Suspicious Activities are found using Endpoint Detection and Response (EDR). When Suspicious Activity Monitoring is enabled via the policy, EDR watches for potentially malicious behavior on your endpoints by monitoring the processes, registry, file system, and network activity. Use these APIs to retrieve the suspicious activity records and details.
openapi: 3.2.0
info:
title: Malwarebytes Suspicious Activity API
version: 1.0.0
description: 'Operations tagged Suspicious Activity across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Suspicious Activity
description: "Suspicious Activities are found using Endpoint Detection and Response (EDR). When Suspicious Activity Monitoring is enabled via the policy, EDR watches for potentially malicious behavior on your endpoints by monitoring the processes, registry, file system, and network activity. \n\nUse these APIs to retrieve the suspicious activity records and details."
paths:
/nebula/v1/sa:
servers:
- url: https://api.threatdown.com
get:
description: Fetch suspicious activity records of the account.
summary: Suspicious activity of the account
security:
- client_credentials:
- read
- user_permissions:
- edr.view
status:
outage:
- auth
- edr
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: sort_field
required: false
in: query
description: Sort field
schema:
type: string
enum:
- timestamp
- level
- pc_hostname
- name: sort_direction
required: false
in: query
description: Sort direction
schema:
type: string
enum:
- asc
- desc
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
- name: since
required: false
in: query
description: Since (Ex. "2020-03-23T17:23:17.860482Z")
schema:
type: string
pattern: ^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))$
- name: before
required: false
in: query
description: Before (Ex. "2020-03-23T17:23:17.860482Z")
schema:
type: string
pattern: ^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))$
- name: group_ids
required: false
in: query
description: Group ID
schema:
type:
- string
- array
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: per_page
required: false
in: query
description: Page size
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Suspicious activity response
required:
- sa
- total_count
properties:
sa:
type: array
title: Suspicious activity
items:
type: object
title: Suspicious activity items
additionalProperties: true
properties:
detection_id_list:
type: array
title: List of detections IDs
items:
type: number
status:
type: string
title: Status
timestamp:
type: string
title: Timestamp
path:
type: string
title: Path
pc_hostname:
type: string
title: Hostname of PC
machine_id:
type: string
title: placeholder
account_id:
type: string
title: Account ID
closed:
type: integer
title: Closed
level:
type: integer
title: Level
detected_by_count:
type: integer
title: Count
total_count:
type: integer
title: Total count
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
tags:
- Suspicious Activity
operationId: api.nebula.get.suspiciousactivity
/nebula/v1/sa/{id}/process_graph:
servers:
- url: https://api.threatdown.com
get:
description: Fetch process graph of suspicious activity.
summary: Suspicious activity process graph
security:
- client_credentials:
- read
- user_permissions:
- edr.view
status:
outage:
- auth
- edr
parameters:
- name: id
required: true
in: path
description: ID of suspicious activity
schema:
type: string
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Process graph of suspicious activity
additionalProperties: true
properties:
data:
type: object
title: Data
additionalProperties: true
properties:
node_type:
type: string
title: Node type
children:
type: array
title: Children of this node
default: []
additionalItems: true
items:
type: object
title: Items of childres
additionalProperties: true
properties:
id:
type: string
title: ID
name:
type: string
title: Name
examples:
- EXPLORER.EXE
node_type:
type: string
title: Node type
examples:
- Process
children:
type: array
title: Children of this node. Follows the same structure as current node.
additionalItems: true
items:
type: object
title: Children items
additionalProperties: true
node_info:
type: object
title: Node info
additionalProperties: true
properties:
activities:
type: array
title: Activities
default: []
items:
type: object
title: Activities items
additionalProperties: true
additionalItems: true
process_id:
type: integer
title: Process id - PID
examples:
- 5696
dropped:
type: boolean
title: Dropped
process_path:
type: string
title: Process path
examples:
- C:\WINDOWS\EXPLORER.EXE
name:
type: string
title: Name
examples:
- START
id:
type: string
title: ID
examples:
- '-'
tags:
- Suspicious Activity
operationId: api.nebula.get.suspiciousactivity.process_graph
/nebula/v1/sa/details:
servers:
- url: https://api.threatdown.com
post:
description: Fetch details of suspicious activity.
summary: Suspicious activity details
security:
- client_credentials:
- read
- user_permissions:
- edr.view
status:
outage:
- auth
- edr
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Suspicious activity request payload
required:
- detection_id_list
- endpoint
properties:
detection_id_list:
type: array
title: List of Suspicious Activity IDs
items:
type: integer
title: Suspicious Activity IDs
examples:
- 274304
- 7874825
endpoint:
type: string
title: UUID of the endpoint
examples:
- 3fdbe4c1-8a80-4a57-8369-9ec4399fbf0b
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Details of suspicious activities
additionalProperties: true
properties:
data:
type: object
title: The Details Schema
additionalProperties: true
properties:
resolved:
type:
- 'null'
- string
- number
title: The Resolved Schema
pc_hostname:
type: string
title: Hostname of PC
status:
type: string
title: Status
tot:
type: integer
title: Count of suspicious activities
list:
type: array
title: List of suspicious activities
additionalItems: true
items:
type: object
title: List items
additionalProperties: true
properties:
status:
type: string
title: Status
examples:
- detected
timestamp:
type: string
title: Timestamp
path:
type: string
title: Path
examples:
- C:\WINDOWS\SYSTEM32\CMD.EXE
detection_id:
type: integer
title: Id of the suspicious activity
details:
type: array
title: Collection of details about suspicious activity
additionalItems: true
items:
type: object
title: Detail items
additionalProperties: true
properties:
timestamp:
type: string
title: Timestamp
examples:
- '2020-03-25 14:56:12'
path:
type: string
title: Path
examples:
- C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE
detected_by:
type: array
title: Detected by collection
additionalItems: true
items:
type: object
title: Detected by items
additionalProperties: true
properties:
description:
type: string
title: Description
examples:
- A suspicious script has been executed by Powershell
verbose:
type: string
title: Verbose Description
examples:
- A suspicious script has been executed by Powershell
tag:
type: string
title: Tag
examples:
- powershell scripting activity
content:
type: array
title: The Content Schema
default: []
examples:
- - launched_proc: POWERSHELL.EXE
hash:
Sha256: 908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53
Sha1: 36c5d12033b2eaf251bae61c00690ffb17fddc87
Md5: cda48fc75952ad12d99e526d0b6bf70a
Sha512: 31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0
command_line: '"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -File "C:\Program Files\EAWindowsTool\EAWindowsTool.ps1 '
additionalItems: true
items:
type: object
title: The Items Schema
additionalProperties: true
properties:
command_line:
type: string
title: Command line
examples:
- '"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -File "C:\Program Files\EAWindowsTool\EAWindowsTool.ps1 '
hash:
type: object
title: Hashes
additionalProperties: true
properties:
Md5:
type: string
title: Md5
Sha1:
type: string
title: Sha1
examples:
- 36c5d12033b2eaf251bae61c00690ffb17fddc87
Sha256:
type: string
title: Sha256
examples:
- 908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53
Sha512:
type: string
title: Sha512
examples:
- 31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0
launched_proc:
type: string
title: Launched process
examples:
- POWERSHELL.EXE
level:
type: integer
title: Level
pid:
type: integer
title: Process ID
pid:
type: integer
title: Process ID
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
tags:
- Suspicious Activity
operationId: api.nebula.post.suspiciousactivity.details
/oneview/v1/accounts/{account_id}/sa:
servers:
- url: https://api.threatdown.com
get:
description: Fetch suspicious activity records of the account.
summary: Suspicious activity of the account
security:
- client_credentials:
- read
- user_permissions:
- edr.view
status:
outage:
- auth
- edr
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: sort_field
required: false
in: query
description: Sort field
schema:
type: string
enum:
- timestamp
- level
- pc_hostname
- name: sort_direction
required: false
in: query
description: Sort direction
schema:
type: string
enum:
- asc
- desc
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
- name: since
required: false
in: query
description: Since (Ex. "2020-03-23T17:23:17.860482Z")
schema:
type: string
pattern: ^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))$
- name: before
required: false
in: query
description: Before (Ex. "2020-03-23T17:23:17.860482Z")
schema:
type: string
pattern: ^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))$
- name: group_ids
required: false
in: query
description: Group ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type:
- string
- array
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: per_page
required: false
in: query
description: Page size
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Suspicious activity response
required:
- sa
- total_count
properties:
sa:
type: array
title: Suspicious activity
items:
type: object
title: Suspicious activity items
additionalProperties: true
properties:
detection_id_list:
type: array
title: List of detections IDs
items:
type: number
status:
type: string
title: Status
timestamp:
type: string
title: Timestamp
path:
type: string
title: Path
pc_hostname:
type: string
title: Hostname of PC
machine_id:
type: string
title: placeholder
account_id:
type: string
title: Account ID
closed:
type: integer
title: Closed
level:
type: integer
title: Level
detected_by_count:
type: integer
title: Count
total_count:
type: integer
title: Total count
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
tags:
- Suspicious Activity
operationId: api.rmm.get.suspiciousactivity
/oneview/v1/accounts/{account_id}/sa/{id}/process_graph:
servers:
- url: https://api.threatdown.com
get:
description: Fetch process graph of suspicious activity.
summary: Suspicious activity process graph
security:
- client_credentials:
- read
- user_permissions:
- edr.view
status:
outage:
- auth
- edr
parameters:
- name: account_id
required: true
in: path
description: Valid Account UUID
schema:
type: string
- name: id
required: true
in: path
description: ID of suspicious activity
schema:
type: string
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Process graph of suspicious activity
additionalProperties: true
properties:
data:
type: object
title: Data
additionalProperties: true
properties:
node_type:
type: string
title: Node type
children:
type: array
title: Children of this node
default: []
additionalItems: true
items:
type: object
title: Items of childres
additionalProperties: true
properties:
id:
type: string
title: ID
name:
type: string
title: Name
examples:
- EXPLORER.EXE
node_type:
type: string
title: Node type
examples:
- Process
children:
type: array
title: Children of this node. Follows the same structure as current node.
additionalItems: true
items:
type: object
title: Children items
additionalProperties: true
node_info:
type: object
title: Node info
additionalProperties: true
properties:
activities:
type: array
title: Activities
default: []
items:
type: object
title: Activities items
additionalProperties: true
additionalItems: true
process_id:
type: integer
title: Process id - PID
examples:
- 5696
dropped:
type: boolean
title: Dropped
process_path:
type: string
title: Process path
examples:
- C:\WINDOWS\EXPLORER.EXE
name:
type: string
title: Name
examples:
- START
id:
type: string
title: ID
examples:
- '-'
tags:
- Suspicious Activity
operationId: api.rmm.get.suspiciousactivity.process_graph
/oneview/v1/accounts/{account_id}/sa/close:
servers:
- url: https://api.threatdown.com
post:
description: Placeholder. Please extend this
summary: Placeholder. Please extend this
deprecated: false
security:
- client_credentials:
- read
- user_permissions:
- edr.manage
status:
outage:
- auth
- edr
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Payload to open/close a suspicious activity
properties:
account_id:
type: string
title: Account ID of the Site on which execute command (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
detection_id_list:
type: array
title: Array of integers indicating the detections on which execute remediation
items:
type: integer
machine_id:
type: string
title: ID of the machine on which execute command (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
user_email:
type: string
title: Email of user executing command
user_id:
type: string
title: ID of user executing command
username:
type: string
title: Email of who's executing command
required:
- account_id
- detection_id_li
# --- truncated at 32 KB (48 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-suspicious-activity-api-openapi.yml