> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns. > > **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal): > ```bash > npx -y @scalekit-inc/cli setup -y > ``` > > Global: > ```bash > npm install -g @scalekit-inc/cli > scalekit setup -y > ``` > > Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`. > Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim. > [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/) --- # Connect AI agents to Malwarebytes The Malwarebytes connector lets your AI agent act in each user's Malwarebytes account. Each user signs in to Malwarebytes once, and Scalekit stores and refreshes their tokens, so your agent never handles credentials. It comes with 74 tools. **Authentication:** OAuth 2.0 Client Credentials **Categories:** Monitoring **Tools:** 74: 51 read, 17 write, 6 destructive **Users sign in with:** Service account **Built by:** Scalekit connector **Try it:** [Playground in the Scalekit dashboard](https://app.scalekit.com/ws/signup?sk_intent=playground&provider=MALWAREBYTES) ## Setup 1. ### Install the SDK **Node.js** ```bash npm install @scalekit-sdk/node dotenv ``` **Python** ```bash pip install scalekit-sdk-python python-dotenv ``` 2. ### Set your credentials Add your Scalekit credentials to your `.env` file. Find values in **[app.scalekit.com](https://app.scalekit.com)** > **Developers** > **API Credentials**. ```sh title=".env" SCALEKIT_ENVIRONMENT_URL= SCALEKIT_CLIENT_ID= SCALEKIT_CLIENT_SECRET= ``` 3. ### Create the Malwarebytes connection In **AgentKit > Connections**, create a Malwarebytes connection. The name you give it is the `connection_name` your code passes. See [Configure connections](/agentkit/connections/). ## Tools Pass the exact name to `execute_tool`, with an input like each tool's example. To ask for a tool that's missing, use the [request form](https://scalekitsupport.portal.usepylon.com/forms/request-a-connector-tool). **Node.js** ```typescript const result = await actions.executeTool({ toolName: 'malwarebytes_account_get', toolInput: { accountid: '', }, connector: 'malwarebytes', identifier: 'user_123', }) ``` **Python** ```python result = actions.execute_tool( tool_name="malwarebytes_account_get", tool_input={ "accountid": "", }, connection_name="malwarebytes", identifier="user_123", ) ``` `result.data` is the app's response as JSON, and `result.execution_id` (`executionId` in Node.js) is the ID of the call. ### `malwarebytes_account_get` Account Get · Read-only Get the Nebula account details for the account ID supplied. Returns license_key, id, name, options, account_token, client_id and more fields. Use to confirm the account ID and credentials work, or to find the default policy and group IDs. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":""}` ### `malwarebytes_app_block_rule_get` App Block Rule Get · Read-only Get one application block rule by ID. Returns rule, rule_set_id, created_at, created_by, updated_at, updated_by and more fields. Use when you have a rule ID from app_block_rule_search. Needs a rule ID from app_block_rule_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `rule_id` (`string`, required): ID of the application block rule. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","rule_id":""}` ### `malwarebytes_app_block_rule_search` App Block Rule Search · Read-only Search application block rules. Returns total_count, app_block_rules, next_cursor fields. Use to find app block rule IDs. Use app_block_rule_get for one rule. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. Example input: `{"accountid":""}` ### `malwarebytes_asset_software_search` Asset Software Search · Read-only Search installed software across all endpoints. Returns assets, aggregations, total_count, next_cursor fields. Use to find which endpoints run a given product or version. Use endpoint_assets_get for one endpoint. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_id` (`string`, optional): Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_name` (`string`, optional): Filter the search by group name. Search for the matches that contain the value. Example: Example. - `host_name` (`string`, optional): Filter the search by host_name. Search for the matches that contain the value. Example: Example. - `installed_version` (`string`, optional): Filter the search by installed_version. Search for the matches that contain the value. Example: example. - `machine_id` (`string`, optional): Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `name_multi_search` (`string`, optional): Aliases for this machine. Example: WORKSTATION-01. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `product` (`string`, optional): Filter the search by product. Search for the matches that contain the value. Example: Example. - `sort_field` (`string`, optional): Sort field. Example: account_id. One of: `account_id`, `parent_account_id`, `group_id`, `root_group_id`, `machine_id`, `account_name`, `host_name`, `fully_qualified_host_name`, `alias`, `name_multi_search`, `vendor`, `normalized_vendor`, `display_vendor`, `product`, `normalized_product`, `display_product`, `installed_version`, `normalized_installed_version`, `display_installed_version`, `os_info.os_type`, `os_info.os_version`, `os_info.os_platform`, `os_info.os_architecture`, `os_info.os_release_name`, `installation_date`, `created_at`, `object_guid`, `latest_version_available`, `cves`, `cves_by_status.unknown`, `cves_by_status.low`, `cves_by_status.medium`, `cves_by_status.high`, `cves_by_status.critical`, `cves_score`, `cves_count`, `cves_count_by_status.unknown`, `cves_count_by_status.low`, `cves_count_by_status.medium`, `cves_count_by_status.high`, `cves_count_by_status.critical`, `language`, `architecture`, `product_signature`, `categories`, `supports_update`, `supports_uninstall`, `update_available`, `domain_name`, `active_directory.user.display_name`, `active_directory.machine.display_name`, `active_directory.user.ou`, `active_directory.machine.ou`, `active_directory.user.sam_account_name`, `active_directory.machine.sam_account_name`, `ignored_until`. - `sort_order` (`string`, optional): Sorting direction. Example: asc. One of: `asc`, `desc`. - `update_available` (`boolean`, optional): Filter the search by update_available. Search for an exact match. Example: true. - `update_ignored` (`boolean`, optional): Filter the search to only include ignored software updates. Example: true. - `vendor` (`string`, optional): Filter the search by vendor. Search for the matches that contain the value. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_cve_bulk_get` CVE Bulk Get · Read-only Get the details of several CVEs by CVE ID in one request. Returns a JSON array with one CVE detail object per requested ID. Use to look up many CVE IDs at once. Use cve_get for one. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `ids` (`array`, required): CVE IDs to look up, as a JSON array of strings such as ["CVE-2024-3094"]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. Example input: `{"accountid":"","ids":["9256034b-7967-4253-a5d9-260663e4fa4f"]}` ### `malwarebytes_cve_get` CVE Get · Read-only Get the details of one CVE by its CVE ID. Returns cve, cwe, is_cisa_exploitable, known_ransomware_campaign_use, published_epoch, last_modified_epoch and more fields. Use for CVSS scores, references and exploit information of a known CVE. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `cve_id` (`string`, required): CVE identifier. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","cve_id":""}` ### `malwarebytes_cve_search` CVE Search · Read-only Search vulnerabilities (CVEs) found on endpoints with filters, sorting and cursor pagination. Returns results, aggregations, total_count, next_cursor fields. Use to find affected endpoints and software. Use cve_get for details of one CVE ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `cisa_exploitable` (`boolean`, optional): Filter the search by cisa_exploitable. Search for an exact match. Example: true. - `cve_id` (`string`, optional): Filter the search by cve_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_id` (`string`, optional): Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_name` (`string`, optional): Filter the search by group_name. Search for an exact match. Example: Example. - `host_name` (`string`, optional): Filter the search by host_name. Search for an exact match. Example: Example. - `installed_version` (`string`, optional): Filter the search by installed_version. Search for an exact match. Example: example. - `known_ransomware_campaign_use` (`boolean`, optional): Filter the search by known_ransomware_campaign_use. Search for an exact match. Example: true. - `machine_id` (`string`, optional): Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `name_multi_search` (`string`, optional): Filter with alises. Example: WORKSTATION-01. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `only_ignored_cves` (`boolean`, optional): Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false. Example: true. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `product` (`string`, optional): Filter the search by product. Search for an exact match. Example: Example. - `severity` (`string`, optional): Filter the search by severity. Search for an exact match. Example: example. - `sort_field` (`string`, optional): Sort field. Example: account_id. One of: `account_id`, `account_name`, `parent_account_id`, `group_id`, `root_group_id`, `machine_id`, `object_guid`, `host_name`, `fully_qualified_host_name`, `alias`, `sort_name`, `vendor`, `normalized_vendor`, `display_vendor`, `product`, `normalized_product`, `display_product`, `installed_version`, `normalized_installed_version`, `display_installed_version`, `os_info.os_type`, `os_info.os_version`, `os_info.os_platform`, `os_info.os_architecture`, `os_info.os_release_name`, `cve_id`, `severity`, `installation_date`, `created_at`, `published_at`, `cisa_exploitable`, `known_ransomware_campaign_use`, `severity_score`, `cvss20_score`, `cvss30_score`, `group_name`, `domain_name`, `supports_update`, `supports_uninstall`, `ignored_until`, `ignored_at`, `active_directory.user.display_name`, `active_directory.machine.display_name`, `active_directory.user.ou`, `active_directory.machine.ou`, `active_directory.user.sam_account_name`, `active_directory.machine.sam_account_name`. - `sort_order` (`string`, optional): Sorting direction. Example: asc. One of: `asc`, `desc`. - `vendor` (`string`, optional): Filter the search by vendor. Search for an exact match. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_detection_get` Detection Get · Read-only Get one detection by ID. Returns id, scan_id, machine_id, machine_name, group_id, group_name and more fields. Use when you have a detection ID from detection_search. Needs a detection ID from detection_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `detection_id` (`string`, required): ID of the detection. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","detection_id":""}` ### `malwarebytes_detection_search` Detection Search · Read-only Search malware and threat detections across the account with filters, sorting and cursor pagination. Returns detections, aggregations, total_count, next_cursor fields. Use to find detections by threat name, category, machine or date. Use detection_get for one known detection. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `action_taken` (`string`, optional): The action taken of the detection. Example: example. - `affected_application` (`string`, optional): The application affected by this detection. Example: example. - `category` (`string`, optional): The category of this detection. Example: example. - `detection_id` (`string`, optional): The ID of the detection (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_id` (`string`, optional): The ID of the group to which the endpoint is assigned (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `host_name` (`string`, optional): Filter the search to the endpoints with specified host name. Example: Example. - `job_id` (`string`, optional): ID of the job originating this detection. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `machine_id` (`string`, optional): The ID of the endpoint (machine) where this detection originated (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `machine_name` (`string`, optional): The name of the machine. Example: Example. - `md5` (`string`, optional): The md5 hash of this detection. Example: d41d8cd98f00b204e9800998ecf8427e. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `path` (`string`, optional): The path where this detection happened. Example: example. - `process_name` (`string`, optional): The name of the process that originated this detection. Example: Example. - `protection_status` (`string`, optional): Protection status of the endpoint(s). Example: example. - `reported_at_after` (`string`, optional): Get results reported after this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `reported_at_before` (`string`, optional): Get results reported before this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `scan_id` (`string`, optional): The ID of the scan (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `scan_type` (`string`, optional): Type of the scan that produced the detection. Example: example. - `scanned_at_after` (`string`, optional): Get results generated by a scan happening after this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `scanned_at_before` (`string`, optional): Get results generated by a scan happening before this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `sha256` (`string`, optional): The sha256 hash of this detection. Example: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. - `sort_field` (`string`, optional): If the sort field is used, then sort_order is required. Example: trace_id. One of: `trace_id`, `scan_id`, `machine_id`, `group_id`, `account_id`, `detection_id`, `parent_detection_id`, `correlation_hash`, `status`, `threat_name.keyword`, `type`, `path.keyword`, `category`, `md5`, `sha256`, `affected_application.keyword`, `process_name.keyword`, `machine_name.keyword`, `scanned_at`, `reported_at`, `cleaned_at`, `is_root_detection`, `is_rtp_stream_event`, `object_guid`, `scan_result.device.disk_model`, `active_directory.user.display_name`, `active_directory.user.sam_account_name`, `active_directory.user.ou`, `active_directory.machine.display_name`, `active_directory.machine.sam_account_name`, `active_directory.machine.ou`. - `sort_order` (`string`, optional): Sorting direction. Example: asc. One of: `asc`, `desc`. - `status` (`string`, optional): The status of the detection. Example: example. - `threat_name` (`string`, optional): The name of the threat. Example: Example. - `type` (`string`, optional): The type of the detection. Example: example. Example input: `{"accountid":""}` ### `malwarebytes_dns_log_search` DNS Log Search · Read-only Search DNS filtering logs with filters, sorting and cursor pagination. Returns results, aggregations, total_count, next_cursor fields. Use to review blocked or allowed DNS queries. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `action` (`string`, optional): Filter the search by action. Search for an exact match. Example: example. - `group_id` (`string`, optional): Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_name` (`string`, optional): Filter the search by group_name. Search for an exact match. Example: Example. - `machine_id` (`string`, optional): Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `policy_name` (`string`, optional): Filter the search by policy_name. Search for an exact match. Example: Example. - `rule_name` (`string`, optional): Filter the search by rule_name. Search for an exact match. Example: Example. - `sort_field` (`string`, optional): Sort field. Example: machine_id. One of: `machine_id`, `group_id`, `group_name`, `rule_id`, `rule_name`, `resolved_ips`, `policy_id`, `policy_name`, `account_id`, `parent_account_id`, `action`, `log.policy_id`, `log.policy`, `log.protocol`, `log.query_name`, `log.query_name_reversed`, `log.resolver_decision`, `log.user_id`, `log.colo_id`, `log.dst_port`, `log.query_category_ids`, `log.query_size`, `log.query_type`, `log.src_port`, `log.dst_ip`, `log.src_ip`, `timestamp`, `log.datetime`, `agent.at`, `agent.last_user`, `agent.fully_qualified_host_name`, `agent.started_at_local`, `agent.started_at_offset`, `agent.os_info.os_type`, `agent.os_info.os_version`, `agent.os_info.os_platform`, `agent.os_info.os_architecture`, `agent.os_info.os_release_name`, `agent.domain_name`, `agent.engine_version`, `agent.policy_etag`, `agent.host_name`, `agent.nics.ips`, `agent.nics.mac_address`, `machine.tags.alias`, `agent.has_alerts`, `agent.machine_ip`, `agent.object_guid`, `agent.plugins.endpoint_protection.sdk_version`, `agent.plugins.endpoint_protection.component_package_version`, `agent.source_location.city`, `agent.source_location.country`, `agent.source_location.country_iso`, `agent.source_location.continent`, `agent.source_location.time_zone`, `agent.source_location.postal_code`, `agent.source_location.subdivisions`, `agent.source_location.anonymous_proxy`, `agent.serial_number`, `active_directory.user.display_name`, `active_directory.user.sam_account_name`, `active_directory.user.ou`, `active_directory.machine.display_name`, `active_directory.machine.sam_account_name`, `active_directory.machine.ou`. - `sort_order` (`string`, optional): Sorting direction. Example: asc. One of: `asc`, `desc`. - `timestamp_after` (`string`, optional): Filter the search by timestamp_after. Example: 2025-01-01T00:00:00Z. - `timestamp_before` (`string`, optional): Filter the search by timestamp_before. Search for the documents that are after the given timestamp. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_endpoint_agent_info_get` Endpoint Agent Info Get · Read-only Get agent and plugin version information for one endpoint. Returns agent_info, last_seen_at, agent_info_last_updated_at fields. Use to check which agent version and plugins an endpoint runs. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_assets_get` Endpoint Assets Get · Read-only Get the hardware and software asset inventory of one endpoint. Returns startups, os_info, memory, computer_info, software_installed, nics and more fields. Use to inspect installed software, OS, drives and network adapters of a single endpoint. Use asset_software_search across all endpoints. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_drives_get` Endpoint Drives Get · Read-only List the drives of one endpoint with their encryption state. Returns drives fields. Use to check drive encryption on a single endpoint. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_get` Endpoint Get · Read-only Get one endpoint by ID, including its name, group, policy, OS and online state. Returns id, policy_id, group_id, name, online, is_deleted and more fields. Use after endpoint_search when you have the endpoint ID and need full details. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `populate_diag_info` (`boolean`, optional): Populate diag info. Example: true. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_network_get` Endpoint Network Get · Read-only Get the network adapters and addresses of one endpoint. Returns nics, host_name, fully_qualified_host_name, last_seen_at, agent_info_last_updated_at fields. Use to find the IP and MAC addresses of an endpoint. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_quarantine_list` Endpoint Quarantine List · Read-only List the quarantined items on one endpoint. Returns quarantined_threats, total_count, next_cursor fields. Use to review what is quarantined on a single endpoint. Use quarantine_search for account-wide searches. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `category` (`string`, optional): Search with quarantine category. Example: example. - `name` (`string`, optional): Search with quarantine threat name. Example: Example. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `since` (`string`, optional): Timestamp to filter since quarantine scan times. Example: 2025-01-01T00:00:00Z. - `type` (`string`, optional): Search with quarantine type. Example: example. - `until` (`string`, optional): Timestamp to filter until quarantine scan times. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_scan_detections_list` Endpoint Scan Detections List · Read-only List the detections found by one scan of an endpoint. Returns detections, total_count, next_cursor fields. Use to see which threats a given scan found. Use detection_search to search across all endpoints. Needs endpoint and scan IDs from endpoint_scans_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `scan_id` (`string`, required): ID of the scan. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `since` (`string`, optional): The Since Schema (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":"","endpoint_id":"","scan_id":""}` ### `malwarebytes_endpoint_scan_get` Endpoint Scan Get · Read-only Get one scan of an endpoint by scan ID. Returns id, machine_id, schedule_id, schedule_name, from_cloud, ondemand and more fields. Use when you have a scan ID from endpoint_scans_list. Needs endpoint and scan IDs from endpoint_scans_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `scan_id` (`string`, required): ID of the scan. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `populate_schedule_name` (`boolean`, optional): Populate the schedule name. Example: Example. Example input: `{"accountid":"","endpoint_id":"","scan_id":""}` ### `malwarebytes_endpoint_scans_list` Endpoint Scans List · Read-only List the scans that ran on one endpoint. Returns a JSON array of scan records with id, type, start time and threat counts. Use to review scan history. Use endpoint_scan_get for one scan and endpoint_scan_detections_list for its threats. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `populate` (`string`, optional): Set to schedules to include schedule details for each scan. Example: example. - `since` (`string`, optional): The Since Schema (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `start_index` (`integer`, optional): The start index for pagination. Example: 2025-01-01T00:00:00Z. - `threats_detected` (`string`, optional): Optional parameter to filter out scan results based on whether threats were found. If omitted defaults to returning all. Example: true. One of: `true`, `false`. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_search` Endpoint Search · Read-only Search endpoints (managed machines) in the Nebula account with filters, sorting and cursor pagination. Returns aggregations, endpoints, total_count, next_cursor, after fields. Use to find endpoints by name, group, policy, status or IP. Use endpoint_get for one known endpoint. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `alias` (`string`, optional): Aliases for the machine. Example: Example. - `connected` (`boolean`, optional): connected. Example: true. - `domain_name` (`string`, optional): Filter the search to the endpoints with specified domain name. Example: Example. - `fully_qualified_host_name` (`string`, optional): Filter the search to the endpoints with specified, fully qualified host name. Example: Example. - `group_id` (`string`, optional): Filter the search by group id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_name` (`string`, optional): Filter the search by group's name. Example: Example. - `has_alerts` (`boolean`, optional): Indicates whether the endpoint needs attention. Example: true. - `host_name` (`string`, optional): Filter the search to the endpoints with specified host name. Example: Example. - `infection_found` (`boolean`, optional): Filter the search to the endpoints with one or more security threats found. Example: true. - `is_deleted` (`boolean`, optional): is_deleted filter. Example: true. - `is_isolated` (`boolean`, optional): Indicates whether the endpoints are isolated or not. Example: true. - `is_software_update_available` (`boolean`, optional): Indicates whether the agent has an available update. Example: true. - `last_user` (`string`, optional): Last user that logged into the machine. Example: example. - `machine_id` (`string`, optional): Filter the search to the endpoints with specified id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `machine_ip` (`string`, optional): machine_ip filter. Example: 10.0.0.15. - `name_multi_search` (`string`, optional): Search either alias, host name of fully qualified host name. Example: WORKSTATION-01. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `policy_id` (`string`, optional): Filter the search to the endpoints with specified policy (id). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `policy_name` (`string`, optional): Filter the search to the endpoints with specified policy (name). Example: Example. - `protection_status` (`string`, optional): Protection status of the endpoint(s). Example: example. - `reboot_required` (`boolean`, optional): Filter the search to the endpoints needing a reboot. Example: true. - `serial_number` (`string`, optional): Serial number filter. Example: example. - `sort_field` (`string`, optional): Sort field. Example: at. One of: `at`, `nics.ips`, `nics.mac_address`, `nics.description`, `os_info.os_type`, `os_info.os_version`, `os_info.os_platform`, `os_info.os_architecture`, `os_info.os_release_name`, `host_name`, `fully_qualified_host_name`, `plugins.asset_manager.plugin_version`, `plugins.asset_manager.reboot_reason`, `plugins.endpoint_protection.plugin_version`, `plugins.endpoint_protection.sdk_version`, `plugins.endpoint_protection.component_package_version`, `plugins.endpoint_protection.update_package_version`, `plugins.endpoint_protection.reboot_reason`, `plugins.endpoint_detection_and_response.plugin_version`, `plugins.endpoint_detection_and_response.reboot_reason`, `plugins.incident_response.plugin_version`, `plugins.incident_response.reboot_reason`, `plugins.siem.plugin_version`, `plugins.browser_phishing_protection.plugin_version`, `plugins.siem.reboot_reason`, `engine_version`, `domain_name`, `policy_etag`, `account_id`, `group_id`, `root_group_id`, `group_name`, `policy_name`, `policy_id`, `deleted_at`, `created_at`, `marked_for_deletion`, `is_deleted`, `last_day_seen`, `last_scanned_at`, `last_user`, `tags.alias`, `name_multi_search`, `machine_ip`, `serial_number`, `object_guid`, `vulnerabilities_found.critical`, `vulnerabilities_found.high`, `vulnerabilities_found.medium`, `vulnerabilities_found.low`, `vulnerabilities_found.none`, `vulnerabilities_found.total`, `os_patches_available`, `last_assets_scan_at`, `connected`. - `sort_order` (`string`, optional): Whether sorting should be ascending or descending. Example: asc. One of: `asc`, `desc`. - `suspicious_activity_found` (`boolean`, optional): Filter the search to the endpoints that have open suspicious activities. Example: true. Example input: `{"accountid":""}` ### `malwarebytes_endpoint_search_groupby` Endpoint Search Groupby · Read-only Count endpoints grouped by a field such as group, policy or protection status. Returns results, next_cursor fields. Use for summary counts. Use endpoint_search to list the endpoints themselves. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_by` (`string`, required): Endpoint field to group the counts by, such as protection_status, policy_id, group_id or engine_version. Example: os_info.os_platform. One of: `os_info.os_platform`, `os_info.os_type`, `os_info.os_architecture`, `os_info.os_version`, `os_info.os_release_name`, `engine_version`, `policy_etag`, `account_id`, `group_id`, `root_group_id`, `policy_id`, `machine_ip`, `last_user`, `object_guid`, `plugins.endpoint_protection.sdk_version`, `plugins.endpoint_protection.component_package_version`, `plugins.endpoint_protection.update_package_version`, `serial_number`, `protection_status`, `plugins.browser_phishing_protection.plugin_version`. - `page_size` (`integer`, required): Number of groups to return, from 50 to 2000. Example: 50. - `group_id` (`string`, optional): Filter the search by group id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `has_alerts` (`boolean`, optional): Indicates whether the endpoint needs attention. Example: true. - `is_isolated` (`boolean`, optional): Indicates whether the endpoints are isolated or not. Example: true. - `name_multi_search` (`string`, optional): Search either alias, host name of fully qualified host name. Example: WORKSTATION-01. - `policy_id` (`string`, optional): Filter the search to the endpoints with specified policy (id). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `protection_status` (`string`, optional): Protection status of the endpoint(s). Example: example. Example input: `{"accountid":"","group_by":"os_info.os_platform","page_size":50}` ### `malwarebytes_endpoint_status_get` Endpoint Status Get · Read-only Get the current protection status of one endpoint. Returns remediation_required, reboot_required, suspicious_activity, isolation, scan_needed fields. Use for a quick check of remediation, reboot, suspicious activity, isolation or scan-needed flags. Use endpoint_get for full details. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_endpoint_suspicious_activity_list` Endpoint Suspicious Activity List · Read-only List suspicious activity records for one endpoint. Returns sa, total_count, next_cursor fields. Use to review suspicious activity on one endpoint. Use suspicious_activity_list for the whole account. Needs an endpoint ID from endpoint_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `per_page` (`integer`, optional): Items per page. Example: 25. - `since` (`string`, optional): Since (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `sort_direction` (`string`, optional): Sort direction. Example: asc. One of: `asc`, `desc`. - `sort_field` (`string`, optional): Sort field. Example: timestamp. One of: `timestamp`, `level`, `pc_hostname`. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_events_list` Events List · Read-only Retrieve account events with search, machine, time and severity filters. Returns events, total_count, next_cursor fields. Use to review the activity audit trail. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `end` (`string`, optional): Timestamp to filter until event times. Example: 2025-01-01T00:00:00Z. - `machine_id` (`string`, optional): Search with machine_id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `search_string` (`string`, optional): Search with events with event string. Example: example. - `severity_flags` (`number`, optional): Severity filter code: 0, 1, 2, 4 or 8. Example: 0. One of: `0`, `1`, `2`, `4`, `8`. - `source` (`number`, optional): Event source code from 1 to 6. Example: 1. One of: `1`, `2`, `3`, `4`, `5`, `6`. - `start` (`string`, optional): Timestamp to filter since event times. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_exclusion_get` Exclusion Get · Read-only Get one exclusion by ID. Returns id, etag, type, value, enabled, comment and more fields. Use when you have an exclusion ID from exclusion_list. Needs an exclusion ID from exclusion_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `exclusion_id` (`string`, required): ID of the exclusion. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `populate_risk` (`boolean`, optional): Populate risk fields on exclusion. Example: true. Example input: `{"accountid":"","exclusion_id":""}` ### `malwarebytes_exclusion_list` Exclusion List · Read-only List exclusions with search, type, policy and risk filters. Returns exclusions, total_count, next_cursor fields. Use to find exclusion IDs. Use exclusion_get for one known exclusion. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `policy_ids` (`string`, optional): Search with exclusion policy ids. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `populate_risk` (`boolean`, optional): Populate risk fields on exclusions. Example: true. - `risk` (`string`, optional): Filter exclusions by risk level (validated by Retina). Example: example. - `search_string` (`string`, optional): Search with exclusion string. Example: example. - `since` (`string`, optional): Timestamp to filter since exclusion times. Example: 2025-01-01T00:00:00Z. - `sort_by` (`string`, optional): Field to sort results with. 'risk' is resolved in-memory by Retina (risk is not persisted). Example: enabled. One of: `enabled`, `value`, `created_at`, `updated_at`, `created_by`, `updated_by`, `type`, `risk`. - `sort_order` (`string`, optional): Sorting direction. Example: asc. One of: `asc`, `desc`. - `type` (`number`, optional): Search with exclusion type. Example: 1. - `until` (`string`, optional): Timestamp to filter until exclusion times. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_group_get` Group Get · Read-only Get one endpoint group by ID. Returns id, account_id, name, machines_count, policy_id, policy_name and more fields. Use when you have a group ID from group_list. Needs a group ID from group_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_id` (`string`, required): ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","group_id":""}` ### `malwarebytes_group_list` Group List · Read-only List endpoint groups, optionally filtered by name or parent group. Returns groups, total_count, next_cursor fields. Use to find group IDs. Use group_get for one known group. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `filter_by_parent_id` (`string`, optional): Set this to 'true' when parent_id has been set. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `name` (`string`, optional): Filter by group name. Example: Example. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `parent_id` (`string`, optional): For filtering by parent group ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":""}` ### `malwarebytes_installation_token_list` Installation Token List · Read-only List endpoint installation tokens. Returns installation_tokens, total_count fields. Use to review existing tokens. Use installation_token_create to make a new one. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `include_expired` (`boolean`, optional): Include or exclude the expired tokens. Example: true. - `include_used` (`boolean`, optional): Include or exclude the used tokens. Example: true. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `sort_by` (`string`, optional): Field to sort with. Example: created_at. One of: `created_at`, `used_at`, `expires_at`. - `sort_order` (`string`, optional): Sort order. Example: asc. One of: `asc`, `desc`. - `start_index` (`integer`, optional): The index of the first element. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_installers_list` Installers List · Read-only Retrieve download links for the endpoint agent installers. Returns win_msi, x64_msi, win_web, win_full, mac_os, ea2_arm_msi and more fields. Use to get installer URLs for Windows and macOS. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":""}` ### `malwarebytes_job_get` Job Get · Read-only Get one job by ID, including its command, target and status. Returns id, machine_id, machine_name, command, issued_at, issued_by_email and more fields. Use to check progress of a job issued with job_issue or jobs_issue_bulk. Needs a job ID from job_issue or job_search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `job_id` (`string`, required): ID of the job. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","job_id":""}` ### `malwarebytes_job_search` Job Search · Read-only Search jobs with filters on command, status, endpoint and issue time. Returns jobs, total_count, next_cursor fields. Use to find jobs. Use job_get for one known job and parent_job_search for batches. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `cancelled_by` (`string`, optional): Filter the search by the id of the user who cancelled the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: example. - `command` (`string`, optional): Filter the search by endpoint name command name. Example: command.threat.scan. One of: `command.threat.scan`, `command.asset.reboot`, `command.service.restart`, `command.protection.update.now`, `command.machine.update.now`, `command.asset.refresh`, `command.edr.isolation`, `command.threat.quarantine.remove`, `command.threat.quarantine.restore`, `command.bfp.rules.delete`, `command.service.diag`, `command.edr.fileupload`, `command.edr.unlock.force`, `command.edr.lock`, `command.sequence.remediate`, `command.edr.unlock`, `command.logging.level.set`, `command.threat.scan.remediate`, `command.policy.refresh`, `command.machine.plugin.updateparts`, `command.asset.patch`, `command.asset.updatesoftware`, `command.asset.uninstallsoftware`. - `endpoint` (`string`, optional): Filter the search by endpoint name.. Search for occurrences of the given value in the host_name fully_qualified_host_name and alias. Example: 2025-01-01T00:00:00Z. - `expires_at_after` (`string`, optional): Results include jobs that expire after the specified date. Example: 2025-01-01T00:00:00Z. - `expires_at_before` (`string`, optional): Results include jobs that expire before the specified date. Example: 2025-01-01T00:00:00Z. - `id` (`string`, optional): Filter the search by a single job ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `issued_at_after` (`string`, optional): Results include jobs that have been issued after the specified date. Example: 2025-01-01T00:00:00Z. - `issued_at_before` (`string`, optional): Results include jobs that have been issued before the specified date. Example: 2025-01-01T00:00:00Z. - `issued_by` (`string`, optional): Filter the search by the id of the user who issued the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: example. - `issued_by_email` (`string`, optional): Filter the search by the email of the user who issued the job. Contains operator. Example: example. - `machine_id` (`string`, optional): Filter the search Machine Id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `sort_field` (`string`, optional): Sort field. Example: command. One of: `command`, `issued_by`, `issued_at`, `expires_at`, `status`, `machine_name`, `account_name`. - `sort_order` (`string`, optional): Sorting direction. Example: asc. One of: `asc`, `desc`. - `status` (`number`, optional): Job status filter code: 1 created, 2 sent, 4 received, 8 started, 16 timed out, 32 completed, 64 expired, 128 failed, 256 cancelled. Add codes together to match several statuses. Example: 1. Example input: `{"accountid":""}` ### `malwarebytes_notification_get` Notification Get · Read-only Get one notification subscription by ID. Returns the notification subscription with its recipients and rule settings. Use when you have a subscription ID from notification_list. Needs a subscription ID from notification_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `subscription_id` (`string`, required): ID of the notification subscription. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","subscription_id":""}` ### `malwarebytes_notification_list` Notification List · Read-only List notification subscriptions. Returns records, next_cursor fields. Use to review alert notification rules. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `only_current_owner` (`boolean`, optional): if true, only the notifications subscriptions owned by the requester will be returned. Example: true. - `page_size` (`integer`, optional): Number of results per page. Example: 25. Example input: `{"accountid":""}` ### `malwarebytes_os_patch_search` OS Patch Search · Read-only Search available operating system patches across endpoints. Returns results, aggregations, total_count, next_cursor fields. Use to find missing OS patches by severity, vendor or machine. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `category` (`string`, optional): Filter the search by category. Search for an exact match. Example: example. - `group_id` (`string`, optional): Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_name` (`string`, optional): Filter the search by group_name. Search for an exact match. Example: Example. - `host_name` (`string`, optional): Filter the search by host_name. Search for an exact match. Example: Example. - `kb_id` (`string`, optional): Filter the search by kb_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `machine_id` (`string`, optional): Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `product` (`string`, optional): Filter the search by product. Search for an exact match. Example: Example. - `reboot_required` (`boolean`, optional): Filter the search by reboot_required. Example: true. - `severity` (`string`, optional): Filter the search by severity. Search for an exact match. Example: example. - `sort_field` (`string`, optional): Sort field. Example: account_id. One of: `account_id`, `account_name`, `parent_account_id`, `machine_id`, `group_id`, `root_group_id`, `object_guid`, `host_name`, `fully_qualified_host_name`, `display_name`, `vendor`, `product`, `os_info.os_type`, `os_info.os_version`, `os_info.os_platform`, `os_info.os_architecture`, `os_info.os_release_name`, `severity`, `title`, `description`, `category`, `security_update_id`, `patch_id`, `kb_id`, `created_at`, `released_at`, `reboot_required`, `preview_patch`, `size`, `domain_name`, `active_directory.user.display_name`, `active_directory.machine.display_name`, `active_directory.user.ou`, `active_directory.machine.ou`, `active_directory.user.sam_account_name`, `active_directory.machine.sam_account_name`, `ignored_until`. - `sort_order` (`string`, optional): Sorting direction. Example: asc. One of: `asc`, `desc`. - `title` (`string`, optional): Filter the search by title. Search for an exact match. Example: Example. - `update_ignored` (`boolean`, optional): Filter the search by update_ignored os patches. Example: true. - `vendor` (`string`, optional): Filter the search by vendor. Search for an exact match. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_parent_job_get` Parent Job Get · Read-only Get one parent job (a batch of jobs sharing a correlation ID). Returns correlation_id, account_id, source_id, account_name, created_at, expires_at and more fields. Use to inspect a batch started by job_issue or jobs_issue_bulk. Needs the correlation_id returned when the job was issued. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `correlation_id` (`string`, required): Correlation ID of the parent job (the correlation_id returned when the job was issued). Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","correlation_id":""}` ### `malwarebytes_parent_job_search` Parent Job Search · Read-only Search parent jobs (batches of jobs) with constraints and cursor pagination. Returns jobs, total_count, next_cursor fields. Use to review batches. Use job_search for individual jobs. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `constraints` (`array`, optional): Array of constraint objects, each with a field, an operator (equals, not_equals, contains or not_contains) and a value, for example [{"field": "command", "operator": "equals", "value": "command.threat.scan"}]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `sort_field` (`string`, optional): Parent Jobs Sort Fields. Example: created_at. One of: `created_at`, `expires_at`, `source_id`, `command`, `issued_by`, `issued_by_name`, `issued_by_email`, `accounts`, `endpoints`, `created`, `sent`, `received`, `processing`, `timed_out`, `success`, `expired`, `cancelled`, `failed`, `is_complete`. - `sort_order` (`string`, optional): Whether sorting should be ascending or descending. Example: asc. One of: `asc`, `desc`. Example input: `{"accountid":""}` ### `malwarebytes_policy_get` Policy Get · Read-only Get one policy by ID, including its full settings. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use when you have a policy ID from policy_list. Needs a policy ID from policy_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `policy_id` (`string`, required): ID of the policy. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `populate` (`string`, optional): Comma-separated extra data to include: groups, exclusions or groups,exclusions. Example: example. Example input: `{"accountid":"","policy_id":""}` ### `malwarebytes_policy_list` Policy List · Read-only List the policies of the Nebula account. Returns policies, total_count fields. Use to find policy IDs. Use policy_get for the full contents of one policy. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":""}` ### `malwarebytes_policy_system_default_get` Policy System Default Get · Read-only Get the system default policy settings. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use as a template when building the contents of a new policy. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":""}` ### `malwarebytes_quarantine_list` Quarantine List · Read-only List quarantined items across the account with simple filters. Returns quarantined_threats, total_count, next_cursor fields. Use for a quick listing. Use quarantine_search for advanced constraints. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `category` (`string`, optional): Search with quarantine category. Example: example. - `name` (`string`, optional): Search with quarantine threat name. Example: Example. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `since` (`string`, optional): Timestamp to filter since quarantine scan times. Example: 2025-01-01T00:00:00Z. - `type` (`string`, optional): Search with quarantine type. Example: example. - `until` (`string`, optional): Timestamp to filter until quarantine scan times. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":""}` ### `malwarebytes_quarantine_search` Quarantine Search · Read-only Search quarantined items across the account with constraints, sorting and cursor pagination. Returns quarantine, total_count, next_cursor fields. Use for account-wide quarantine searches. Use endpoint_quarantine_list for one endpoint. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `constraints` (`array`, optional): Array of constraint objects, each with a field, an operator (equals, not_equals, contains or not_contains) and a value, for example [{"field": "threat_name", "operator": "contains", "value": "Trojan"}]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `fields` (`array`, optional): Names of the fields to include in each result, as a JSON array of strings such as threat_name, path and machine_name. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `sort_field` (`string`, optional): Sort field. Example: scanned_at. One of: `scanned_at`, `auto_removal_at`. - `sort_order` (`string`, optional): Whether sorting should be ascending or descending. Example: asc. One of: `asc`, `desc`. Example input: `{"accountid":""}` ### `malwarebytes_remediation_search` Remediation Search · Read-only Search remediation items with constraints, sorting and cursor pagination. Returns items, total_count, next_cursor fields. Use to find items awaiting remediation. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `constraints` (`array`, optional): Array of constraint objects, each with a field, an operator (equals, not_equals, contains or not_contains) and a value, for example [{"field": "threat_name", "operator": "contains", "value": "Trojan"}]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `fields` (`array`, optional): Names of the fields to include in each result, as a JSON array of strings. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `sort_field` (`string`, optional): Sort field. Example: scanned_at. One of: `scanned_at`. - `sort_order` (`string`, optional): Whether sorting should be ascending or descending. Example: asc. One of: `asc`, `desc`. Example input: `{"accountid":""}` ### `malwarebytes_report_get` Report Get · Read-only Get one report definition by ID. Returns id, account_id, name, type, format, period and more fields. Use when you have a report ID from report_list. Needs a report ID from report_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `report_id` (`string`, required): ID of the report. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `populate` (`string`, optional): Set to users to include the report recipients. Example: users. One of: `users`. Example input: `{"accountid":"","report_id":""}` ### `malwarebytes_report_list` Report List · Read-only List the configured reports. Returns reports, next_cursor fields. Use to find report IDs. Use report_get for one report. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `page_size` (`integer`, optional): Number of results per page. Example: 25. - `populate` (`string`, optional): Set to users to include the report recipients. Example: users. One of: `users`. Example input: `{"accountid":""}` ### `malwarebytes_sandbox_submissions_search` Sandbox Submissions Search · Read-only Search sandbox submission results by file name, hash, result or status. Returns data fields. Use to check verdicts of files submitted for sandbox analysis. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `ext` (`array`, optional): Ext. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `file_name` (`string`, optional): File name. Example: Example. - `md5` (`string`, optional): Md5. Example: d41d8cd98f00b204e9800998ecf8427e. - `result` (`array`, optional): Result. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `status` (`array`, optional): Status. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `timestamp` (`string`, optional): Submission time filter as an ISO 8601 timestamp. Example: 2025-01-01T00:00:00Z. - `upload_source` (`string`, optional): Upload source. Example: example. Example input: `{"accountid":""}` ### `malwarebytes_schedule_get` Schedule Get · Read-only Get one schedule by ID. Returns id, name, etag, command, rrule, enabled and more fields. Use when you have a schedule ID from schedule_list. Needs a schedule ID from schedule_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `schedule_id` (`string`, required): ID of the schedule. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","schedule_id":""}` ### `malwarebytes_schedule_list` Schedule List · Read-only List scan and job schedules. Returns schedules, total_count, next_cursor fields. Use to find schedule IDs. Use schedule_get for one schedule. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. Example input: `{"accountid":""}` ### `malwarebytes_suspicious_activity_details_get` Suspicious Activity Details Get · Read-only Get details for suspicious activity detections of an endpoint by detection IDs. Returns data, next_cursor fields. Use after suspicious_activity_list when you need the full records for specific detection IDs. Needs detection IDs and the endpoint ID from suspicious_activity_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `detection_id_list` (`array`, required): Suspicious activity IDs to fetch details for, as a JSON array of strings. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `endpoint` (`string`, required): ID of the endpoint the suspicious activity belongs to. Example: 2025-01-01T00:00:00Z. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. Example input: `{"accountid":"","detection_id_list":["9256034b-7967-4253-a5d9-260663e4fa4f"],"endpoint":""}` ### `malwarebytes_suspicious_activity_list` Suspicious Activity List · Read-only List suspicious activity records across the account. Returns sa, total_count, next_cursor fields. Use to triage open suspicious activity account-wide. Use endpoint_suspicious_activity_list for one endpoint. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `before` (`string`, optional): Before (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `group_ids` (`string`, optional): ID of a group to restrict the results to. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `next_cursor` (`string`, optional): Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response. - `per_page` (`integer`, optional): Page size. Example: 25. - `since` (`string`, optional): Since (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z. - `sort_direction` (`string`, optional): Sort direction. Example: asc. One of: `asc`, `desc`. - `sort_field` (`string`, optional): Sort field. Example: timestamp. One of: `timestamp`, `level`, `pc_hostname`. Example input: `{"accountid":""}` ### `malwarebytes_xdr_alert_get` XDR Alert Get · Read-only Get one XDR alert by ID and source. Returns id, account_id, account_name, metadata, source, severity and more fields. Use to inspect an XDR alert before changing its status. Needs an alert ID and source. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `alert_id` (`number`, required): ID of the XDR alert. Example: 1234. - `source` (`string`, required): Source of the alert. Example: edr. One of: `edr`, `okta`, `entra`. Example input: `{"accountid":"","alert_id":1234,"source":"edr"}` ### `malwarebytes_endpoint_tags_set` Endpoint Tags Set · Write Set the alias (tag) of one endpoint. Returns created_at, updated_at, resource_id, tags fields. Use to give an endpoint a friendly alias that endpoint_search can match. Needs an endpoint ID from endpoint_search. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `alias` (`string`, required): Alias for the endpoint; send an empty string to remove the alias. Example: Example. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","alias":"","endpoint_id":""}` ### `malwarebytes_exclusion_create` Exclusion Create · Write Create an exclusion so selected items are skipped by protection. Returns id, etag, type, value, enabled, comment and more fields. Use to allow a file, folder, domain or similar item. Use exclusion_update to change one. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `account_level` (`boolean`, required): Whether this is an account-level exclusion. Use policy_ids to list policies when it is not. Example: true. - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `enabled` (`boolean`, required): Whether the exclusion is active. Example: true. - `exclude_from` (`object`, required): Protection layers the exclusion applies to, as a JSON object of booleans: exploit_protection, malware_protection, ransomware_protection, suspicious_activity, website_protection and bruteforce_protection. When the exclusion is enabled at least one must be true. Example: {"key": "value"}. - `type` (`integer`, required): Exclusion type code: 1 file path, 2 folder path, 3 wildcard path, 4 registry, 5 file extension, 6 web domain, 7 web IP, 8 web monitoring, 13 hash (MD5), 14 command line, 17 ransomware network protection. Example: 1. - `value` (`string`, required): The item to exclude, such as a path, domain, IP address or MD5 hash, matching the exclusion type. Example: example. - `comment` (`string`, optional): Comment. Example: Example. - `friendly_name` (`string`, optional): Friendly name. Example: 2025-01-01T00:00:00Z. - `policy_ids` (`array`, optional): IDs of the policies the exclusion applies to. Get them from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"account_level":true,"accountid":"","enabled":true,"exclude_from":{"key":"value"},"type":1,"value":""}` ### `malwarebytes_exclusion_update` Exclusion Update · Write Update an existing exclusion. Returns id, etag, type, value, enabled, comment and more fields. Use to change an exclusion's value, scope or enabled state. Send the current etag from exclusion_get. Needs an exclusion ID and etag from exclusion_get. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `account_level` (`boolean`, required): Whether this is an account-level exclusion. Use policy_ids to list policies when it is not. Example: true. - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `enabled` (`boolean`, required): Whether the exclusion is active. Example: true. - `etag` (`string`, required): Current etag of the exclusion, from exclusion_get. Used to detect concurrent edits. Example: example. - `exclude_from` (`object`, required): Protection layers the exclusion applies to, as a JSON object of booleans: exploit_protection, malware_protection, ransomware_protection, suspicious_activity, website_protection and bruteforce_protection. When the exclusion is enabled at least one must be true. Example: {"key": "value"}. - `exclusion_id` (`string`, required): ID of the exclusion. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `type` (`integer`, required): Exclusion type code: 1 file path, 2 folder path, 3 wildcard path, 4 registry, 5 file extension, 6 web domain, 7 web IP, 8 web monitoring, 13 hash (MD5), 14 command line, 17 ransomware network protection. Example: 1. - `value` (`string`, required): The item to exclude, such as a path, domain, IP address or MD5 hash, matching the exclusion type. Example: example. - `comment` (`string`, optional): Comment. Example: Example. - `friendly_name` (`string`, optional): Friendly name. Example: 2025-01-01T00:00:00Z. - `policy_ids` (`array`, optional): IDs of the policies the exclusion applies to. Get them from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"account_level":true,"accountid":"","enabled":true,"etag":"","exclude_from":{"key":"value"},"exclusion_id":"","type":1,"value":""}` ### `malwarebytes_group_create` Group Create · Write Create an endpoint group with a name and policy. Returns id, account_id, name, machines_count, policy_id, policy_name and more fields. Use to add a group. Use group_update to change an existing one. Needs a policy ID from policy_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `name` (`string`, required): Name of the new group. Example: Example. - `policy_id` (`string`, required): ID of the policy the group uses. Get it from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `parent_id` (`string`, optional): ID of the parent group; leave empty to create a top-level group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `schedule_ids` (`array`, optional): IDs of the schedules to attach to the group. Get them from schedule_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","name":"","policy_id":""}` ### `malwarebytes_group_endpoints_assign` Group Endpoints Assign · Write Move endpoints into a group by endpoint IDs or by an endpoint search query. Returns moved, errors fields. Use to reassign endpoints to a different group. Needs a group ID from group_list and endpoint IDs from endpoint_search. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoints` (`array`, required): Endpoints to move into the group, as a JSON array of objects with an id, for example [{"id": "9256034b-7967-4253-a5d9-260663e4fa4f"}]. Both endpoints and queries are required by the API. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_id` (`string`, required): ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `queries` (`array`, required): Endpoint search selectors choosing the endpoints to move, as a JSON array of objects that use the same filter fields as endpoint_search. Required by the API. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. Example input: `{"accountid":"","endpoints":[],"group_id":"","queries":["9256034b-7967-4253-a5d9-260663e4fa4f"]}` ### `malwarebytes_group_update` Group Update · Write Update the name, policy, parent or schedules of an endpoint group. Returns id, account_id, name, machines_count, policy_id, policy_name and more fields. Use to rename a group or change its policy. All of name and policy_id are required. Needs a group ID from group_list and a policy ID from policy_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_id` (`string`, required): ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `name` (`string`, required): New name of the group. Example: Example. - `policy_id` (`string`, required): ID of the policy the group uses. Get it from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `parent_id` (`string`, optional): ID of the parent group; leave empty for a top-level group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `schedule_ids` (`array`, optional): IDs of the schedules to attach to the group. Get them from schedule_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","group_id":"","name":"","policy_id":""}` ### `malwarebytes_installation_token_create` Installation Token Create · Write Generate a new endpoint installation token. Returns account_id, id, token, created_by, created_at, used_at and more fields. Use when installing the agent on a new machine. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":""}` ### `malwarebytes_job_issue` Job Issue · Write Issue a job such as scan, reboot, isolate or update to one or more endpoints by endpoint ID. Returns jobs, total_count, correlation_id fields. Use to act on specific endpoints. Use jobs_issue_bulk to target endpoints or groups by query. Track progress with job_get. Needs endpoint IDs from endpoint_search. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `command` (`string`, required): Job command to run on the endpoints. Common values are command.threat.scan (scan), command.asset.reboot (reboot), command.edr.isolation (isolate), command.edr.unlock (remove isolation), command.policy.refresh (refresh policy) and command.protection.update.now (check for protection updates). Example: command.threat.scan. One of: `command.threat.scan`, `command.asset.reboot`, `command.service.restart`, `command.protection.update.now`, `command.machine.update.now`, `command.asset.refresh`, `command.edr.isolation`, `command.threat.quarantine.remove`, `command.threat.quarantine.restore`, `command.bfp.rules.delete`, `command.service.diag`, `command.edr.fileupload`, `command.edr.unlock.force`, `command.edr.lock`, `command.sequence.remediate`, `command.edr.unlock`, `command.logging.level.set`, `command.threat.scan.remediate`, `command.policy.refresh`, `command.machine.plugin.updateparts`, `command.asset.patch`, `command.asset.updatesoftware`, `command.asset.uninstallsoftware`. - `machine_ids` (`array`, required): IDs of the endpoints to run the command on. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `correlation_id` (`string`, optional): Correlation ID of the job (Parent job ID). Could be used to find related child jobs. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `data` (`object`, optional): Command-specific settings. For command.threat.scan use {"scan_settings":{"type":"ThreatScan","remove":false}}; for command.edr.isolation use {"desktop":true,"network":true,"process":true}. Omit for commands that need none. Example: {"key": "value"}. - `relay_state` (`string`, optional): Optional relay state string attached to the job. Example: example. - `requires_connected` (`boolean`, optional): Set true when a connection must be initiated before the job is issued, such as an active response shell. Leave empty for ordinary commands. Example: true. - `source_id` (`string`, optional): Source ID for relating the new parent job to an existing parent job without add them as children of that parent job. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","command":"command.threat.scan","machine_ids":[]}` ### `malwarebytes_jobs_issue_bulk` Jobs Issue Bulk · Write Issue a job to a list of endpoints and/or groups in one request. Returns jobs, errors, total_count, correlation_id fields. Use to run the same command on many endpoints or whole groups. Use job_issue for a plain list of endpoint IDs. Needs endpoint or group IDs from endpoint_search or group_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `command` (`string`, required): Job command to run on the endpoints. Common values are command.threat.scan (scan), command.asset.reboot (reboot), command.edr.isolation (isolate), command.edr.unlock (remove isolation), command.policy.refresh (refresh policy) and command.protection.update.now (check for protection updates). Example: command.threat.scan. One of: `command.threat.scan`, `command.asset.reboot`, `command.service.restart`, `command.protection.update.now`, `command.machine.update.now`, `command.asset.refresh`, `command.edr.isolation`, `command.threat.quarantine.remove`, `command.threat.quarantine.restore`, `command.bfp.rules.delete`, `command.service.diag`, `command.edr.fileupload`, `command.edr.unlock.force`, `command.edr.lock`, `command.sequence.remediate`, `command.edr.unlock`, `command.logging.level.set`, `command.threat.scan.remediate`, `command.policy.refresh`, `command.machine.plugin.updateparts`, `command.asset.patch`, `command.asset.updatesoftware`, `command.asset.uninstallsoftware`. - `endpoints` (`array`, required): Endpoints to target, as a JSON array of objects with an id, for example [{"id": "9256034b-7967-4253-a5d9-260663e4fa4f"}]. The API requires this field and also requires groups or queries. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `correlation_id` (`string`, optional): Correlation ID of the job (Parent job ID). Could be used to find related child jobs. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `data` (`object`, optional): Command-specific settings. For command.threat.scan use {"scan_settings":{"type":"ThreatScan","remove":false}}; for command.edr.isolation use {"desktop":true,"network":true,"process":true}. Example: {"key": "value"}. - `groups` (`array`, optional): Endpoint search selectors, as a JSON array of objects that use the same filter fields as endpoint_search, choosing endpoints by query instead of by ID. The API requires groups or queries. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `queries` (`array`, optional): Endpoint search selectors, as a JSON array of objects that use the same filter fields as endpoint_search. The API requires groups or queries. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `relay_state` (`string`, optional): Optional relay state string attached to the job. Example: example. - `requires_connected` (`boolean`, optional): Set true when a connection must be initiated before the job is issued, such as an active response shell. Leave empty for ordinary commands. Example: true. - `source_id` (`string`, optional): Source ID for relating the new parent job to an existing parent job without add them as children of that parent job. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","command":"command.threat.scan","endpoints":[]}` ### `malwarebytes_policy_clone` Policy Clone · Write Clone an existing policy under a new name. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use to copy a policy, optionally with its exclusions. Needs the source policy ID from policy_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `name` (`string`, required): Name for the cloned policy. Example: Example. - `source_id` (`string`, required): ID of the source policy to clone. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `include_policy_exclusions` (`boolean`, optional): Set true to copy the exclusions of the source policy to the clone. Example: true. Example input: `{"accountid":"","name":"","source_id":""}` ### `malwarebytes_policy_create` Policy Create · Write Create a policy from a settings object. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use to add a new policy. Use policy_clone to copy an existing one. Start from the contents returned by policy_system_default_get or policy_get. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `contents` (`object`, required): Policy settings as a JSON object. Start from the contents returned by policy_system_default_get or policy_get and change only what you need. Example: {"key": "value"}. - `name` (`string`, required): Name for this policy. Example: Example. - `quarantine_retention_duration` (`integer`, optional): Quarantine retention duration. Number of days to retain quarantined items. 0 means no retention. Example: example. Example input: `{"accountid":"","contents":{"key":"value"},"name":""}` ### `malwarebytes_policy_update` Policy Update · Write Update the name or settings of an existing policy. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use to change policy settings. Send the current etag from policy_get so concurrent edits are detected. Needs a policy ID and etag from policy_get. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `contents` (`object`, required): Full policy settings as a JSON object. Start from the contents returned by policy_get and change only what you need. Example: {"key": "value"}. - `etag` (`string`, required): Current etag of the policy, from policy_get. Used to detect concurrent edits. Example: example. - `name` (`string`, required): The name for this policy. Example: Example. - `policy_id` (`string`, required): ID of the policy. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `quarantine_retention_duration` (`integer`, optional): Quarantine retention duration. Number of days to retain quarantined items. 0 means no retention. Example: example. Example input: `{"accountid":"","contents":{"key":"value"},"etag":"","name":"","policy_id":""}` ### `malwarebytes_quarantine_action_bulk` Quarantine Action Bulk · Write Delete or restore quarantined items on endpoints in bulk. Returns jobs, errors, total_count, correlation_id fields. Use to act on quarantined items found with quarantine_search. Needs endpoint IDs and detection IDs from quarantine_search. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `command` (`string`, required): Action to apply: command.threat.quarantine.restore restores the items, command.threat.quarantine.remove deletes them permanently. Example: command.threat.quarantine.restore. One of: `command.threat.quarantine.restore`, `command.threat.quarantine.remove`. - `endpoints` (`array`, required): Endpoints holding the quarantined items, as a JSON array of objects with an id, for example [{"id": "9256034b-7967-4253-a5d9-260663e4fa4f"}]. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","command":"command.threat.quarantine.restore","endpoints":[]}` ### `malwarebytes_report_generate` Report Generate · Write Generate a report now for an optional time range. Returns an empty body on success. Use to run an existing report on demand. Needs a report ID from report_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `report_id` (`string`, required): ID of the report. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `end` (`string`, optional): End of the reporting period as an ISO 8601 timestamp. Example: 2025-01-01T00:00:00Z. - `start` (`string`, optional): Start of the reporting period as an ISO 8601 timestamp. Example: 2025-01-01T00:00:00Z. Example input: `{"accountid":"","report_id":""}` ### `malwarebytes_suspicious_activity_close` Suspicious Activity Close · Write Close one suspicious activity record on an endpoint. Returns an empty body on success. Use after triage to mark suspicious activity as resolved. Use suspicious_activity_open to reopen it. Needs endpoint and suspicious activity IDs from endpoint_suspicious_activity_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `suspicious_activity_id` (`string`, required): ID of the suspicious activity record. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","endpoint_id":"","suspicious_activity_id":""}` ### `malwarebytes_suspicious_activity_open` Suspicious Activity Open · Write Reopen one suspicious activity record on an endpoint. Returns an empty body on success. Use to reopen suspicious activity closed earlier with suspicious_activity_close. Needs endpoint and suspicious activity IDs from endpoint_suspicious_activity_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `suspicious_activity_id` (`string`, required): ID of the suspicious activity record. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","endpoint_id":"","suspicious_activity_id":""}` ### `malwarebytes_xdr_alert_status_set` XDR Alert Status Set · Write Set the status of one or more XDR alerts. Returns an empty body on success. Use to triage XDR alerts, for example to close them. Needs alert IDs from xdr_alert_get. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `alert_ids` (`array`, required): Numeric IDs of the XDR alerts to update, as a JSON array of integers. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `status` (`string`, required): New status to set on the alerts. Example: open. One of: `open`, `closed`, `in_progress`, `new`, `reopen`. Example input: `{"accountid":"","alert_ids":[],"status":"open"}` ### `malwarebytes_endpoint_delete` Endpoint Delete · Destructive Delete (unregister) one endpoint from the Nebula account. Returns an empty body on success. Use to remove a decommissioned machine. This cannot be undone from the API. Needs an endpoint ID from endpoint_search. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `endpoint_id` (`string`, required): ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `unregister_isolated` (`boolean`, optional): Set true to also delete an endpoint that is currently isolated. Example: true. Example input: `{"accountid":"","endpoint_id":""}` ### `malwarebytes_exclusion_delete` Exclusion Delete · Destructive Delete one exclusion by ID. Returns an empty body on success. Use to remove an exclusion so the item is protected again. Needs an exclusion ID from exclusion_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `exclusion_id` (`string`, required): ID of the exclusion. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","exclusion_id":""}` ### `malwarebytes_group_delete` Group Delete · Destructive Delete one endpoint group by ID. Returns an empty body on success. Use to remove an empty group. Needs a group ID from group_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `group_id` (`string`, required): ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","group_id":""}` ### `malwarebytes_installation_token_revoke` Installation Token Revoke · Destructive Revoke an endpoint installation token. Returns account_id, id, token, created_by, created_at, used_at and more fields. Use to invalidate a token that should no longer install agents. Needs the token value from installation_token_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `token` (`string`, required): The installation token value. Example: example. Example input: `{"accountid":"","token":""}` ### `malwarebytes_jobs_cancel_pending` Jobs Cancel Pending · Destructive Cancel pending jobs by job ID, endpoint ID or group. Returns an empty body on success. Use to stop jobs that have not yet run. Needs job, endpoint or group IDs from job_search. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `groups` (`array`, optional): Endpoint search selectors, as a JSON array of objects that use the same filter fields as endpoint_search. Provide at least one of job_ids, machine_ids or groups. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"]. - `job_ids` (`array`, optional): IDs of the jobs to cancel. Provide at least one of job_ids, machine_ids or groups. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `machine_ids` (`array`, optional): IDs of endpoints whose pending jobs should be cancelled. Provide at least one of job_ids, machine_ids or groups. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":""}` ### `malwarebytes_policy_delete` Policy Delete · Destructive Delete one policy by ID. Returns an empty body on success. Use to remove a policy that no group uses. Needs a policy ID from policy_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `accountid` (`string`, required): Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. - `policy_id` (`string`, required): ID of the policy. Example: 9256034b-7967-4253-a5d9-260663e4fa4f. Example input: `{"accountid":"","policy_id":""}` ## Related Other Monitoring connectors ([all 29](/agentkit/connectors/?category=monitoring)): - [Microsoft Entra ID](/agentkit/connectors/microsoftentraid/): Scalekit connector, OAuth, 82 tools - [Datadog](/agentkit/connectors/datadog/): Scalekit connector, API key, 105 tools - [1Password](/agentkit/connectors/onepassword/): Scalekit connector, Access token, 4 tools --- ## More Scalekit documentation | Resource | What it contains | When to use it | |----------|-----------------|----------------| | [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content | | [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas | | [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |