McAfee (Trellix) Threats API

openapi: 3.2.0
info:
  title: McAfee MVISION Threats API
  description: McAfee MVISION cloud-native security platform API for endpoint detection and response (EDR), threat prevention, device management, and incident investigation. Provides access to detections, threats, devices, and investigation workflows.
  version: '2.0'
  contact:
    name: McAfee Support
    url: https://www.mcafee.com/enterprise/en-us/support.html
  termsOfService: https://www.mcafee.com/enterprise/en-us/about/legal/terms-of-use.html
servers:
- url: https://api.mvision.mcafee.com
  description: MVISION Cloud Production
security:
- bearerAuth: []
tags:
- name: Threats
  description: Retrieve and manage detected threats
paths:
  /edr/v2/threats:
    get:
      operationId: listThreats
      summary: McAfee List threats
      description: Retrieve a paginated list of detected threats across all managed endpoints, with optional filtering by severity, status, and time range.
      tags:
      - Threats
      parameters:
      - name: filter[severity]
        in: query
        required: false
        description: Filter threats by severity level
        schema:
          type: string
          enum:
          - low
          - medium
          - high
          - critical
      - name: filter[status]
        in: query
        required: false
        description: Filter threats by current status
        schema:
          type: string
          enum:
          - new
          - investigating
          - resolved
          - dismissed
      - name: filter[detectedAfter]
        in: query
        required: false
        description: Filter threats detected after this ISO 8601 timestamp
        schema:
          type: string
          format: date-time
      - $ref: '#/components/parameters/pageLimit'
      - $ref: '#/components/parameters/pageOffset'
      responses:
        '200':
          description: Paginated list of threats
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/ThreatListResponse'
        '401':
          description: Unauthorized
  /edr/v2/threats/{threatId}:
    get:
      operationId: getThreat
      summary: McAfee Get a specific threat
      description: Retrieve detailed information about a specific threat by its unique ID, including affected hosts, threat indicators, and remediation status.
      tags:
      - Threats
      parameters:
      - $ref: '#/components/parameters/threatId'
      responses:
        '200':
          description: Threat details
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/ThreatResponse'
        '401':
          description: Unauthorized
        '404':
          description: Threat not found
    patch:
      operationId: updateThreat
      summary: McAfee Update threat status
      description: Update the status or assignment of a specific threat, such as marking it as investigating, resolved, or dismissed.
      tags:
      - Threats
      parameters:
      - $ref: '#/components/parameters/threatId'
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum:
                      - threats
                    id:
                      type: string
                    attributes:
                      type: object
                      properties:
                        status:
                          type: string
                          enum:
                          - new
                          - investigating
                          - resolved
                          - dismissed
      responses:
        '200':
          description: Threat updated successfully
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/ThreatResponse'
        '401':
          description: Unauthorized
        '404':
          description: Threat not found
components:
  schemas:
    ThreatListResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Threat'
        meta:
          $ref: '#/components/schemas/PaginationMeta'
    PaginationMeta:
      type: object
      properties:
        totalCount:
          type: integer
          description: Total number of matching records
        pageLimit:
          type: integer
          description: Current page size limit
        pageOffset:
          type: integer
          description: Current offset
    Threat:
      type: object
      properties:
        id:
          type: string
          description: Unique threat ID
        type:
          type: string
          enum:
          - threats
        attributes:
          type: object
          properties:
            name:
              type: string
              description: Threat name
            severity:
              type: string
              enum:
              - low
              - medium
              - high
              - critical
              description: Threat severity level
            status:
              type: string
              enum:
              - new
              - investigating
              - resolved
              - dismissed
              description: Current threat status
            detectedAt:
              type: string
              format: date-time
              description: Detection timestamp
            hostName:
              type: string
              description: Affected hostname
            processName:
              type: string
              description: Associated process name
            filePath:
              type: string
              description: Associated file path
            sha256:
              type: string
              description: SHA-256 hash of the associated file
            mitreAttackTechnique:
              type: string
              description: MITRE ATT&CK technique ID
    ThreatResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Threat'
  parameters:
    pageLimit:
      name: page[limit]
      in: query
      required: false
      description: Maximum number of results to return per page
      schema:
        type: integer
        default: 20
        maximum: 100
    pageOffset:
      name: page[offset]
      in: query
      required: false
      description: Number of results to skip for pagination
      schema:
        type: integer
        default: 0
    threatId:
      name: threatId
      in: path
      required: true
      description: Unique threat identifier
      schema:
        type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 bearer token from client credentials grant
externalDocs:
  description: McAfee MVISION Developer Documentation
  url: https://developer.mvision.mcafee.com/