Malwarebytes Vulnerability Assessment API
The Vulnerability Assessment API from Malwarebytes — 5 operation(s) for vulnerability assessment.
OpenAPI Specification
openapi: 3.2.0
info:
title: ThreatDown Vulnerability Assessment API
description: "# Introduction\nThreatDown OneView APIs provide you resources to remotely manage the security of your devices from code. It integrates ThreatDown protection into your workflows and pipelines. The following are some of the actions you can do with OneView APIs:\n\n- Manage the security of your endpoints.\n- Analyze endpoint assets.\n- Perform advance analysis on detections of malware, ransomware, exploits, and other threats by ThreatDown Endpoint Agent.\n- Scan, isolate, remediate, and reboot endpoints.\n- Create new sites.\n- Provision OneView users.\n- Create subscriptions for your customers.\n- Subscribe to security Webhook events to get notified of detections.\n\n## Authentication\n\nThreatDown API uses OAuth2 to allow secure authorization in a simple and standard method from web, mobile, and desktop applications.\n\nRefer to the [Authentication](#operation/api.oneview.oauth2.token) endpoint to retrieve an `access_token` using your `client_id` and `client_secret`.\n\n## Access' scopes\n\nAccess scopes are the permissions that applications require for authorization and use. \n\nWhen creating a new application, you can decide the access level the application has to your account's data. This utility allows you to restrict the scope of access to your account's data depending on the application's needs. For example, if you only need to analyze detections found on your endpoint, the read scope will be enough to prevent that application from modifying data or issuing jobs.\n\nSpecifying access scopes gives you control over the access of your data. You can set different scopes to provide the appropriate credentials to your team. For example, you may want your company's IT department to be able to isolate infected endpoints, while you may want your analysts to only read data for generating reports. To do so, you can create two applications using different scopes, and provide the right people with the right pair of credentials for programmatic access.\n\nSee [Authentication](#operation/api.oneview.oauth2.token) for available scopes.\n\n## User permissions\n\nThe user associated with the client (i.e. the user that created the OAuth2 application) must have the required permissions to perform the requested operation. If the user does not have sufficient permissions, the API will respond with a `403 Forbidden` status code.\nFor each API, you can find the required permissions in the AUTHORIZATIONS dropdown, under `user_permissions`.\n\nSome API requires additional permissions based on the data in the body:\n- **jobs** issue API requires `<entity>.performActions` depending on the `command` (\\<entity\\> can be `endpoints`, `softwareInventory`, or `detections`)\n- **notifications** create/update API requires `<entity>.view` depending on the `category`\n- **reports** create/update API requires `<entity>.view` depending on the `type`\n\n## Getting Started\n\nAfter having obtained an `access_token`, you will be able to create [Sites](#tag/Sites) which you will be able to manage through apis.\n\nOnce you have created a customer, the next step is to use the [Subscription](#tag/Subscriptions) APIs to assign a valid subscription for your customer. This will attach an `account_id` property to your [Sites](#tag/Sites) resources that you can use for [Endpoints](#tag/Endpoints), [Detections](#tag/Detections), [Jobs](#tag/Jobs), [Webhooks](#tag/Webhooks) and other APIs for security management.\n\n## Rate Limiting\n\nThreatDown API implements a rate-limiting mechanism to prevent abuse. The rate-limiting mechanism is implemented using a leaky bucket algorithm. Once you exceed the available limit, our server will respond with a `429` status code. You can throttle your requests and retry them later.\n\nThe current limit, which you can see in the table below, has shown to be enough for most use cases. If you encounter `429` error codes, consider taking the following actions to minimize your APIs usage:\n\n- Subscribe to webhooks events instead of polling the API for reacting to changes.\n- Throttle the requests you send to the ThreatDown API for not exceeding the limit.\n- Batch requests when possible.\n- Contact us and request to increase the API quota for your application.\n\nCurrently, the default available quota is `360` requests per minute.\n\n## Available catalog codes\n\nProtection:\n\n- `BUS-CLOUD-IR-01` - ThreatDown Incident Response\n- `BUS-CLOUD-EPP-01` - ThreatDown Endpoint Protection\n- `BUS-CLOUD-EPP-SER-01` - ThreatDown Endpoint Protection for Servers\n- `BUS-CLOUD-EPR-01` - ThreatDown Endpoint Detection and Response\n- `BUS-CLOUD-EDR-SER-01` - ThreatDown Endpoint Detection and Response for Servers\n- `BUS-MBCM-01` - ThreatDown Mobile Security for Business\n\nModules:\n\n- `BUS-MBVM-01` - ThreatDown Vulnerability Assessment\n- `BUS-MBVPM-01` - ThreatDown Vulnerability & Patch Management\n- `BUS-MBDNS-01` - ThreatDown DNS Filtering\n- `BUS-MBAB-01` - ThreatDown Application Block\n- `BUS-CLOUD-MDR-FR30-01` - MDR Data Retention - 30 days\n- `BUS-CLOUD-MDR-01` - ThreatDown Managed Detection and Response\n- `BUS-TDEMS-01` - Email Security\n"
version: 1.0.0
x-logo:
altText: ThreatDown logo
url: https://assets.threatdown.com/hermes/ThreatDown_Horizontal_Navy.png
backgroundColor: '#FFFFFF'
servers:
- url: https://api.threatdown.com
tags:
- name: Vulnerability Assessment
paths:
/oneview/v1/vulnerability-assessment/report:
post:
description: Get vulnerability assessment report for accounts
summary: Get vulnerability assessment report
security:
- client_credentials:
- read
- user_permissions:
- vulnerabilities.view
status:
outage:
- auth
- search_stateless
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
allOf:
- type: object
required:
- account_ids
properties:
account_ids:
type: array
title: The account ids to filter your search
minItems: 1
items:
type: string
title: Account id items (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
properties:
aggregate:
type: boolean
default: false
description: When true, the report is aggregated across all account_ids. When false, results are returned per account.
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
properties:
results:
type: array
items:
type: object
properties:
account_id:
type: string
aggregated:
type: boolean
endpoints_total:
type: number
accounts_total:
type: number
cves:
type: object
properties:
endpoints:
type: number
total:
type: number
required:
- endpoints
- total
critical_cves:
type: object
properties:
endpoints:
type: number
total:
type: number
total_within_thirty_days:
type: number
endpoints_within_thirty_days:
type: number
required:
- endpoints
- total
- total_within_thirty_days
critical_os_patches:
type: object
properties:
endpoints:
type: number
total:
type: number
required:
- endpoints
- total
cisa_cves:
type: object
properties:
endpoints:
type: number
total:
type: number
total_within_twenty_one_days:
type: number
endpoints_total:
type: number
endpoints_percentage:
type: number
required:
- endpoints
- total
- total_within_twenty_one_days
- endpoints_total
- endpoints_percentage
known_ransomware_campaign_use:
type: object
properties:
endpoints:
type: number
total:
type: number
required:
- endpoints
- total
os_patches:
type: object
properties:
endpoints_percentage:
type: number
required:
- endpoints_percentage
cves_by_severity:
type: object
properties:
critical_percentage:
type: number
high_percentage:
type: number
medium_percentage:
type: number
low_percentage:
type: number
unknown_percentage:
type: number
required:
- critical_percentage
- high_percentage
- medium_percentage
- low_percentage
- unknown_percentage
critical_software:
type: array
items:
type: object
properties:
display_product:
type: string
endpoints:
type: number
cves:
type: number
cisa_cves:
type: number
required:
- display_product
- endpoints
- cves
- cisa_cves
high_risk_sites:
type: array
items:
type: object
properties:
account_id:
type: string
critical_cves:
type: number
known_ransomware_campaign_use:
type: number
critical_os_patches:
type: number
cisa_cves:
type: number
endpoints:
type: number
affected_endpoints:
type: number
required:
- critical_cves
- known_ransomware_campaign_use
- critical_os_patches
- cisa_cves
- endpoints
required:
- endpoints_total
- accounts_total
- cves
- critical_cves
- critical_os_patches
- cisa_cves
- known_ransomware_campaign_use
- os_patches
- cves_by_severity
- critical_software
- high_risk_sites
required:
- results
tags:
- Vulnerability Assessment
operationId: api.rmm.vulnerability-assessment.report
/oneview/v1/vulnerability-assessment/cve-stats:
post:
description: Get vulnerability assessment CVE statistics for accounts
summary: Get vulnerability assessment CVE statistics
security:
- client_credentials:
- read
- user_permissions:
- vulnerabilities.view
status:
outage:
- auth
- search_stateless
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
allOf:
- type: object
required:
- account_ids
properties:
account_ids:
type: array
title: The account ids to filter your search
minItems: 1
items:
type: string
title: Account id items (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
properties:
cve_id:
type: string
description: The CVE ID to retrieve stats for
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
properties:
total:
type: number
accounts:
type: number
endpoints:
type: number
tags:
- Vulnerability Assessment
operationId: api.rmm.vulnerability-assessment.cve.stats
/oneview/v1/vulnerability-assessment/details:
post:
description: Get vulnerability assessment details for accounts
summary: Get vulnerability assessment details
security:
- client_credentials:
- read
- user_permissions:
- vulnerabilities.view
status:
outage:
- auth
- search_stateless
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
allOf:
- type: object
required:
- account_ids
properties:
account_ids:
type: array
title: The account ids to filter your search
minItems: 1
items:
type: string
title: Account id items (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
additionalProperties:
type: object
properties:
severity:
type: object
additionalProperties:
type: object
properties:
total:
type: number
required:
- total
additionalProperties: false
machine_id_total:
type: number
known_ransomware_campaign_use_total:
type: number
critical_os_patches_total:
type: number
last_asset_scan_at:
type:
- string
- 'null'
has_va:
type: boolean
has_vpm:
type: boolean
tags:
- Vulnerability Assessment
operationId: api.rmm.vulnerability-assessment.details
/oneview/v1/vulnerability-assessment/software-stats:
post:
description: Get vulnerability assessment software statistics for accounts
summary: Get vulnerability assessment software statistics
security:
- client_credentials:
- read
- user_permissions:
- vulnerabilities.view
status:
outage:
- auth
- search_stateless
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
required:
- account_ids
properties:
account_ids:
type: array
title: The account ids to filter your search
minItems: 1
items:
type: string
title: Account id items (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
properties:
updatable_software_percentage:
type: number
description: The percentage of software with available updates.
tags:
- Vulnerability Assessment
operationId: api.rmm.vulnerability-assessment.software.stats
/oneview/v1/vulnerability-assessment/summary:
post:
description: Get vulnerability assessment summary for accounts
summary: Get vulnerability assessment summary
security:
- client_credentials:
- read
- user_permissions:
- vulnerabilities.view
status:
outage:
- auth
- search_stateless
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
allOf:
- type: object
required:
- account_ids
properties:
account_ids:
type: array
title: The account ids to filter your search
minItems: 1
items:
type: string
title: Account id items (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
definitions:
total_counts:
type: object
properties:
total:
type: number
accounts:
type: number
required:
- total
- accounts
properties: {}
tags:
- Vulnerability Assessment
operationId: api.rmm.vulnerability-assessment.summary
components:
securitySchemes:
client_credentials:
type: oauth2
flows:
clientCredentials:
tokenUrl: /oneview/oauth2/token
scopes:
read: Read data of your Nebula account
write: Write access. Create Users, Sites, Policies, Exclusions and other resources
execute: Issue jobs on your endpoints, like Scan, Reboot or Isolate.
user_permissions:
type: http
scheme: bearer