Malwarebytes Remote Intrusion Detection API
A remote intrusion detection (RID) occurs when a brute force protection rule is triggered according to policy settings. Use these APIs to export and search for RID rules by specific parameters.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Remote Intrusion Detection API
version: 1.0.0
description: 'Operations tagged Remote Intrusion Detection across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Remote Intrusion Detection
description: 'A remote intrusion detection (RID) occurs when a brute force protection rule is triggered according to policy settings.
Use these APIs to export and search for RID rules by specific parameters.'
paths:
/nebula/v1/rid/rules/export:
servers:
- url: https://api.threatdown.com
post:
description: Export RID rules
summary: Export RID rules
security:
- client_credentials:
- execute
- user_permissions:
- bruteForce.view
status:
outage:
- auth
- search_stateful
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Export request
required:
- groups
- select
- format
properties:
format:
type: string
title: The output file
enum:
- csv
- xlsx
- html
- ods
- txt
- rtf
- json
download:
type: boolean
title: Whether to instruct the client to download the response as a file. Only clients like browsers are supported
type:
type: string
title: The encoding of the output
enum:
- string
- base64
- binary
default: string
select:
type: array
title: Which fields to select from the response
items:
type: object
title: Field
required:
- field
- newField
properties:
newField:
type: string
title: the new value
field:
type: string
title: The response field to map to a new value
groups:
type: array
title: List of queries
items:
type: object
required: []
title: Query to fetch endpoints
allOf:
- $schema: http://json-schema.org/draft-07/schema
type: object
title: Search rid rules request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.
required: []
properties:
nics.mac_address:
type: string
title: Filter the search by nics.mac_address. Search for the documents that contains the value
not.nics.mac_address:
type: string
title: Filter the search by not.nics.mac_address. Search for the documents that does not contain the value
nics.mac_address.keyword:
type: string
title: Filter the search by nics.mac_address.keyword. Search for the documents that equals the value
not.nics.mac_address.keyword:
type: string
title: Filter the search by not.nics.mac_address.keyword. Search for the documents that are not equal to the value
nics.description:
type: string
title: Filter the search by nics.description. Search for the documents that contains the value
not.nics.description:
type: string
title: Filter the search by not.nics.description. Search for the documents that does not contain the value
nics.description.keyword:
type: string
title: Filter the search by nics.description.keyword. Search for the documents that equals the value
not.nics.description.keyword:
type: string
title: Filter the search by not.nics.description.keyword. Search for the documents that are not equal to the value
os_info.os_type:
type: string
title: Filter the search by os_info.os_type. Search for the documents that contains the value
not.os_info.os_type:
type: string
title: Filter the search by not.os_info.os_type. Search for the documents that does not contain the value
os_info.os_type.keyword:
type: string
title: Filter the search by os_info.os_type.keyword. Search for the documents that equals the value
not.os_info.os_type.keyword:
type: string
title: Filter the search by not.os_info.os_type.keyword. Search for the documents that are not equal to the value
os_info.os_version:
type: string
title: Filter the search by os_info.os_version. Search for the documents that contains the value
not.os_info.os_version:
type: string
title: Filter the search by not.os_info.os_version. Search for the documents that does not contain the value
os_info.os_version.keyword:
type: string
title: Filter the search by os_info.os_version.keyword. Search for the documents that equals the value
not.os_info.os_version.keyword:
type: string
title: Filter the search by not.os_info.os_version.keyword. Search for the documents that are not equal to the value
os_info.os_platform:
type: string
title: Filter the search by os_info.os_platform. Search for the documents that contains the value
not.os_info.os_platform:
type: string
title: Filter the search by not.os_info.os_platform. Search for the documents that does not contain the value
os_info.os_platform.keyword:
type: string
title: Filter the search by os_info.os_platform.keyword. Search for the documents that equals the value
not.os_info.os_platform.keyword:
type: string
title: Filter the search by not.os_info.os_platform.keyword. Search for the documents that are not equal to the value
os_info.os_architecture:
type: string
title: Filter the search by os_info.os_architecture. Search for the documents that contains the value
not.os_info.os_architecture:
type: string
title: Filter the search by not.os_info.os_architecture. Search for the documents that does not contain the value
os_info.os_architecture.keyword:
type: string
title: Filter the search by os_info.os_architecture.keyword. Search for the documents that equals the value
not.os_info.os_architecture.keyword:
type: string
title: Filter the search by not.os_info.os_architecture.keyword. Search for the documents that are not equal to the value
os_info.os_release_name:
type: string
title: Filter the search by os_info.os_release_name. Search for the documents that contains the value
not.os_info.os_release_name:
type: string
title: Filter the search by not.os_info.os_release_name. Search for the documents that does not contain the value
os_info.os_release_name.keyword:
type: string
title: Filter the search by os_info.os_release_name.keyword. Search for the documents that equals the value
not.os_info.os_release_name.keyword:
type: string
title: Filter the search by not.os_info.os_release_name.keyword. Search for the documents that are not equal to the value
host_name:
type: string
title: Filter the search by host_name. Search for the documents that contains the value
not.host_name:
type: string
title: Filter the search by not.host_name. Search for the documents that does not contain the value
host_name.keyword:
type: string
title: Filter the search by host_name.keyword. Search for the documents that equals the value
not.host_name.keyword:
type: string
title: Filter the search by not.host_name.keyword. Search for the documents that are not equal to the value
fully_qualified_host_name:
type: string
title: Filter the search by fully_qualified_host_name. Search for the documents that contains the value
not.fully_qualified_host_name:
type: string
title: Filter the search by not.fully_qualified_host_name. Search for the documents that does not contain the value
fully_qualified_host_name.keyword:
type: string
title: Filter the search by fully_qualified_host_name.keyword. Search for the documents that equals the value
not.fully_qualified_host_name.keyword:
type: string
title: Filter the search by not.fully_qualified_host_name.keyword. Search for the documents that are not equal to the value
plugins.asset_manager.plugin_version:
type: string
title: Filter the search by plugins.asset_manager.plugin_version. Search for the documents that contains the value
not.plugins.asset_manager.plugin_version:
type: string
title: Filter the search by not.plugins.asset_manager.plugin_version. Search for the documents that does not contain the value
plugins.asset_manager.plugin_version.keyword:
type: string
title: Filter the search by plugins.asset_manager.plugin_version.keyword. Search for the documents that equals the value
not.plugins.asset_manager.plugin_version.keyword:
type: string
title: Filter the search by not.plugins.asset_manager.plugin_version.keyword. Search for the documents that are not equal to the value
plugins.asset_manager.reboot_reasons:
type: string
title: Filter the search by plugins.asset_manager.reboot_reasons. Search for the documents that contains the value
not.plugins.asset_manager.reboot_reasons:
type: string
title: Filter the search by not.plugins.asset_manager.reboot_reasons. Search for the documents that does not contain the value
plugins.asset_manager.reboot_reasons.keyword:
type: string
title: Filter the search by plugins.asset_manager.reboot_reasons.keyword. Search for the documents that equals the value
not.plugins.asset_manager.reboot_reasons.keyword:
type: string
title: Filter the search by not.plugins.asset_manager.reboot_reasons.keyword. Search for the documents that are not equal to the value
plugins.endpoint_protection.plugin_version:
type: string
title: Filter the search by plugins.endpoint_protection.plugin_version. Search for the documents that contains the value
not.plugins.endpoint_protection.plugin_version:
type: string
title: Filter the search by not.plugins.endpoint_protection.plugin_version. Search for the documents that does not contain the value
plugins.endpoint_protection.plugin_version.keyword:
type: string
title: Filter the search by plugins.endpoint_protection.plugin_version.keyword. Search for the documents that equals the value
not.plugins.endpoint_protection.plugin_version.keyword:
type: string
title: Filter the search by not.plugins.endpoint_protection.plugin_version.keyword. Search for the documents that are not equal to the value
plugins.endpoint_protection.sdk_version:
type: string
title: Filter the search by plugins.endpoint_protection.sdk_version. Search for the documents that contains the value
not.plugins.endpoint_protection.sdk_version:
type: string
title: Filter the search by not.plugins.endpoint_protection.sdk_version. Search for the documents that does not contain the value
plugins.endpoint_protection.sdk_version.keyword:
type: string
title: Filter the search by plugins.endpoint_protection.sdk_version.keyword. Search for the documents that equals the value
not.plugins.endpoint_protection.sdk_version.keyword:
type: string
title: Filter the search by not.plugins.endpoint_protection.sdk_version.keyword. Search for the documents that are not equal to the value
plugins.endpoint_protection.component_package_version:
type: string
title: Filter the search by plugins.endpoint_protection.component_package_version. Search for the documents that contains the value
not.plugins.endpoint_protection.component_package_version:
type: string
title: Filter the search by not.plugins.endpoint_protection.component_package_version. Search for the documents that does not contain the value
plugins.endpoint_protection.component_package_version.keyword:
type: string
title: Filter the search by plugins.endpoint_protection.component_package_version.keyword. Search for the documents that equals the value
not.plugins.endpoint_protection.component_package_version.keyword:
type: string
title: Filter the search by not.plugins.endpoint_protection.component_package_version.keyword. Search for the documents that are not equal to the value
plugins.endpoint_protection.update_package_version:
type: string
title: Filter the search by plugins.endpoint_protection.update_package_version. Search for the documents that contains the value
not.plugins.endpoint_protection.update_package_version:
type: string
title: Filter the search by not.plugins.endpoint_protection.update_package_version. Search for the documents that does not contain the value
plugins.endpoint_protection.update_package_version.keyword:
type: string
title: Filter the search by plugins.endpoint_protection.update_package_version.keyword. Search for the documents that equals the value
not.plugins.endpoint_protection.update_package_version.keyword:
type: string
title: Filter the search by not.plugins.endpoint_protection.update_package_version.keyword. Search for the documents that are not equal to the value
plugins.endpoint_protection.reboot_reasons:
type: string
title: Filter the search by plugins.endpoint_protection.reboot_reasons. Search for the documents that contains the value
not.plugins.endpoint_protection.reboot_reasons:
type: string
title: Filter the search by not.plugins.endpoint_protection.reboot_reasons. Search for the documents that does not contain the value
plugins.endpoint_protection.reboot_reasons.keyword:
type: string
title: Filter the search by plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that equals the value
not.plugins.endpoint_protection.reboot_reasons.keyword:
type: string
title: Filter the search by not.plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that are not equal to the value
plugins.endpoint_detection_and_response.plugin_version:
type: string
title: Filter the search by plugins.endpoint_detection_and_response.plugin_version. Search for the documents that contains the value
not.plugins.endpoint_detection_and_response.plugin_version:
type: string
title: Filter the search by not.plugins.endpoint_detection_and_response.plugin_version. Search for the documents that does not contain the value
plugins.endpoint_detection_and_response.plugin_version.keyword:
type: string
title: Filter the search by plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that equals the value
not.plugins.endpoint_detection_and_response.plugin_version.keyword:
type: string
title: Filter the search by not.plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that are not equal to the value
plugins.endpoint_detection_and_response.reboot_reasons:
type: string
title: Filter the search by plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that contains the value
not.plugins.endpoint_detection_and_response.reboot_reasons:
type: string
title: Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that does not contain the value
plugins.endpoint_detection_and_response.reboot_reasons.keyword:
type: string
title: Filter the search by plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that equals the value
not.plugins.endpoint_detection_and_response.reboot_reasons.keyword:
type: string
title: Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that are not equal to the value
plugins.incident_response.plugin_version:
type: string
title: Filter the search by plugins.incident_response.plugin_version. Search for the documents that contains the value
not.plugins.incident_response.plugin_version:
type: string
title: Filter the search by not.plugins.incident_response.plugin_version. Search for the documents that does not contain the value
plugins.incident_response.plugin_version.keyword:
type: string
title: Filter the search by plugins.incident_response.plugin_version.keyword. Search for the documents that equals the value
not.plugins.incident_response.plugin_version.keyword:
type: string
title: Filter the search by not.plugins.incident_response.plugin_version.keyword. Search for the documents that are not equal to the value
plugins.incident_response.reboot_reasons:
type: string
title: Filter the search by plugins.incident_response.reboot_reasons. Search for the documents that contains the value
not.plugins.incident_response.reboot_reasons:
type: string
title: Filter the search by not.plugins.incident_response.reboot_reasons. Search for the documents that does not contain the value
plugins.incident_response.reboot_reasons.keyword:
type: string
title: Filter the search by plugins.incident_response.reboot_reasons.keyword. Search for the documents that equals the value
not.plugins.incident_response.reboot_reasons.keyword:
type: string
title: Filter the search by not.plugins.incident_response.reboot_reasons.keyword. Search for the documents that are not equal to the value
plugins.siem.plugin_version:
type: string
title: Filter the search by plugins.siem.plugin_version. Search for the documents that contains the value
not.plugins.siem.plugin_version:
type: string
title: Filter the search by not.plugins.siem.plugin_version. Search for the documents that does not contain the value
plugins.siem.plugin_version.keyword:
type: string
title: Filter the search by plugins.siem.plugin_version.keyword. Search for the documents that equals the value
not.plugins.siem.plugin_version.keyword:
type: string
title: Filter the search by not.plugins.siem.plugin_version.keyword. Search for the documents that are not equal to the value
plugins.browser_phishing_protection.plugin_version:
type: string
title: Filter the search by plugins.browser_phishing_protection.plugin_version. Search for the documents that contains the value
not.plugins.browser_phishing_protection.plugin_version:
type: string
title: Filter the search by not.plugins.browser_phishing_protection.plugin_version. Search for the documents that does not contain the value
plugins.browser_phishing_protection.plugin_version.keyword:
type: string
title: Filter the search by plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that equals the value
not.plugins.browser_phishing_protection.plugin_version.keyword:
type: string
title: Filter the search by not.plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that are not equal to the value
plugins.siem.reboot_reasons:
type: string
title: Filter the search by plugins.siem.reboot_reasons. Search for the documents that contains the value
not.plugins.siem.reboot_reasons:
type: string
title: Filter the search by not.plugins.siem.reboot_reasons. Search for the documents that does not contain the value
plugins.siem.reboot_reasons.keyword:
type: string
title: Filter the search by plugins.siem.reboot_reasons.keyword. Search for the documents that equals the value
not.plugins.siem.reboot_reasons.keyword:
type: string
title: Filter the search by not.plugins.siem.reboot_reasons.keyword. Search for the documents that are not equal to the value
engine_version:
type: string
title: Filter the search by engine_version. Search for the documents that equal the value
not.engine_version:
type: string
title: Filter the search by not.engine_version. Search for the documents that does not equal the value
engine_version.keyword:
type: string
title: Filter the search by engine_version.keyword. Search for the documents that equals the value
not.engine_version.keyword:
type: string
title: Filter the search by not.engine_version.keyword. Search for the documents that are not equal to the value
domain_name:
type: string
title: Filter the search by domain_name. Search for the documents that contains the value
not.domain_name:
type: string
title: Filter the search by not.domain_name. Search for the documents that does not contain the value
domain_name.keyword:
type: string
title: Filter the search by domain_name.keyword. Search for the documents that equals the value
not.domain_name.keyword:
type: string
title: Filter the search by not.domain_name.keyword. Search for the documents that are not equal to the value
policy_etag:
type: string
title: Filter the search by policy_etag. Search for the documents that contains the value
not.policy_etag:
type: string
title: Filter the search by not.policy_etag. Search for the documents that does not contain the value
policy_etag.keyword:
type: string
title: Filter the search by policy_etag.keyword. Search for the documents that equals the value
not.policy_etag.keyword:
type: string
title: Filter the search by not.policy_etag.keyword. Search for the documents that are not equal to the value
last_user:
type: string
title: Filter the search by last_user. Search for the documents that contains the value
not.last_user:
type: string
title: Filter the search by not.last_user. Search for the documents that does not contain the value
last_user.keyword:
type: string
title: Filter the search by last_user.keyword. Search for the documents that equals the value
not.last_user.keyword:
type: string
title: Filter the search by not.last_user.keyword. Search for the documents that are not equal to the value
id:
type: string
title: Filter the search by id. Search for the documents that contains the value
not.id:
type: string
title: Filter the search by not.id. Search for the documents that does not contain the value
id.keyword:
type: string
title: Filter the search by id.keyword. Search for the documents that equals the value
not.id.keyword:
type: string
title: Filter the search by not.id.keyword. Search for the documents that are not equal to the value
rule_id:
type: string
title: Filter the search by rule_id. Search for the documents that contains the value
not.rule_id:
type: string
title: Filter the search by not.rule_id. Search for the documents that does not contain the value
rule_id.keyword:
type: string
title: Filter the search by rule_id.keyword. Search for the documents that equals the value
not.rule_id.keyword:
type: string
title: Filter the search by not.rule_id.keyword. Search for the documents that are not equal to the value
origin_id:
type: string
title: Filter the search by origin_id. Search for the documents that contains the value
not.origin_id:
type: string
title: Filter the search by not.origin_id. Search for the documents that does not contain the value
origin_id.keyword:
type: string
title: Filter the search by origin_id.keyword. Search for the documents that equals the value
not.origin_id.keyword:
type: string
title: Filter the search by not.origin_id.keyword. Search for the documents that are not equal to the value
machine_id:
type: string
title: Filter the search by machine_id. Search for the documents that contains the value
not.machine_id:
type: string
title: Filter the search by not.machine_id. Search for the documents that does not contain the value
machine_id.keyword:
type: string
title: Filter the search by machine_id.keyword. Search for the documents that equals the value
not.mach
# --- truncated at 32 KB (577 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-remote-intrusion-detection-api-openapi.yml