The Malwarebytes connector lets your AI agent act in each user's Malwarebytes account. Each user signs in to Malwarebytes once, and Scalekit stores and refreshes their tokens, so your agent never handles credentials. It comes with 74 tools.
- Tools
- 74
- What they doRead · write · destructive
- 51 · 17 · 651 read17 write6 destructive
- Users sign in with
- Service account
Setup
Install the SDK
Terminal window npm install @scalekit-sdk/node dotenvTerminal window pip install scalekit-sdk-python python-dotenvSet your credentials
Add your Scalekit credentials to your
.envfile. Find values in app.scalekit.com > Developers > API Credentials..env SCALEKIT_ENVIRONMENT_URL=<your-environment-url>SCALEKIT_CLIENT_ID=<your-client-id>SCALEKIT_CLIENT_SECRET=<your-client-secret>Create the Malwarebytes connection
In AgentKit > Connections, create a Malwarebytes connection. The name you give it is the
connection_nameyour code passes. See Configure connections.
Tools
Pass the exact name toexecute_toolmalwarebytes_account_getGet the Nebula account details for the account ID supplied.Read-onlyAccount Get
Get the Nebula account details for the account ID supplied. Returns license_key, id, name, options, account_token, client_id and more fields. Use to confirm the account ID and credentials work, or to find the default policy and group IDs.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_app_block_rule_getGet one application block rule by ID.Read-onlyApp Block Rule Get
Get one application block rule by ID. Returns rule, rule_set_id, created_at, created_by, updated_at, updated_by and more fields. Use when you have a rule ID from app_block_rule_search. Needs a rule ID from app_block_rule_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
rule_idstringrequired- ID of the application block rule. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_app_block_rule_searchSearch application block rules.Read-onlyApp Block Rule Search
Search application block rules. Returns total_count, app_block_rules, next_cursor fields. Use to find app block rule IDs. Use app_block_rule_get for one rule.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
malwarebytes_asset_software_searchSearch installed software across all endpoints.Read-onlyAsset Software Search
Search installed software across all endpoints. Returns assets, aggregations, total_count, next_cursor fields. Use to find which endpoints run a given product or version. Use endpoint_assets_get for one endpoint.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_idstring- Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_namestring- Filter the search by group name. Search for the matches that contain the value. Example: Example.
host_namestring- Filter the search by host_name. Search for the matches that contain the value. Example: Example.
installed_versionstring- Filter the search by installed_version. Search for the matches that contain the value. Example: example.
machine_idstring- Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
name_multi_searchstring- Aliases for this machine. Example: WORKSTATION-01.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
productstring- Filter the search by product. Search for the matches that contain the value. Example: Example.
sort_fieldstring- Sort field. Example: account_id.one of
account_idparent_account_idgroup_idroot_group_idmachine_idaccount_namehost_namefully_qualified_host_namealiasname_multi_searchvendornormalized_vendordisplay_vendorproductnormalized_productdisplay_productinstalled_versionnormalized_installed_versiondisplay_installed_versionos_info.os_typeos_info.os_versionos_info.os_platformos_info.os_architectureos_info.os_release_nameinstallation_datecreated_atobject_guidlatest_version_availablecvescves_by_status.unknowncves_by_status.lowcves_by_status.mediumcves_by_status.highcves_by_status.criticalcves_scorecves_countcves_count_by_status.unknowncves_count_by_status.lowcves_count_by_status.mediumcves_count_by_status.highcves_count_by_status.criticallanguagearchitectureproduct_signaturecategoriessupports_updatesupports_uninstallupdate_availabledomain_nameactive_directory.user.display_nameactive_directory.machine.display_nameactive_directory.user.ouactive_directory.machine.ouactive_directory.user.sam_account_nameactive_directory.machine.sam_account_nameignored_until sort_orderstring- Sorting direction. Example: asc.one of
ascdesc update_availableboolean- Filter the search by update_available. Search for an exact match. Example: true.
update_ignoredboolean- Filter the search to only include ignored software updates. Example: true.
vendorstring- Filter the search by vendor. Search for the matches that contain the value. Example: 2025-01-01T00:00:00Z.
malwarebytes_cve_bulk_getGet the details of several CVEs by CVE ID in one request.Read-onlyCVE Bulk Get
Get the details of several CVEs by CVE ID in one request. Returns a JSON array with one CVE detail object per requested ID. Use to look up many CVE IDs at once. Use cve_get for one.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
idsarrayrequired- CVE IDs to look up, as a JSON array of strings such as ["CVE-2024-3094"]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
malwarebytes_cve_getGet the details of one CVE by its CVE ID.Read-onlyCVE Get
Get the details of one CVE by its CVE ID. Returns cve, cwe, is_cisa_exploitable, known_ransomware_campaign_use, published_epoch, last_modified_epoch and more fields. Use for CVSS scores, references and exploit information of a known CVE.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
cve_idstringrequired- CVE identifier. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_cve_searchSearch vulnerabilities (CVEs) found on endpoints with filters, sorting and cursor pagination.Read-onlyCVE Search
Search vulnerabilities (CVEs) found on endpoints with filters, sorting and cursor pagination. Returns results, aggregations, total_count, next_cursor fields. Use to find affected endpoints and software. Use cve_get for details of one CVE ID.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
cisa_exploitableboolean- Filter the search by cisa_exploitable. Search for an exact match. Example: true.
cve_idstring- Filter the search by cve_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_idstring- Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_namestring- Filter the search by group_name. Search for an exact match. Example: Example.
host_namestring- Filter the search by host_name. Search for an exact match. Example: Example.
installed_versionstring- Filter the search by installed_version. Search for an exact match. Example: example.
known_ransomware_campaign_useboolean- Filter the search by known_ransomware_campaign_use. Search for an exact match. Example: true.
machine_idstring- Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
name_multi_searchstring- Filter with alises. Example: WORKSTATION-01.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
only_ignored_cvesboolean- Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false. Example: true.
page_sizeinteger- Number of results per page. Example: 25.
productstring- Filter the search by product. Search for an exact match. Example: Example.
severitystring- Filter the search by severity. Search for an exact match. Example: example.
sort_fieldstring- Sort field. Example: account_id.one of
account_idaccount_nameparent_account_idgroup_idroot_group_idmachine_idobject_guidhost_namefully_qualified_host_namealiassort_namevendornormalized_vendordisplay_vendorproductnormalized_productdisplay_productinstalled_versionnormalized_installed_versiondisplay_installed_versionos_info.os_typeos_info.os_versionos_info.os_platformos_info.os_architectureos_info.os_release_namecve_idseverityinstallation_datecreated_atpublished_atcisa_exploitableknown_ransomware_campaign_useseverity_scorecvss20_scorecvss30_scoregroup_namedomain_namesupports_updatesupports_uninstallignored_untilignored_atactive_directory.user.display_nameactive_directory.machine.display_nameactive_directory.user.ouactive_directory.machine.ouactive_directory.user.sam_account_nameactive_directory.machine.sam_account_name sort_orderstring- Sorting direction. Example: asc.one of
ascdesc vendorstring- Filter the search by vendor. Search for an exact match. Example: 2025-01-01T00:00:00Z.
malwarebytes_detection_getGet one detection by ID.Read-onlyDetection Get
Get one detection by ID. Returns id, scan_id, machine_id, machine_name, group_id, group_name and more fields. Use when you have a detection ID from detection_search. Needs a detection ID from detection_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
detection_idstringrequired- ID of the detection. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_detection_searchSearch malware and threat detections across the account with filters, sorting and cursor pagination.Read-onlyDetection Search
Search malware and threat detections across the account with filters, sorting and cursor pagination. Returns detections, aggregations, total_count, next_cursor fields. Use to find detections by threat name, category, machine or date. Use detection_get for one known detection.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
action_takenstring- The action taken of the detection. Example: example.
affected_applicationstring- The application affected by this detection. Example: example.
categorystring- The category of this detection. Example: example.
detection_idstring- The ID of the detection (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_idstring- The ID of the group to which the endpoint is assigned (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
host_namestring- Filter the search to the endpoints with specified host name. Example: Example.
job_idstring- ID of the job originating this detection. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
machine_idstring- The ID of the endpoint (machine) where this detection originated (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
machine_namestring- The name of the machine. Example: Example.
md5string- The md5 hash of this detection. Example: d41d8cd98f00b204e9800998ecf8427e.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
pathstring- The path where this detection happened. Example: example.
process_namestring- The name of the process that originated this detection. Example: Example.
protection_statusstring- Protection status of the endpoint(s). Example: example.
reported_at_afterstring- Get results reported after this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
reported_at_beforestring- Get results reported before this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
scan_idstring- The ID of the scan (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
scan_typestring- Type of the scan that produced the detection. Example: example.
scanned_at_afterstring- Get results generated by a scan happening after this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
scanned_at_beforestring- Get results generated by a scan happening before this date (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
sha256string- The sha256 hash of this detection. Example: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
sort_fieldstring- If the sort field is used, then sort_order is required. Example: trace_id.one of
trace_idscan_idmachine_idgroup_idaccount_iddetection_idparent_detection_idcorrelation_hashstatusthreat_name.keywordtypepath.keywordcategorymd5sha256affected_application.keywordprocess_name.keywordmachine_name.keywordscanned_atreported_atcleaned_atis_root_detectionis_rtp_stream_eventobject_guidscan_result.device.disk_modelactive_directory.user.display_nameactive_directory.user.sam_account_nameactive_directory.user.ouactive_directory.machine.display_nameactive_directory.machine.sam_account_nameactive_directory.machine.ou sort_orderstring- Sorting direction. Example: asc.one of
ascdesc statusstring- The status of the detection. Example: example.
threat_namestring- The name of the threat. Example: Example.
typestring- The type of the detection. Example: example.
malwarebytes_dns_log_searchSearch DNS filtering logs with filters, sorting and cursor pagination.Read-onlyDNS Log Search
Search DNS filtering logs with filters, sorting and cursor pagination. Returns results, aggregations, total_count, next_cursor fields. Use to review blocked or allowed DNS queries.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
actionstring- Filter the search by action. Search for an exact match. Example: example.
group_idstring- Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_namestring- Filter the search by group_name. Search for an exact match. Example: Example.
machine_idstring- Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
policy_namestring- Filter the search by policy_name. Search for an exact match. Example: Example.
rule_namestring- Filter the search by rule_name. Search for an exact match. Example: Example.
sort_fieldstring- Sort field. Example: machine_id.one of
machine_idgroup_idgroup_namerule_idrule_nameresolved_ipspolicy_idpolicy_nameaccount_idparent_account_idactionlog.policy_idlog.policylog.protocollog.query_namelog.query_name_reversedlog.resolver_decisionlog.user_idlog.colo_idlog.dst_portlog.query_category_idslog.query_sizelog.query_typelog.src_portlog.dst_iplog.src_iptimestamplog.datetimeagent.atagent.last_useragent.fully_qualified_host_nameagent.started_at_localagent.started_at_offsetagent.os_info.os_typeagent.os_info.os_versionagent.os_info.os_platformagent.os_info.os_architectureagent.os_info.os_release_nameagent.domain_nameagent.engine_versionagent.policy_etagagent.host_nameagent.nics.ipsagent.nics.mac_addressmachine.tags.aliasagent.has_alertsagent.machine_ipagent.object_guidagent.plugins.endpoint_protection.sdk_versionagent.plugins.endpoint_protection.component_package_versionagent.source_location.cityagent.source_location.countryagent.source_location.country_isoagent.source_location.continentagent.source_location.time_zoneagent.source_location.postal_codeagent.source_location.subdivisionsagent.source_location.anonymous_proxyagent.serial_numberactive_directory.user.display_nameactive_directory.user.sam_account_nameactive_directory.user.ouactive_directory.machine.display_nameactive_directory.machine.sam_account_nameactive_directory.machine.ou sort_orderstring- Sorting direction. Example: asc.one of
ascdesc timestamp_afterstring- Filter the search by timestamp_after. Example: 2025-01-01T00:00:00Z.
timestamp_beforestring- Filter the search by timestamp_before. Search for the documents that are after the given timestamp. Example: 2025-01-01T00:00:00Z.
malwarebytes_endpoint_agent_info_getGet agent and plugin version information for one endpoint.Read-onlyEndpoint Agent Info Get
Get agent and plugin version information for one endpoint. Returns agent_info, last_seen_at, agent_info_last_updated_at fields. Use to check which agent version and plugins an endpoint runs. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_endpoint_assets_getGet the hardware and software asset inventory of one endpoint.Read-onlyEndpoint Assets Get
Get the hardware and software asset inventory of one endpoint. Returns startups, os_info, memory, computer_info, software_installed, nics and more fields. Use to inspect installed software, OS, drives and network adapters of a single endpoint. Use asset_software_search across all endpoints. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_endpoint_drives_getList the drives of one endpoint with their encryption state.Read-onlyEndpoint Drives Get
List the drives of one endpoint with their encryption state. Returns drives fields. Use to check drive encryption on a single endpoint. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_endpoint_getGet one endpoint by ID, including its name, group, policy, OS and online state.Read-onlyEndpoint Get
Get one endpoint by ID, including its name, group, policy, OS and online state. Returns id, policy_id, group_id, name, online, is_deleted and more fields. Use after endpoint_search when you have the endpoint ID and need full details. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
populate_diag_infoboolean- Populate diag info. Example: true.
malwarebytes_endpoint_network_getGet the network adapters and addresses of one endpoint.Read-onlyEndpoint Network Get
Get the network adapters and addresses of one endpoint. Returns nics, host_name, fully_qualified_host_name, last_seen_at, agent_info_last_updated_at fields. Use to find the IP and MAC addresses of an endpoint. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_endpoint_quarantine_listList the quarantined items on one endpoint.Read-onlyEndpoint Quarantine List
List the quarantined items on one endpoint. Returns quarantined_threats, total_count, next_cursor fields. Use to review what is quarantined on a single endpoint. Use quarantine_search for account-wide searches. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
categorystring- Search with quarantine category. Example: example.
namestring- Search with quarantine threat name. Example: Example.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
sincestring- Timestamp to filter since quarantine scan times. Example: 2025-01-01T00:00:00Z.
typestring- Search with quarantine type. Example: example.
untilstring- Timestamp to filter until quarantine scan times. Example: 2025-01-01T00:00:00Z.
malwarebytes_endpoint_scan_detections_listList the detections found by one scan of an endpoint.Read-onlyEndpoint Scan Detections List
List the detections found by one scan of an endpoint. Returns detections, total_count, next_cursor fields. Use to see which threats a given scan found. Use detection_search to search across all endpoints. Needs endpoint and scan IDs from endpoint_scans_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
scan_idstringrequired- ID of the scan. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
sincestring- The Since Schema (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
malwarebytes_endpoint_scan_getGet one scan of an endpoint by scan ID.Read-onlyEndpoint Scan Get
Get one scan of an endpoint by scan ID. Returns id, machine_id, schedule_id, schedule_name, from_cloud, ondemand and more fields. Use when you have a scan ID from endpoint_scans_list. Needs endpoint and scan IDs from endpoint_scans_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
scan_idstringrequired- ID of the scan. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
populate_schedule_nameboolean- Populate the schedule name. Example: Example.
malwarebytes_endpoint_scans_listList the scans that ran on one endpoint.Read-onlyEndpoint Scans List
List the scans that ran on one endpoint. Returns a JSON array of scan records with id, type, start time and threat counts. Use to review scan history. Use endpoint_scan_get for one scan and endpoint_scan_detections_list for its threats. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
page_sizeinteger- Number of results per page. Example: 25.
populatestring- Set to schedules to include schedule details for each scan. Example: example.
sincestring- The Since Schema (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
start_indexinteger- The start index for pagination. Example: 2025-01-01T00:00:00Z.
threats_detectedstring- Optional parameter to filter out scan results based on whether threats were found. If omitted defaults to returning all. Example: true.one of
truefalse
malwarebytes_endpoint_searchSearch endpoints (managed machines) in the Nebula account with filters, sorting and cursor pagination.Read-onlyEndpoint Search
Search endpoints (managed machines) in the Nebula account with filters, sorting and cursor pagination. Returns aggregations, endpoints, total_count, next_cursor, after fields. Use to find endpoints by name, group, policy, status or IP. Use endpoint_get for one known endpoint.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
aliasstring- Aliases for the machine. Example: Example.
connectedboolean- connected. Example: true.
domain_namestring- Filter the search to the endpoints with specified domain name. Example: Example.
fully_qualified_host_namestring- Filter the search to the endpoints with specified, fully qualified host name. Example: Example.
group_idstring- Filter the search by group id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_namestring- Filter the search by group's name. Example: Example.
has_alertsboolean- Indicates whether the endpoint needs attention. Example: true.
host_namestring- Filter the search to the endpoints with specified host name. Example: Example.
infection_foundboolean- Filter the search to the endpoints with one or more security threats found. Example: true.
is_deletedboolean- is_deleted filter. Example: true.
is_isolatedboolean- Indicates whether the endpoints are isolated or not. Example: true.
is_software_update_availableboolean- Indicates whether the agent has an available update. Example: true.
last_userstring- Last user that logged into the machine. Example: example.
machine_idstring- Filter the search to the endpoints with specified id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
machine_ipstring- machine_ip filter. Example: 10.0.0.15.
name_multi_searchstring- Search either alias, host name of fully qualified host name. Example: WORKSTATION-01.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
policy_idstring- Filter the search to the endpoints with specified policy (id). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
policy_namestring- Filter the search to the endpoints with specified policy (name). Example: Example.
protection_statusstring- Protection status of the endpoint(s). Example: example.
reboot_requiredboolean- Filter the search to the endpoints needing a reboot. Example: true.
serial_numberstring- Serial number filter. Example: example.
sort_fieldstring- Sort field. Example: at.one of
atnics.ipsnics.mac_addressnics.descriptionos_info.os_typeos_info.os_versionos_info.os_platformos_info.os_architectureos_info.os_release_namehost_namefully_qualified_host_nameplugins.asset_manager.plugin_versionplugins.asset_manager.reboot_reasonplugins.endpoint_protection.plugin_versionplugins.endpoint_protection.sdk_versionplugins.endpoint_protection.component_package_versionplugins.endpoint_protection.update_package_versionplugins.endpoint_protection.reboot_reasonplugins.endpoint_detection_and_response.plugin_versionplugins.endpoint_detection_and_response.reboot_reasonplugins.incident_response.plugin_versionplugins.incident_response.reboot_reasonplugins.siem.plugin_versionplugins.browser_phishing_protection.plugin_versionplugins.siem.reboot_reasonengine_versiondomain_namepolicy_etagaccount_idgroup_idroot_group_idgroup_namepolicy_namepolicy_iddeleted_atcreated_atmarked_for_deletionis_deletedlast_day_seenlast_scanned_atlast_usertags.aliasname_multi_searchmachine_ipserial_numberobject_guidvulnerabilities_found.criticalvulnerabilities_found.highvulnerabilities_found.mediumvulnerabilities_found.lowvulnerabilities_found.nonevulnerabilities_found.totalos_patches_availablelast_assets_scan_atconnected sort_orderstring- Whether sorting should be ascending or descending. Example: asc.one of
ascdesc suspicious_activity_foundboolean- Filter the search to the endpoints that have open suspicious activities. Example: true.
malwarebytes_endpoint_search_groupbyCount endpoints grouped by a field such as group, policy or protection status.Read-onlyEndpoint Search Groupby
Count endpoints grouped by a field such as group, policy or protection status. Returns results, next_cursor fields. Use for summary counts. Use endpoint_search to list the endpoints themselves.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_bystringrequired- Endpoint field to group the counts by, such as protection_status, policy_id, group_id or engine_version. Example: os_info.os_platform.one of
os_info.os_platformos_info.os_typeos_info.os_architectureos_info.os_versionos_info.os_release_nameengine_versionpolicy_etagaccount_idgroup_idroot_group_idpolicy_idmachine_iplast_userobject_guidplugins.endpoint_protection.sdk_versionplugins.endpoint_protection.component_package_versionplugins.endpoint_protection.update_package_versionserial_numberprotection_statusplugins.browser_phishing_protection.plugin_version page_sizeintegerrequired- Number of groups to return, from 50 to 2000. Example: 50.
group_idstring- Filter the search by group id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
has_alertsboolean- Indicates whether the endpoint needs attention. Example: true.
is_isolatedboolean- Indicates whether the endpoints are isolated or not. Example: true.
name_multi_searchstring- Search either alias, host name of fully qualified host name. Example: WORKSTATION-01.
policy_idstring- Filter the search to the endpoints with specified policy (id). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
protection_statusstring- Protection status of the endpoint(s). Example: example.
malwarebytes_endpoint_status_getGet the current protection status of one endpoint.Read-onlyEndpoint Status Get
Get the current protection status of one endpoint. Returns remediation_required, reboot_required, suspicious_activity, isolation, scan_needed fields. Use for a quick check of remediation, reboot, suspicious activity, isolation or scan-needed flags. Use endpoint_get for full details. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_endpoint_suspicious_activity_listList suspicious activity records for one endpoint.Read-onlyEndpoint Suspicious Activity List
List suspicious activity records for one endpoint. Returns sa, total_count, next_cursor fields. Use to review suspicious activity on one endpoint. Use suspicious_activity_list for the whole account. Needs an endpoint ID from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
per_pageinteger- Items per page. Example: 25.
sincestring- Since (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
sort_directionstring- Sort direction. Example: asc.one of
ascdesc sort_fieldstring- Sort field. Example: timestamp.one of
timestamplevelpc_hostname
malwarebytes_events_listRetrieve account events with search, machine, time and severity filters.Read-onlyEvents List
Retrieve account events with search, machine, time and severity filters. Returns events, total_count, next_cursor fields. Use to review the activity audit trail.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endstring- Timestamp to filter until event times. Example: 2025-01-01T00:00:00Z.
machine_idstring- Search with machine_id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
search_stringstring- Search with events with event string. Example: example.
severity_flagsnumber- Severity filter code: 0, 1, 2, 4 or 8. Example: 0.one of
01248 sourcenumber- Event source code from 1 to 6. Example: 1.one of
123456 startstring- Timestamp to filter since event times. Example: 2025-01-01T00:00:00Z.
malwarebytes_exclusion_getGet one exclusion by ID.Read-onlyExclusion Get
Get one exclusion by ID. Returns id, etag, type, value, enabled, comment and more fields. Use when you have an exclusion ID from exclusion_list. Needs an exclusion ID from exclusion_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
exclusion_idstringrequired- ID of the exclusion. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
populate_riskboolean- Populate risk fields on exclusion. Example: true.
malwarebytes_exclusion_listList exclusions with search, type, policy and risk filters.Read-onlyExclusion List
List exclusions with search, type, policy and risk filters. Returns exclusions, total_count, next_cursor fields. Use to find exclusion IDs. Use exclusion_get for one known exclusion.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
policy_idsstring- Search with exclusion policy ids. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
populate_riskboolean- Populate risk fields on exclusions. Example: true.
riskstring- Filter exclusions by risk level (validated by Retina). Example: example.
search_stringstring- Search with exclusion string. Example: example.
sincestring- Timestamp to filter since exclusion times. Example: 2025-01-01T00:00:00Z.
sort_bystring- Field to sort results with. 'risk' is resolved in-memory by Retina (risk is not persisted). Example: enabled.one of
enabledvaluecreated_atupdated_atcreated_byupdated_bytyperisk sort_orderstring- Sorting direction. Example: asc.one of
ascdesc typenumber- Search with exclusion type. Example: 1.
untilstring- Timestamp to filter until exclusion times. Example: 2025-01-01T00:00:00Z.
malwarebytes_group_getGet one endpoint group by ID.Read-onlyGroup Get
Get one endpoint group by ID. Returns id, account_id, name, machines_count, policy_id, policy_name and more fields. Use when you have a group ID from group_list. Needs a group ID from group_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_idstringrequired- ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_group_listList endpoint groups, optionally filtered by name or parent group.Read-onlyGroup List
List endpoint groups, optionally filtered by name or parent group. Returns groups, total_count, next_cursor fields. Use to find group IDs. Use group_get for one known group.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
filter_by_parent_idstring- Set this to 'true' when parent_id has been set. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
namestring- Filter by group name. Example: Example.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
parent_idstring- For filtering by parent group ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_installation_token_listList endpoint installation tokens.Read-onlyInstallation Token List
List endpoint installation tokens. Returns installation_tokens, total_count fields. Use to review existing tokens. Use installation_token_create to make a new one.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
include_expiredboolean- Include or exclude the expired tokens. Example: true.
include_usedboolean- Include or exclude the used tokens. Example: true.
page_sizeinteger- Number of results per page. Example: 25.
sort_bystring- Field to sort with. Example: created_at.one of
created_atused_atexpires_at sort_orderstring- Sort order. Example: asc.one of
ascdesc start_indexinteger- The index of the first element. Example: 2025-01-01T00:00:00Z.
malwarebytes_installers_listRetrieve download links for the endpoint agent installers.Read-onlyInstallers List
Retrieve download links for the endpoint agent installers. Returns win_msi, x64_msi, win_web, win_full, mac_os, ea2_arm_msi and more fields. Use to get installer URLs for Windows and macOS.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_job_getGet one job by ID, including its command, target and status.Read-onlyJob Get
Get one job by ID, including its command, target and status. Returns id, machine_id, machine_name, command, issued_at, issued_by_email and more fields. Use to check progress of a job issued with job_issue or jobs_issue_bulk. Needs a job ID from job_issue or job_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
job_idstringrequired- ID of the job. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_job_searchSearch jobs with filters on command, status, endpoint and issue time.Read-onlyJob Search
Search jobs with filters on command, status, endpoint and issue time. Returns jobs, total_count, next_cursor fields. Use to find jobs. Use job_get for one known job and parent_job_search for batches.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
cancelled_bystring- Filter the search by the id of the user who cancelled the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: example.
commandstring- Filter the search by endpoint name command name. Example: command.threat.scan.one of
command.threat.scancommand.asset.rebootcommand.service.restartcommand.protection.update.nowcommand.machine.update.nowcommand.asset.refreshcommand.edr.isolationcommand.threat.quarantine.removecommand.threat.quarantine.restorecommand.bfp.rules.deletecommand.service.diagcommand.edr.fileuploadcommand.edr.unlock.forcecommand.edr.lockcommand.sequence.remediatecommand.edr.unlockcommand.logging.level.setcommand.threat.scan.remediatecommand.policy.refreshcommand.machine.plugin.updatepartscommand.asset.patchcommand.asset.updatesoftwarecommand.asset.uninstallsoftware endpointstring- Filter the search by endpoint name.. Search for occurrences of the given value in the host_name fully_qualified_host_name and alias. Example: 2025-01-01T00:00:00Z.
expires_at_afterstring- Results include jobs that expire after the specified date. Example: 2025-01-01T00:00:00Z.
expires_at_beforestring- Results include jobs that expire before the specified date. Example: 2025-01-01T00:00:00Z.
idstring- Filter the search by a single job ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
issued_at_afterstring- Results include jobs that have been issued after the specified date. Example: 2025-01-01T00:00:00Z.
issued_at_beforestring- Results include jobs that have been issued before the specified date. Example: 2025-01-01T00:00:00Z.
issued_bystring- Filter the search by the id of the user who issued the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: example.
issued_by_emailstring- Filter the search by the email of the user who issued the job. Contains operator. Example: example.
machine_idstring- Filter the search Machine Id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
sort_fieldstring- Sort field. Example: command.one of
commandissued_byissued_atexpires_atstatusmachine_nameaccount_name sort_orderstring- Sorting direction. Example: asc.one of
ascdesc statusnumber- Job status filter code: 1 created, 2 sent, 4 received, 8 started, 16 timed out, 32 completed, 64 expired, 128 failed, 256 cancelled. Add codes together to match several statuses. Example: 1.
malwarebytes_notification_getGet one notification subscription by ID.Read-onlyNotification Get
Get one notification subscription by ID. Returns the notification subscription with its recipients and rule settings. Use when you have a subscription ID from notification_list. Needs a subscription ID from notification_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
subscription_idstringrequired- ID of the notification subscription. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_notification_listList notification subscriptions.Read-onlyNotification List
List notification subscriptions. Returns records, next_cursor fields. Use to review alert notification rules.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
only_current_ownerboolean- if true, only the notifications subscriptions owned by the requester will be returned. Example: true.
page_sizeinteger- Number of results per page. Example: 25.
malwarebytes_os_patch_searchSearch available operating system patches across endpoints.Read-onlyOS Patch Search
Search available operating system patches across endpoints. Returns results, aggregations, total_count, next_cursor fields. Use to find missing OS patches by severity, vendor or machine.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
categorystring- Filter the search by category. Search for an exact match. Example: example.
group_idstring- Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_namestring- Filter the search by group_name. Search for an exact match. Example: Example.
host_namestring- Filter the search by host_name. Search for an exact match. Example: Example.
kb_idstring- Filter the search by kb_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
machine_idstring- Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
productstring- Filter the search by product. Search for an exact match. Example: Example.
reboot_requiredboolean- Filter the search by reboot_required. Example: true.
severitystring- Filter the search by severity. Search for an exact match. Example: example.
sort_fieldstring- Sort field. Example: account_id.one of
account_idaccount_nameparent_account_idmachine_idgroup_idroot_group_idobject_guidhost_namefully_qualified_host_namedisplay_namevendorproductos_info.os_typeos_info.os_versionos_info.os_platformos_info.os_architectureos_info.os_release_nameseveritytitledescriptioncategorysecurity_update_idpatch_idkb_idcreated_atreleased_atreboot_requiredpreview_patchsizedomain_nameactive_directory.user.display_nameactive_directory.machine.display_nameactive_directory.user.ouactive_directory.machine.ouactive_directory.user.sam_account_nameactive_directory.machine.sam_account_nameignored_until sort_orderstring- Sorting direction. Example: asc.one of
ascdesc titlestring- Filter the search by title. Search for an exact match. Example: Example.
update_ignoredboolean- Filter the search by update_ignored os patches. Example: true.
vendorstring- Filter the search by vendor. Search for an exact match. Example: 2025-01-01T00:00:00Z.
malwarebytes_parent_job_getGet one parent job (a batch of jobs sharing a correlation ID).Read-onlyParent Job Get
Get one parent job (a batch of jobs sharing a correlation ID). Returns correlation_id, account_id, source_id, account_name, created_at, expires_at and more fields. Use to inspect a batch started by job_issue or jobs_issue_bulk. Needs the correlation_id returned when the job was issued.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
correlation_idstringrequired- Correlation ID of the parent job (the correlation_id returned when the job was issued). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_parent_job_searchSearch parent jobs (batches of jobs) with constraints and cursor pagination.Read-onlyParent Job Search
Search parent jobs (batches of jobs) with constraints and cursor pagination. Returns jobs, total_count, next_cursor fields. Use to review batches. Use job_search for individual jobs.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
constraintsarray- Array of constraint objects, each with a field, an operator (equals, not_equals, contains or not_contains) and a value, for example [{"field": "command", "operator": "equals", "value": "command.threat.scan"}]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
sort_fieldstring- Parent Jobs Sort Fields. Example: created_at.one of
created_atexpires_atsource_idcommandissued_byissued_by_nameissued_by_emailaccountsendpointscreatedsentreceivedprocessingtimed_outsuccessexpiredcancelledfailedis_complete sort_orderstring- Whether sorting should be ascending or descending. Example: asc.one of
ascdesc
malwarebytes_policy_getGet one policy by ID, including its full settings.Read-onlyPolicy Get
Get one policy by ID, including its full settings. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use when you have a policy ID from policy_list. Needs a policy ID from policy_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
policy_idstringrequired- ID of the policy. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
populatestring- Comma-separated extra data to include: groups, exclusions or groups,exclusions. Example: example.
malwarebytes_policy_listList the policies of the Nebula account.Read-onlyPolicy List
List the policies of the Nebula account. Returns policies, total_count fields. Use to find policy IDs. Use policy_get for the full contents of one policy.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_policy_system_default_getGet the system default policy settings.Read-onlyPolicy System Default Get
Get the system default policy settings. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use as a template when building the contents of a new policy.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_quarantine_listList quarantined items across the account with simple filters.Read-onlyQuarantine List
List quarantined items across the account with simple filters. Returns quarantined_threats, total_count, next_cursor fields. Use for a quick listing. Use quarantine_search for advanced constraints.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
categorystring- Search with quarantine category. Example: example.
namestring- Search with quarantine threat name. Example: Example.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
sincestring- Timestamp to filter since quarantine scan times. Example: 2025-01-01T00:00:00Z.
typestring- Search with quarantine type. Example: example.
untilstring- Timestamp to filter until quarantine scan times. Example: 2025-01-01T00:00:00Z.
malwarebytes_quarantine_searchSearch quarantined items across the account with constraints, sorting and cursor pagination.Read-onlyQuarantine Search
Search quarantined items across the account with constraints, sorting and cursor pagination. Returns quarantine, total_count, next_cursor fields. Use for account-wide quarantine searches. Use endpoint_quarantine_list for one endpoint.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
constraintsarray- Array of constraint objects, each with a field, an operator (equals, not_equals, contains or not_contains) and a value, for example [{"field": "threat_name", "operator": "contains", "value": "Trojan"}]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
fieldsarray- Names of the fields to include in each result, as a JSON array of strings such as threat_name, path and machine_name. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
sort_fieldstring- Sort field. Example: scanned_at.one of
scanned_atauto_removal_at sort_orderstring- Whether sorting should be ascending or descending. Example: asc.one of
ascdesc
malwarebytes_remediation_searchSearch remediation items with constraints, sorting and cursor pagination.Read-onlyRemediation Search
Search remediation items with constraints, sorting and cursor pagination. Returns items, total_count, next_cursor fields. Use to find items awaiting remediation.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
constraintsarray- Array of constraint objects, each with a field, an operator (equals, not_equals, contains or not_contains) and a value, for example [{"field": "threat_name", "operator": "contains", "value": "Trojan"}]. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
fieldsarray- Names of the fields to include in each result, as a JSON array of strings. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
sort_fieldstring- Sort field. Example: scanned_at.one of
scanned_at sort_orderstring- Whether sorting should be ascending or descending. Example: asc.one of
ascdesc
malwarebytes_report_getGet one report definition by ID.Read-onlyReport Get
Get one report definition by ID. Returns id, account_id, name, type, format, period and more fields. Use when you have a report ID from report_list. Needs a report ID from report_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
report_idstringrequired- ID of the report. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
populatestring- Set to users to include the report recipients. Example: users.one of
users
malwarebytes_report_listList the configured reports.Read-onlyReport List
List the configured reports. Returns reports, next_cursor fields. Use to find report IDs. Use report_get for one report.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
page_sizeinteger- Number of results per page. Example: 25.
populatestring- Set to users to include the report recipients. Example: users.one of
users
malwarebytes_sandbox_submissions_searchSearch sandbox submission results by file name, hash, result or status.Read-onlySandbox Submissions Search
Search sandbox submission results by file name, hash, result or status. Returns data fields. Use to check verdicts of files submitted for sandbox analysis.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
extarray- Ext. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
file_namestring- File name. Example: Example.
md5string- Md5. Example: d41d8cd98f00b204e9800998ecf8427e.
resultarray- Result. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
statusarray- Status. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
timestampstring- Submission time filter as an ISO 8601 timestamp. Example: 2025-01-01T00:00:00Z.
upload_sourcestring- Upload source. Example: example.
malwarebytes_schedule_getGet one schedule by ID.Read-onlySchedule Get
Get one schedule by ID. Returns id, name, etag, command, rrule, enabled and more fields. Use when you have a schedule ID from schedule_list. Needs a schedule ID from schedule_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
schedule_idstringrequired- ID of the schedule. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_schedule_listList scan and job schedules.Read-onlySchedule List
List scan and job schedules. Returns schedules, total_count, next_cursor fields. Use to find schedule IDs. Use schedule_get for one schedule.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
malwarebytes_suspicious_activity_details_getGet details for suspicious activity detections of an endpoint by detection IDs.Read-onlySuspicious Activity Details Get
Get details for suspicious activity detections of an endpoint by detection IDs. Returns data, next_cursor fields. Use after suspicious_activity_list when you need the full records for specific detection IDs. Needs detection IDs and the endpoint ID from suspicious_activity_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
detection_id_listarrayrequired- Suspicious activity IDs to fetch details for, as a JSON array of strings. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
endpointstringrequired- ID of the endpoint the suspicious activity belongs to. Example: 2025-01-01T00:00:00Z.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
malwarebytes_suspicious_activity_listList suspicious activity records across the account.Read-onlySuspicious Activity List
List suspicious activity records across the account. Returns sa, total_count, next_cursor fields. Use to triage open suspicious activity account-wide. Use endpoint_suspicious_activity_list for one endpoint.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
beforestring- Before (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
group_idsstring- ID of a group to restrict the results to. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
next_cursorstring- Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.
per_pageinteger- Page size. Example: 25.
sincestring- Since (Ex. "2020-03-23T17:23:17.860482Z"). Example: 2025-01-01T00:00:00Z.
sort_directionstring- Sort direction. Example: asc.one of
ascdesc sort_fieldstring- Sort field. Example: timestamp.one of
timestamplevelpc_hostname
malwarebytes_xdr_alert_getGet one XDR alert by ID and source.Read-onlyXDR Alert Get
Get one XDR alert by ID and source. Returns id, account_id, account_name, metadata, source, severity and more fields. Use to inspect an XDR alert before changing its status. Needs an alert ID and source.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
alert_idnumberrequired- ID of the XDR alert. Example: 1234.
sourcestringrequired- Source of the alert. Example: edr.one of
edroktaentra
malwarebytes_exclusion_createCreate an exclusion so selected items are skipped by protection.WriteExclusion Create
Create an exclusion so selected items are skipped by protection. Returns id, etag, type, value, enabled, comment and more fields. Use to allow a file, folder, domain or similar item. Use exclusion_update to change one.
Inputs
account_levelbooleanrequired- Whether this is an account-level exclusion. Use policy_ids to list policies when it is not. Example: true.
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
enabledbooleanrequired- Whether the exclusion is active. Example: true.
exclude_fromobjectrequired- Protection layers the exclusion applies to, as a JSON object of booleans: exploit_protection, malware_protection, ransomware_protection, suspicious_activity, website_protection and bruteforce_protection. When the exclusion is enabled at least one must be true. Example: {"key": "value"}.
typeintegerrequired- Exclusion type code: 1 file path, 2 folder path, 3 wildcard path, 4 registry, 5 file extension, 6 web domain, 7 web IP, 8 web monitoring, 13 hash (MD5), 14 command line, 17 ransomware network protection. Example: 1.
valuestringrequired- The item to exclude, such as a path, domain, IP address or MD5 hash, matching the exclusion type. Example: example.
commentstring- Comment. Example: Example.
friendly_namestring- Friendly name. Example: 2025-01-01T00:00:00Z.
policy_idsarray- IDs of the policies the exclusion applies to. Get them from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_exclusion_updateUpdate an existing exclusion.WriteExclusion Update
Update an existing exclusion. Returns id, etag, type, value, enabled, comment and more fields. Use to change an exclusion's value, scope or enabled state. Send the current etag from exclusion_get. Needs an exclusion ID and etag from exclusion_get.
- Idempotent
Inputs
account_levelbooleanrequired- Whether this is an account-level exclusion. Use policy_ids to list policies when it is not. Example: true.
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
enabledbooleanrequired- Whether the exclusion is active. Example: true.
etagstringrequired- Current etag of the exclusion, from exclusion_get. Used to detect concurrent edits. Example: example.
exclude_fromobjectrequired- Protection layers the exclusion applies to, as a JSON object of booleans: exploit_protection, malware_protection, ransomware_protection, suspicious_activity, website_protection and bruteforce_protection. When the exclusion is enabled at least one must be true. Example: {"key": "value"}.
exclusion_idstringrequired- ID of the exclusion. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
typeintegerrequired- Exclusion type code: 1 file path, 2 folder path, 3 wildcard path, 4 registry, 5 file extension, 6 web domain, 7 web IP, 8 web monitoring, 13 hash (MD5), 14 command line, 17 ransomware network protection. Example: 1.
valuestringrequired- The item to exclude, such as a path, domain, IP address or MD5 hash, matching the exclusion type. Example: example.
commentstring- Comment. Example: Example.
friendly_namestring- Friendly name. Example: 2025-01-01T00:00:00Z.
policy_idsarray- IDs of the policies the exclusion applies to. Get them from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_group_createCreate an endpoint group with a name and policy.WriteGroup Create
Create an endpoint group with a name and policy. Returns id, account_id, name, machines_count, policy_id, policy_name and more fields. Use to add a group. Use group_update to change an existing one. Needs a policy ID from policy_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
namestringrequired- Name of the new group. Example: Example.
policy_idstringrequired- ID of the policy the group uses. Get it from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
parent_idstring- ID of the parent group; leave empty to create a top-level group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
schedule_idsarray- IDs of the schedules to attach to the group. Get them from schedule_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_group_endpoints_assignMove endpoints into a group by endpoint IDs or by an endpoint search query.WriteGroup Endpoints Assign
Move endpoints into a group by endpoint IDs or by an endpoint search query. Returns moved, errors fields. Use to reassign endpoints to a different group. Needs a group ID from group_list and endpoint IDs from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpointsarrayrequired- Endpoints to move into the group, as a JSON array of objects with an id, for example [{"id": "9256034b-7967-4253-a5d9-260663e4fa4f"}]. Both endpoints and queries are required by the API. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_idstringrequired- ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
queriesarrayrequired- Endpoint search selectors choosing the endpoints to move, as a JSON array of objects that use the same filter fields as endpoint_search. Required by the API. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
malwarebytes_group_updateUpdate the name, policy, parent or schedules of an endpoint group.WriteGroup Update
Update the name, policy, parent or schedules of an endpoint group. Returns id, account_id, name, machines_count, policy_id, policy_name and more fields. Use to rename a group or change its policy. All of name and policy_id are required. Needs a group ID from group_list and a policy ID from policy_list.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_idstringrequired- ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
namestringrequired- New name of the group. Example: Example.
policy_idstringrequired- ID of the policy the group uses. Get it from policy_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
parent_idstring- ID of the parent group; leave empty for a top-level group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
schedule_idsarray- IDs of the schedules to attach to the group. Get them from schedule_list. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_installation_token_createGenerate a new endpoint installation token.WriteInstallation Token Create
Generate a new endpoint installation token. Returns account_id, id, token, created_by, created_at, used_at and more fields. Use when installing the agent on a new machine.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_job_issueIssue a job such as scan, reboot, isolate or update to one or more endpoints by endpoint ID.WriteJob Issue
Issue a job such as scan, reboot, isolate or update to one or more endpoints by endpoint ID. Returns jobs, total_count, correlation_id fields. Use to act on specific endpoints. Use jobs_issue_bulk to target endpoints or groups by query. Track progress with job_get. Needs endpoint IDs from endpoint_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
commandstringrequired- Job command to run on the endpoints. Common values are command.threat.scan (scan), command.asset.reboot (reboot), command.edr.isolation (isolate), command.edr.unlock (remove isolation), command.policy.refresh (refresh policy) and command.protection.update.now (check for protection updates). Example: command.threat.scan.one of
command.threat.scancommand.asset.rebootcommand.service.restartcommand.protection.update.nowcommand.machine.update.nowcommand.asset.refreshcommand.edr.isolationcommand.threat.quarantine.removecommand.threat.quarantine.restorecommand.bfp.rules.deletecommand.service.diagcommand.edr.fileuploadcommand.edr.unlock.forcecommand.edr.lockcommand.sequence.remediatecommand.edr.unlockcommand.logging.level.setcommand.threat.scan.remediatecommand.policy.refreshcommand.machine.plugin.updatepartscommand.asset.patchcommand.asset.updatesoftwarecommand.asset.uninstallsoftware machine_idsarrayrequired- IDs of the endpoints to run the command on. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
correlation_idstring- Correlation ID of the job (Parent job ID). Could be used to find related child jobs. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
dataobject- Command-specific settings. For command.threat.scan use {"scan_settings":{"type":"ThreatScan","remove":false}}; for command.edr.isolation use {"desktop":true,"network":true,"process":true}. Omit for commands that need none. Example: {"key": "value"}.
relay_statestring- Optional relay state string attached to the job. Example: example.
requires_connectedboolean- Set true when a connection must be initiated before the job is issued, such as an active response shell. Leave empty for ordinary commands. Example: true.
source_idstring- Source ID for relating the new parent job to an existing parent job without add them as children of that parent job. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_jobs_issue_bulkIssue a job to a list of endpoints and/or groups in one request.WriteJobs Issue Bulk
Issue a job to a list of endpoints and/or groups in one request. Returns jobs, errors, total_count, correlation_id fields. Use to run the same command on many endpoints or whole groups. Use job_issue for a plain list of endpoint IDs. Needs endpoint or group IDs from endpoint_search or group_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
commandstringrequired- Job command to run on the endpoints. Common values are command.threat.scan (scan), command.asset.reboot (reboot), command.edr.isolation (isolate), command.edr.unlock (remove isolation), command.policy.refresh (refresh policy) and command.protection.update.now (check for protection updates). Example: command.threat.scan.one of
command.threat.scancommand.asset.rebootcommand.service.restartcommand.protection.update.nowcommand.machine.update.nowcommand.asset.refreshcommand.edr.isolationcommand.threat.quarantine.removecommand.threat.quarantine.restorecommand.bfp.rules.deletecommand.service.diagcommand.edr.fileuploadcommand.edr.unlock.forcecommand.edr.lockcommand.sequence.remediatecommand.edr.unlockcommand.logging.level.setcommand.threat.scan.remediatecommand.policy.refreshcommand.machine.plugin.updatepartscommand.asset.patchcommand.asset.updatesoftwarecommand.asset.uninstallsoftware endpointsarrayrequired- Endpoints to target, as a JSON array of objects with an id, for example [{"id": "9256034b-7967-4253-a5d9-260663e4fa4f"}]. The API requires this field and also requires groups or queries. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
correlation_idstring- Correlation ID of the job (Parent job ID). Could be used to find related child jobs. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
dataobject- Command-specific settings. For command.threat.scan use {"scan_settings":{"type":"ThreatScan","remove":false}}; for command.edr.isolation use {"desktop":true,"network":true,"process":true}. Example: {"key": "value"}.
groupsarray- Endpoint search selectors, as a JSON array of objects that use the same filter fields as endpoint_search, choosing endpoints by query instead of by ID. The API requires groups or queries. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
queriesarray- Endpoint search selectors, as a JSON array of objects that use the same filter fields as endpoint_search. The API requires groups or queries. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
relay_statestring- Optional relay state string attached to the job. Example: example.
requires_connectedboolean- Set true when a connection must be initiated before the job is issued, such as an active response shell. Leave empty for ordinary commands. Example: true.
source_idstring- Source ID for relating the new parent job to an existing parent job without add them as children of that parent job. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_policy_cloneClone an existing policy under a new name.WritePolicy Clone
Clone an existing policy under a new name. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use to copy a policy, optionally with its exclusions. Needs the source policy ID from policy_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
namestringrequired- Name for the cloned policy. Example: Example.
source_idstringrequired- ID of the source policy to clone. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
include_policy_exclusionsboolean- Set true to copy the exclusions of the source policy to the clone. Example: true.
malwarebytes_policy_createCreate a policy from a settings object.WritePolicy Create
Create a policy from a settings object. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use to add a new policy. Use policy_clone to copy an existing one. Start from the contents returned by policy_system_default_get or policy_get.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
contentsobjectrequired- Policy settings as a JSON object. Start from the contents returned by policy_system_default_get or policy_get and change only what you need. Example: {"key": "value"}.
namestringrequired- Name for this policy. Example: Example.
quarantine_retention_durationinteger- Quarantine retention duration. Number of days to retain quarantined items. 0 means no retention. Example: example.
malwarebytes_policy_updateUpdate the name or settings of an existing policy.WritePolicy Update
Update the name or settings of an existing policy. Returns id, account_id, etag, name, expire_endpoints, contents and more fields. Use to change policy settings. Send the current etag from policy_get so concurrent edits are detected. Needs a policy ID and etag from policy_get.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
contentsobjectrequired- Full policy settings as a JSON object. Start from the contents returned by policy_get and change only what you need. Example: {"key": "value"}.
etagstringrequired- Current etag of the policy, from policy_get. Used to detect concurrent edits. Example: example.
namestringrequired- The name for this policy. Example: Example.
policy_idstringrequired- ID of the policy. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
quarantine_retention_durationinteger- Quarantine retention duration. Number of days to retain quarantined items. 0 means no retention. Example: example.
malwarebytes_quarantine_action_bulkDelete or restore quarantined items on endpoints in bulk.WriteQuarantine Action Bulk
Delete or restore quarantined items on endpoints in bulk. Returns jobs, errors, total_count, correlation_id fields. Use to act on quarantined items found with quarantine_search. Needs endpoint IDs and detection IDs from quarantine_search.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
commandstringrequired- Action to apply: command.threat.quarantine.restore restores the items, command.threat.quarantine.remove deletes them permanently. Example: command.threat.quarantine.restore.one of
command.threat.quarantine.restorecommand.threat.quarantine.remove endpointsarrayrequired- Endpoints holding the quarantined items, as a JSON array of objects with an id, for example [{"id": "9256034b-7967-4253-a5d9-260663e4fa4f"}]. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_report_generateGenerate a report now for an optional time range.WriteReport Generate
Generate a report now for an optional time range. Returns an empty body on success. Use to run an existing report on demand. Needs a report ID from report_list.
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
report_idstringrequired- ID of the report. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endstring- End of the reporting period as an ISO 8601 timestamp. Example: 2025-01-01T00:00:00Z.
startstring- Start of the reporting period as an ISO 8601 timestamp. Example: 2025-01-01T00:00:00Z.
malwarebytes_suspicious_activity_closeClose one suspicious activity record on an endpoint.WriteSuspicious Activity Close
Close one suspicious activity record on an endpoint. Returns an empty body on success. Use after triage to mark suspicious activity as resolved. Use suspicious_activity_open to reopen it. Needs endpoint and suspicious activity IDs from endpoint_suspicious_activity_list.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
suspicious_activity_idstringrequired- ID of the suspicious activity record. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_suspicious_activity_openReopen one suspicious activity record on an endpoint.WriteSuspicious Activity Open
Reopen one suspicious activity record on an endpoint. Returns an empty body on success. Use to reopen suspicious activity closed earlier with suspicious_activity_close. Needs endpoint and suspicious activity IDs from endpoint_suspicious_activity_list.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
suspicious_activity_idstringrequired- ID of the suspicious activity record. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_xdr_alert_status_setSet the status of one or more XDR alerts.WriteXDR Alert Status Set
Set the status of one or more XDR alerts. Returns an empty body on success. Use to triage XDR alerts, for example to close them. Needs alert IDs from xdr_alert_get.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
alert_idsarrayrequired- Numeric IDs of the XDR alerts to update, as a JSON array of integers. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
statusstringrequired- New status to set on the alerts. Example: open.one of
openclosedin_progressnewreopen
malwarebytes_endpoint_deleteDelete (unregister) one endpoint from the Nebula account.DestructiveEndpoint Delete
Delete (unregister) one endpoint from the Nebula account. Returns an empty body on success. Use to remove a decommissioned machine. This cannot be undone from the API. Needs an endpoint ID from endpoint_search.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
endpoint_idstringrequired- ID of the endpoint. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
unregister_isolatedboolean- Set true to also delete an endpoint that is currently isolated. Example: true.
malwarebytes_exclusion_deleteDelete one exclusion by ID.DestructiveExclusion Delete
Delete one exclusion by ID. Returns an empty body on success. Use to remove an exclusion so the item is protected again. Needs an exclusion ID from exclusion_list.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
exclusion_idstringrequired- ID of the exclusion. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_group_deleteDelete one endpoint group by ID.DestructiveGroup Delete
Delete one endpoint group by ID. Returns an empty body on success. Use to remove an empty group. Needs a group ID from group_list.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
group_idstringrequired- ID of the group. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_installation_token_revokeRevoke an endpoint installation token.DestructiveInstallation Token Revoke
Revoke an endpoint installation token. Returns account_id, id, token, created_by, created_at, used_at and more fields. Use to invalidate a token that should no longer install agents. Needs the token value from installation_token_list.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
tokenstringrequired- The installation token value. Example: example.
malwarebytes_jobs_cancel_pendingCancel pending jobs by job ID, endpoint ID or group.DestructiveJobs Cancel Pending
Cancel pending jobs by job ID, endpoint ID or group. Returns an empty body on success. Use to stop jobs that have not yet run. Needs job, endpoint or group IDs from job_search.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
groupsarray- Endpoint search selectors, as a JSON array of objects that use the same filter fields as endpoint_search. Provide at least one of job_ids, machine_ids or groups. Example: ["9256034b-7967-4253-a5d9-260663e4fa4f"].
job_idsarray- IDs of the jobs to cancel. Provide at least one of job_ids, machine_ids or groups. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
machine_idsarray- IDs of endpoints whose pending jobs should be cancelled. Provide at least one of job_ids, machine_ids or groups. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
malwarebytes_policy_deleteDelete one policy by ID.DestructivePolicy Delete
Delete one policy by ID. Returns an empty body on success. Use to remove a policy that no group uses. Needs a policy ID from policy_list.
- Idempotent
Inputs
accountidstringrequired- Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
policy_idstringrequired- ID of the policy. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.
No tools match.
