When a harmful file is found on a device, it can be neutralized and placed in quarantine, preventing it from posing a threat. You can utilize the Quarantine APIs to export or check data for the existence of quarantined threats across your environments.
openapi: 3.2.0
info:
title: Malwarebytes Quarantine API
version: 1.0.0
description: 'Operations tagged Quarantine across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Quarantine
description: When a harmful file is found on a device, it can be neutralized and placed in quarantine, preventing it from posing a threat. You can utilize the Quarantine APIs to export or check data for the existence of quarantined threats across your environments.
paths:
/nebula/v1/quarantine/export:
servers:
- url: https://api.threatdown.com
post:
description: "Export quarantine data. Specify your interested fields and the output format.\n\n\n\nSupported output formats: csv, xlsx, json.\n\n\n\n## Settings\n\n\n\n| Name | Description |\n|------|-------------|\n|ids | List of quarantine ids selected for exporting |\n| groups | List of queries. The constraints accepted can be found on the route schema |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n\n## Examples\n\n\n\n\n\n### Download xlsx file\n\n\n\nA request with this body sent by a browser will download a file called `report.xlxs`, displaying a table with columns: `Threat Name`, `Date`, `Location`, `Type`, `Category`, `Endpoint` for all quarantines with `Category` set to Malware :\n\n\n\n```json\n{\n \"download\":true,\n \"format\":\"xlsx\",\n \"filename\": \"Report\",\n \"select\":[\n {\n \"field\":\"threat_name\",\n \"newField\":\"Threat name\"\n },\n {\n \"field\":\"scanned_at\",\n \"newField\":\"Date\"\n },\n {\n \"field\":\"path\",\n \"newField\":\"Location\"\n },\n {\n \"field\":\"type\",\n \"newField\":\"Type\"\n },\n {\n \"field\":\"category\",\n \"newField\":\"Category\"\n },\n {\n \"field\":\"machine_name\",\n \"newField\":\"Endpoint\"\n }\n ],\n \"type\":\"base64\",\n \"groups\": [{\n \"category\":\"malware\"\n }]\n}\n```\n\n\n\n### Get JSON with all ids for programmatic usage\n\n\nA request with this body sent will return a JSON object containing containing info for: `Quarantine ID`, `Threat Name`, `Date`, `Location`, `Type`, `Endpoint` for all quarantines with `Category` set to PUP :\n\n```json\n{\n \"format\":\"json\",\n \"select\":[\n {\n \"field\":\"id\",\n \"newField\":\"Quarantine ID\"\n },\n {\n \"field\":\"threat_name\",\n \"newField\":\"Threat name\"\n },\n {\n \"field\":\"scanned_at\",\n \"newField\":\"Date\"\n },\n {\n \"field\":\"path\",\n \"newField\":\"Location\"\n },\n {\n \"field\":\"type\",\n \"newField\":\"Type\"\n },\n {\n \"field\":\"machine_name\",\n \"newField\":\"Endpoint\"\n }\n ],\n \"type\":\"string\",\n \"groups\":[\n {\n \"category\":\"PUP\"\n }\n ]\n}\n```\n\n\n\n*Example response*\n\n```\n[\n {\n \"Threat name\":\"PUP.Optional\",\n \"Date\":\"2021-02-27T02:50:44.000Z\",\n \"Location\":\"C:\\\\USERS\\\\ADMIN\\\\DESKTOP\\\\TEST_PUP.1.EXE\",\n \"Type\":\"file\",\n \"Category\":\"PUP\",\n \"Endpoint\":\"DESKTOP-MB\"\n },\n {\n \"Threat name\":\"PUP.Optional\",\n \"Date\":\"2021-02-13T01:56:39.000Z\",\n \"Location\":\"C:\\\\Users\\\\admin\\\\Desktop\\\\Test_PUP.exe\",\n \"Type\":\"file\",\n \"Category\":\"PUP\",\n \"Endpoint\":\"DESKTOP-MB\"\n }\n]\n```\n"
summary: Export quarantines
security:
- client_credentials:
- read
- user_permissions:
- detections.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
- name: name
required: false
in: query
description: Search with quarantine threat name.
schema:
type: string
- name: category
required: false
in: query
description: Search with quarantine category.
schema:
type: string
- name: type
required: false
in: query
description: Search with quarantine type
schema:
type: string
- name: since
required: false
in: query
description: Timestamp to filter since quarantine scan times.
schema:
type: string
- name: until
required: false
in: query
description: Timestamp to filter until quarantine scan times.
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Export request
required:
- select
- format
anyOf:
- required:
- groups
- required:
- ids
properties:
groups:
type: array
items:
type: object
anyOf:
- type: object
title: Search for quarantines
properties:
ids:
type: array
title: IDs of quarantines to filter by
items:
type: string
title: 'IDs of quarantine to filter by (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f") '
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
machine_id:
type: string
title: ID of the endpoint
examples:
- 2d2dd661-486e-463d-8065-16340eabfa96
category:
type: string
title: Category name of the quarantine.
examples:
- Malware
type:
type: array
title: Type of the quarantine.
items:
type: string
examples:
- - file
since:
type: string
title: Timestamp to filter since quarantine scan times.
format: date-time
formatMinimum: '1970-01-01T00:00:00Z'
until:
type: string
title: Timestamp to filter until quarantine scan times.
format: date-time
formatMinimum: '1970-01-01T00:00:00.000'
- type: object
properties:
constraints:
type: array
title: Quarantine constraints
items:
title: Quarantine Constraints
type: object
oneOf:
- title: String (Equals, Not Equals) Constraints
required:
- operator
- value
properties:
field:
type: string
oneOf:
- type: string
title: Quarantine UID String Fields
enum:
- id
- scan_id
- machine_id
- detection_id
- parent_detection_id
- account_id
- title: Quarantine Simple String Fields
type: string
enum:
- correlation_hash
- threat_name
- machine_name
- path
- md5
- sha256
- scanned_at_offset_seconds
- trace_id
- rule_id
- type: string
title: Quarantine Enum String Fields
enum:
- type
- category
operator:
type: string
description: Operator to apply to the constraint
enum:
- equals
- not_equals
value:
type:
- string
- array
title: Value to search
items:
type: string
case_insensitive:
type: boolean
default: false
if:
properties:
field:
type: string
title: Quarantine UID String Fields
enum:
- id
- scan_id
- machine_id
- detection_id
- parent_detection_id
- account_id
then:
properties:
value:
type:
- string
- array
format: uuid
items:
type: string
format: uuid
- title: String (Contains, Not Contains) Constraints
required:
- operator
- value
properties:
field:
title: Quarantine Simple String Fields
type: string
enum:
- correlation_hash
- threat_name
- machine_name
- path
- md5
- sha256
- scanned_at_offset_seconds
- trace_id
- rule_id
operator:
type: string
description: Operator to apply to the constraint
enum:
- contains
- not_contains
value:
type: string
title: Value to search
case_insensitive:
type: boolean
default: false
- title: Boolean (Equals) Constraints
required:
- operator
- value
properties:
field:
type: string
oneOf:
- type: string
title: Quarantine Boolean Fields
enum:
- is_rtp_stream_event
operator:
type: string
description: Operator to apply to the constraint
enum:
- equals
value:
title: Value to search. Must be true or false
type: boolean
- title: Date (start, end) Constraints
properties:
field:
type: string
title: Quarantine Date Fields
enum:
- scanned_at
- reported_at
- cleaned_at
- updated_at
- resource_created_at
- resource_modified_at
- auto_removal_at
oneOf:
- minProperties: 1
title: Specify Date Range
not:
anyOf:
- required:
- operator
- required:
- value
properties:
start:
type: string
format: date-time
title: Start Date
end:
type: string
format: date-time
title: End Date
- title: Specify Exact Date
not:
anyOf:
- required:
- start
- required:
- end
required:
- operator
- value
properties:
operator:
type: string
enum:
- equals
value:
type:
- string
- array
format: date-time
title: Value to search
items:
format: date-time
format:
type: string
title: The output file
enum:
- csv
- xlsx
- html
- ods
- txt
- rtf
- json
download:
type: boolean
title: Whether to instruct the client to download the response as a file. Only clients like browsers are supported
filename:
type: string
title: The name of the output file if download is set to true
ids:
type: array
title: IDs of quarantines to filter by (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
items:
type: string
title: IDs of quarantine to filter by (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
type:
type: string
title: The encoding of the output
enum:
- string
- base64
- binary
default: string
select:
type: array
title: Which fields to select from the response
items:
type: object
title: Field
properties:
newField:
type: string
title: the new value
field:
type: string
title: The response field to map to a new value
enum:
- id
- type
- scan_id
- machine_id
- machine_name
- group_id
- detection_id
- scanned_at
- scanned_at_local
- reported_at
- resource_created_at
- resource_modified_at
- threat_name
- path
- category
- ip_address
- url
- port
- device.disk_model
responses: {}
tags:
- Quarantine
operationId: api.nebula.export.quarantine
/nebula/v1/quarantine:
servers:
- url: https://api.threatdown.com
get:
description: Get all the quarantined items. Refer to Jobs apis to restore and delete items from quarantine
summary: Get all quarantined items
security:
- client_credentials:
- read
- user_permissions:
- detections.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
- name: name
required: false
in: query
description: Search with quarantine threat name.
schema:
type: string
- name: category
required: false
in: query
description: Search with quarantine category.
schema:
type: string
- name: type
required: false
in: query
description: Search with quarantine type
schema:
type: string
- name: since
required: false
in: query
description: Timestamp to filter since quarantine scan times.
schema:
type: string
- name: until
required: false
in: query
description: Timestamp to filter until quarantine scan times.
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
$schema: http://json-schema.org/draft-07/schema
type: object
title: The get quearantines response
description: Get quarantine for a given machine
examples:
- quarantined_threats:
- id: 957fc464-9ee1-473c-8f49-d89d2da1d5d8
scan_id: 00000000-0000-0000-0000-000000000000
machine_id: 0ac6eb75-3b3d-49ea-86ea-4349465d32bf
machine_name: EndpointDetections
group_id: 999a0d78-a983-44fc-a302-995cdfb39da3
detection_id: 1491ac5b-60fc-439c-acd3-4e5e1881337f
scanned_at: '2020-05-20T13:21:21Z'
scanned_at_local: '2020-05-20T13:21:21Z'
reported_at: '2020-05-20T13:21:23.114719Z'
threat_name: ransomware.script
type:
- file
stauts: quarantined
path: C:\Deploy\RealTime\ransomware.exe
category: arw
ip_address: ''
url: ''
port: ''
total_count: 1
next_cursor: ''
required:
- quarantined_threats
- total_count
- next_cursor
properties:
quarantined_threats:
type: array
title: List of quearantine threats
description: List of quarantined threats.
items:
type: object
title: Get detection by id
additionalProperties: true
required:
- id
- scan_id
- machine_id
- detection_id
- scanned_at
- scanned_at_local
- reported_at
- status
- type
- path
- category
properties:
id:
type: string
title: The ID of the detection (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
scan_id:
type: string
title: Scan ID this detection belongs to (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
machine_id:
type: string
title: Endpoint ID this detection belongs to (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
machine_name:
type: string
title: Machine name
group_id:
type: string
title: Group ID the endpoint has (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
group_name:
type: string
title: Group name the endpoint has
policy_id:
type: string
title: The ID of the policy associated to the machine where this detection happened (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
policy_name:
type: string
title: Policy name
detection_id:
type: string
title: Detection id from endpoint
scanned_at:
type: string
title: Scanned at time (Ex. "2020-03-23T17:23:17.860482Z")
pattern: ^\d{4}-[0-1]\d-[0-3]\d[(t|T)\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:(z|Z)|[+-]\d{2}:\d{2})$
examples:
- '2020-03-23T17:23:17.860482Z'
scanned_at_local:
type: string
title: Scanned at local time (Ex. "2020-03-23T17:23:17.860482Z")
pattern: ^\d{4}-[0-1]\d-[0-3]\d[(t|T)\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:(z|Z)|[+-]\d{2}:\d{2})$
examples:
- '2020-03-23T17:23:17.860482Z'
reported_at:
type: string
title: Detection reported at time (Ex. "2020-03-23T17:23:17.860482Z")
pattern: ^\d{4}-[0-1]\d-[0-3]\d[(t|T)\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:(z|Z)|[+-]\d{2}:\d{2})$
examples:
- '2020-03-23T17:23:17.860482Z'
resource_created_at:
type: string
title: The creation timestamp of the original quarantined file
format: date-time
resource_modified_at:
type: string
title: The modification timestamp of the original quarantined file
format: date-time
status:
type: string
title: Status
action_taken:
type: string
title: Action Taken
examples:
- unknown
- failed
- noActionByUser
- quarantined
- replaced
- deleteOnReboot
- replaceOnReboot
- blocked
- whitelisted
- unquarantined
threat_name:
type: string
title: Threat name
type:
type: array
title: Type
items:
type: string
title: Items
path:
type: string
title: Path
category:
type: string
title: Category
ip_address:
type: string
title: IP address
url:
type: string
title: Url
port:
type: string
title: Port
affected_application:
type: string
title: Affected application
md5:
type: string
title: Md5
process_name:
type: string
title: Process name
auto_removal_at:
type:
- string
- 'null'
title: Automatic removal timestamp
description: When the quarantined item will be automatically removed.
format: date-time
examples:
- '2020-03-23T17:23:17.860482Z'
total_count:
type: integer
title: Total count of items
description: Total count of items
default: 0
examples:
- 1
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
tags:
- Quarantine
operationId: api.nebula.get.quarantine-all
/nebula/v1/quarantine/action:
servers:
- url: https://api.threatdown.com
post:
description: Issue Delete/Restore all quarantines job to a machine with machine id
summary: Bulk quarantine action
security:
- client_credentials:
- execute
- user_permissions:
- detections.performActions
- detections.delete
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: The Post Issue Jobs With Machine ID
required:
- endpoints
- command
properties:
command:
type: string
title: Command
enum:
- command.threat.quarantine.restore
- command.threat.quarantine.remove
endpoints:
type: array
title: Machine IDs
items:
type: object
title: Machine IDs items
required:
- id
properties:
id:
type: string
# --- truncated at 32 KB (109 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-quarantine-api-openapi.yml