Malwarebytes Syslog API
The Syslog API from Malwarebytes — 5 operation(s) for syslog.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/malwarebytes:malwarebytes-syslog-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: ThreatDown Syslog API
description: '# Introduction
ThreatDown OneView APIs provide you resources to remotely manage the security of your devices from code. It integrates ThreatDown protection into your workflows and pipelines. The following are some of the actions you can do with OneView APIs:
- Manage the security of your endpoints. - Analyze endpoint assets. - Perform advance analysis on detections of malware, ransomware, exploits, and other threats by ThreatDown Endpoint Agent. - Scan, isolate, remediate, and reboot endpoints. - Create new sites. - Provision OneView users. - Create subscriptions for your customers. - Subscribe to security Webhook events to get notified of detections. ## Authentication
ThreatDown API uses OAuth2 to allow secure authorization in a simple and standard method from web, mobile, and desktop applications. Refer to the Authentication endpoint to retrieve an `access_token` using your `client_id` and `client_secret`. ## Access'' scopes
Access scopes are the permissions that applications require for authorization and use. When creating a new application, you can decide the access level the application has to your account''s data. This utility allows you to restrict the scope of access to your account''s data depending on the application''s needs. For example, if you only need to analyze detections found on your endpoint, the read scope will be enough to prevent that application from modifying data or issuing jobs. Specifying access scopes gives you control over the access of your data. You can set different scopes to provide the appropriate credentials to your team. For example, you may want your company''s IT department to be able to isolate infected endpoints, while you may want your analysts to only read data for generating reports. To do so, you can create two applications using different scopes, and provide the right people with the right pair of credentials for programmatic access. See Authentication for available scopes. ## User permissions
The user associated with the client (i.e. the user that created the OAuth2 application) must have the required permissions to perform the requested operation. If the user does not have sufficient permissions, the API will respond with a `403 Forbidden` status code. For each API, you can find the required permissions in the AUTHORIZATIONS dropdown, under `user_permissions`. Some API requires additional permissions based on the data in the body:
- **jobs** issue API requires `.performActions` depending on the `command` (\ can be `endpoints`, `softwareInventory`, or `detections`)
- **notifications** create/update API requires `.view` depending on the `category`
- **reports** create/update API requires `.view` depending on the `type`
## Getting Started
After having obtained an `access_token`, you will be able to create Sites which you will be able to manage through apis. Once you have created a customer, the next step is to use the Subscription APIs to assign a valid subscription for your customer. This will attach an `account_id` property to your Sites resources that you can use for Endpoints, Detections, Jobs, Webhooks and other APIs for security management. ## Rate Limiting
ThreatDown API implements a rate-limiting mechanism to prevent abuse. The rate-limiting mechanism is implemented using a leaky bucket algorithm. Once you exceed the available limit, our server will respond with a `429` status code. You can throttle your requests and retry them later. The current limit, which you can see in the table below, has shown to be enough for most use cases. If you encounter `429` error codes, consider taking the following actions to minimize your APIs usage:
- Subscribe to webhooks events instead of polling the API for reacting to changes. - Throttle the requests you send to the ThreatDown API for not exceeding the limit. - Batch requests when possible. - Contact us and request to increase the API quota for your application. Currently, the default available quota is `360` requests per minute.'
version: 1.0.0
x-logo:
altText: ThreatDown logo
url: https://assets.threatdown.com/hermes/ThreatDown_Horizontal_Navy.png
backgroundColor: '#FFFFFF'
servers:
- url: https://api.threatdown.com
tags:
- name: Syslog
paths:
/oneview/v1/accounts/{account_id}/syslog:
get:
description: Get syslog config records by account id.
summary: Get syslog config records
security:
- client_credentials:
- read
- user_permissions:
- syslog.view
status:
outage:
- auth
parameters:
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: array
title: SyslogConfigsList
items:
type: object
title: SyslogConfig
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
account_id:
type: string
title: The account id to which this syslog config belong
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
machines:
type: array
title: Array of machines
items:
type: object
title: Machine object
properties:
id:
type: string
title: The Id of machine
enabled:
type: boolean
title: Is endpoint syslog enabled
tags:
- Syslog
operationId: api.rmm.get.syslog
post:
description: Create new syslog config record.
summary: Create new syslog config record
security:
- client_credentials:
- write
- user_permissions:
- syslog.manage
status:
outage:
- auth
parameters:
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: SyslogCreate
additionalProperties: true
properties:
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: SyslogConfig
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
account_id:
type: string
title: The account id to which this syslog config belong
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
machines:
type: array
title: Array of machines
items:
type: object
title: Machine object
properties:
id:
type: string
title: The Id of machine
enabled:
type: boolean
title: Is endpoint syslog enabled
tags:
- Syslog
operationId: api.rmm.post.syslog
/oneview/v1/accounts/{account_id}/syslog/{id}:
get:
description: Get syslog config record by account id and config id.
summary: Get syslog config record by id
security:
- client_credentials:
- read
- user_permissions:
- syslog.view
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: SyslogConfig
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
account_id:
type: string
title: The account id to which this syslog config belong
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
machines:
type: array
title: Array of machines
items:
type: object
title: Machine object
properties:
id:
type: string
title: The Id of machine
enabled:
type: boolean
title: Is endpoint syslog enabled
tags:
- Syslog
operationId: api.rmm.getbyid.syslog
put:
description: Update syslog config by account_id and config id.
summary: Update syslog config
security:
- client_credentials:
- write
- user_permissions:
- syslog.manage
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: SyslogUpdate
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: SyslogConfig
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
account_id:
type: string
title: The account id to which this syslog config belong
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
machines:
type: array
title: Array of machines
items:
type: object
title: Machine object
properties:
id:
type: string
title: The Id of machine
enabled:
type: boolean
title: Is endpoint syslog enabled
tags:
- Syslog
operationId: api.rmm.put.syslog
/oneview/v1/syslog:
post:
description: Search syslog configs by multiple accounts.
summary: Search syslog configs by multiple accounts
security:
- client_credentials:
- read
- user_permissions:
- syslog.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
required:
- account_ids
properties:
account_ids:
type: array
title: The account ids to filter your search
minItems: 1
items:
type: string
title: Account id items (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Syslog search reponse.
properties:
syslog:
type: array
title: syslogs
items:
type: object
title: SyslogConfig
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
account_id:
type: string
title: The account id to which this syslog config belong
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
machines:
type: array
title: Array of machines
items:
type: object
title: Machine object
properties:
id:
type: string
title: The Id of machine
enabled:
type: boolean
title: Is endpoint syslog enabled
total_count:
type: number
title: Total count
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
additionalProperties: false
tags:
- Syslog
operationId: api.rmm.post.syslog.search
/oneview/v1/accounts/{account_id}/syslog/{id}/machines:
post:
description: Assign syslog config machines.
summary: Assign syslog config machines
security:
- client_credentials:
- write
- user_permissions:
- syslog.manage
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: SyslogMachines
additionalProperties: true
properties:
machine_ids:
type: array
title: Array of machine ids
items:
type: string
title: Machine Id
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: SyslogConfig
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
account_id:
type: string
title: The account id to which this syslog config belong
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
machines:
type: array
title: Array of machines
items:
type: object
title: Machine object
properties:
id:
type: string
title: The Id of machine
enabled:
type: boolean
title: Is endpoint syslog enabled
tags:
- Syslog
operationId: api.rmm.post.syslog.machines
/oneview/v1/accounts/{account_id}/syslog/{id}/machines/{machine_id}:
post:
description: Set syslog machine enabled/disabled.
summary: Set syslog machine enabled
security:
- client_credentials:
- write
- user_permissions:
- syslog.manage
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: machine_id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Syslog toggle machine body
properties:
enabled:
type: boolean
title: Enable syslog for machine
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: SyslogConfig
additionalProperties: true
properties:
id:
type: string
title: The Id of syslog
account_id:
type: string
title: The account id to which this syslog config belong
name:
type: string
title: The name of the syslog
host:
type: string
title: Host ip
port:
type: number
title: Host port
protocol:
type: string
title: Protocol
enum:
- TCP
- UDP
interval:
type: number
title: Interval in minutes (5-1440)
format:
type: string
title: Format of logs
severity:
type: number
title: Severity of events (0-10)
machines:
type: array
title: Array of machines
items:
type: object
title: Machine object
properties:
id:
type: string
title: The Id of machine
enabled:
type: boolean
title: Is endpoint syslog enabled
tags:
- Syslog
operationId: api.rmm.nebula.post.syslog.machines.enable
components:
securitySchemes:
client_credentials:
type: oauth2
flows:
clientCredentials:
tokenUrl: /oneview/oauth2/token
scopes:
read: Read data of your Nebula account
write: Write access. Create Users, Sites, Policies, Exclusions and other resources
execute: Issue jobs on your endpoints, like Scan, Reboot or Isolate.
user_permissions:
type: http
scheme: bearer