ThreatDown OneView API

Malwarebytes Connector

The ThreatDown OneView API connector facilitates automated interactions with ThreatDown's threat intelligence services, enabling efficient threat detection and management.

ThreatDown OneView API serves as a comprehensive threat detection and management tool, offering a robust API for exporting, searching, and managing detection data. By integrating with Swimlane Turbine, security teams can automate the extraction of detailed detection information, manage false positive reporting, and perform advanced searches with fine-grained filters. This connector streamlines the process of threat detection analysis and response, enhancing the efficiency and effectiveness of security operations.

Limitations

OAuth2 client credentials authentication provides application-level access to Malwarebytes resources without user context. This form of authentication allows an application to make API requests on its own behalf using the client credentials flow.

With OAuth2 client credentials authentication, you can perform actions such as:

Export detection data synchronously and asynchronously

Search detections with advanced filtering and grouping

Retrieve detailed detection information by ID

Submit false positive requests with evidence

Access comprehensive threat intelligence data

Supported Version

The Malwarebytes connector supports the following versions of the Malwarebytes API:

OAuth 2.0 Client Credentials in Malwarebytes v1:

Fully supported for application-only authentication

Used for requests where user authentication is not required (accessing detection data and threat intelligence)

Configuration

Prerequisites

To effectively utilize the ThreatDown OneView API connector with Swimlane Turbine, ensure you have the following prerequisites:

OAuth2 client credentials authentication with the following parameters:

URL: Endpoint for ThreatDown OneView API access

Client ID: Unique identifier for OAuth2 authentication

Client Secret: Confidential key for OAuth2 authentication

Token URL: Endpoint to obtain OAuth2 tokens

Account ID: Identifier for the user's account in ThreatDown OneView

Authentication Methods

OAuth 2.0 Client Credentials Authentication

Setup Instructions:

You will need to sign up for a Malwarebytes Nebula account and generate client credentials. Once you have those, you'll also need to obtain your account ID. Follow the steps below:

Log into your Malwarebytes Nebula account

Navigate to the Integrate section

Generate your client credentials (client_id and client_secret)

Note your Account ID (UUID format) from your account settings

You can find the Account ID in your Malwarebytes Nebula account settings or API configuration page.

Document References:

Malwarebytes OAuth2 Token Documentation

Troubleshoot Tips

Note that client credentials are application-specific and should be kept secure. The access token obtained through the client credentials flow is valid for a limited time and will be automatically refreshed by the connector.

Capabilities

Export Detections

Export Detections Asynchronously

Get Detection by ID

Search Detections

Search Detections GroupBy

Submit False Positive Request

Export Detections

The export detections endpoint returns detection data in various formats (CSV, XLSX, HTML, ODS, TXT, RTF, JSON) with configurable field selection and filtering options. This endpoint allows for comprehensive data export with flexible query groups and field mapping.