREQ=DAILY
endpoint_interface_options:
type: object
additionalProperties: true
title: Endpoint interface options
examples:
- show_windows_contextmenu: true
display_rtp_events: true
allow_run_threat_scan: true
show_threat_scan_shortcuts: true
limit_endpoint_agent_control: true
show_tray_icon: 'true'
properties:
show_tray_icon:
type:
- string
- boolean
title: Show Malwarebytes icon in notification area
examples:
- 'true'
display_rtp_events:
type: boolean
title: Display real-time protection notifications
examples:
- true
allow_run_threat_scan:
type: boolean
title: Allow users to run a Threat Scan (all threats will be quarantined automatically)
examples:
- true
show_windows_contextmenu:
type: boolean
title: Show ThreatDown option in context menus (Windows only)
examples:
- true
show_threat_scan_shortcuts:
type: boolean
title: Show ThreatDown shortcuts on Start menu and desktop to run Threat Scans (Windows only)
examples:
- true
limit_endpoint_agent_control:
type: boolean
title: The Limit_endpoint_agent_control Schema
description: Allow only Administrator level users to interact with the ThreatDown Tray (Windows only, not supported in XP or Server 2003)
examples:
- true
endpoint_tamper_protection:
type:
- object
- 'null'
additionalProperties: true
title: Tamper protection
examples:
- uninstall_password: $2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK
properties:
uninstall_password:
type: string
title: Encrypted password
examples:
- ''
status:
type: string
title: Status of the Policy
examples:
- ok
packages:
type: array
title: Collection of packages
default: []
items:
type: object
additionalProperties: true
title: Packages contain Policies for different products
examples:
- sirius_os_packages:
- operating_system: windows
sirius_package_name: epa.win.plugin.assetmanager
policy:
policy_version: 1
default_scan_settings:
include_nics: true
include_installs: true
include_processes: false
include_memory: true
include_modules: false
include_updates: true
include_drives: true
include_startups: true
product_name: Asset Manager
schema_version: '1.0'
- enabled: true
sirius_os_packages:
- sirius_package_name: epa.win.plugin.edr
operating_system: windows
policy:
isolation:
enabled: true
title_image_path: https://nebula-retina-mb-qa.eng-dev.mb-internal.com/api/v1/machine/isolation_image/20200310_105756.bmp?amazonaws=1
text: Your system has been locked by the IT Department. Please contact the Helpdesk for further information.
title: Malware or suspicious application behavior has been detected on this computer.
log_file_retention_rules:
max_num_roll_backups: 5
max_file_size: 125MB
flight_recorder:
learning_duration: 20
very_aggressive: true
enabled_server: true
rollback:
window: 48
enabled: true
file_size: 20MB
backup_quota: 30
file_size_server: 100MB
backup_folder_server: C:\ProgramData\Malwarebytes Endpoint Agent\Plugins\EDRPlugin\Backup\
enabled: true
eagle_url: ''
policy_version: 1
product_name: Endpoint Detection and Response
schema_version: '1.0'
- sirius_os_packages:
- operating_system: mac
sirius_package_name: epa.mac.plugin.assetmanager
policy:
policy_version: 1
default_scan_settings:
include_startups: true
include_nics: true
include_installs: true
include_processes: false
include_memory: true
include_modules: false
include_updates: true
include_drives: true
product_name: Mac Asset Manager
schema_version: '1.0'
- policy:
isolation:
enabled: false
policy_version: 1
flight_recorder:
enabled: false
eagle_url: ''
enabled_server: false
learning_duration: 20
network_collection_enabled: false
log_file_retention_rules:
max_file_size: 125MB
max_file_size_server: 1024MB
max_num_roll_backups: 5
enabled: false
product_name: Mac Endpoint Detection and Response
schema_version: '1.0'
sirius_os_packages:
- operating_system: mac
sirius_package_name: epa.mac.plugin.edr
- enabled: true
policy_version: 1
schema_version: '1.0'
sirius_os_packages:
- operating_system: windows
sirius_package_name: epa.win.plugin.mbam
policy:
self_protect_early_start: true
usage_stat: true
application_updates: true
windows_context_menus: false
protection_aging: '180'
win_ac: default
rtp_settings:
ransomware:
enabled: true
delay_rtp: true
exploit:
enabled: true
options:
amp_sp_other: true
java_wmcl: true
java_aijoip: true
amp_crg32_media: true
abp_pmbp_media: true
amp_mrad_pdf: true
amp_mrad_browser: true
amp_sp_pdf: true
ah_bua_ms: true
amp_mph_chrome: true
ah_bua_pdf: true
ah_ahs_chrome: true
java_misp: true
ah_daef_browser: true
ah_dep_chrome: true
amp_depb_ms: true
amp_rrg64_browser: true
amp_crg32_other: true
amp_rrg32_media: true
amp_crg64_media: true
abp_pmbp_other: true
abp_mll_media: true
amp_mph_pdf: true
amp_mrad_media: true
amp_rrg32_ms: true
ah_bua_browser: true
amp_rrg32_browser: true
java_mosp: true
amp_mph_media: true
ah_dahs_browser: true
amp_rrg32_other: true
abp_pmbp_pdf: true
amp_crg64_other: true
abp_mll_other: true
abp_pmbp_browser: true
amp_rrg64_media: true
amp_mrad_other: true
amp_crg32_pdf: true
amp_depb_media: true
amp_rrg64_chrome: true
amp_crg64_pdf: true
abp_mll_pdf: true
ah_bua_chrome: true
amp_depb_pdf: true
java_mmgp: true
amp_rrg32_chrome: true
ah_dep_ms: true
abp_powmi_ms: true
amp_depb_chrome: true
amp_mph_other: false
abp_mll_chrome: true
amp_crg64_chrome: true
amp_mph_ms: true
abp_povba_ms: true
amp_sp_chrome: true
abp_piev_browser: true
ah_ahs_media: true
amp_crg32_chrome: true
ah_dep_media: true
ah_ahs_pdf: false
amp_crg64_ms: true
abp_mll_ms: true
amp_rrg64_other: true
amp_depb_browser: true
amp_depb_other: true
amp_mrad_chrome: true
ah_bua_media: false
amp_mph_browser: true
abp_pmbp_chrome: true
java_mmcep: true
abp_mll_browser: true
amp_crg64_browser: true
amp_sp_ms: true
ah_ahs_browser: true
ah_ahs_other: true
ah_dep_other: true
amp_sp_browser: true
ah_bua_other: true
amp_rrg32_pdf: true
ah_ahs_ms: true
amp_rrg64_pdf: true
amp_crg32_browser: true
ah_diev_browser: true
amp_sp_media: true
amp_rrg64_ms: true
ah_dep_pdf: true
ah_dep_browser: true
amp_mrad_ms: true
# --- truncated at 32 KB (439 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-policies-api-openapi.yml