--- title: ThreatDown OneView API slug: connectors/threatdown-oneview-api docTags: createdAt: 2026-06-09T16:29:38.649Z --- ## Malwarebytes Connector The ThreatDown OneView API connector facilitates automated interactions with ThreatDown's threat intelligence services, enabling efficient threat detection and management. ThreatDown OneView API serves as a comprehensive threat detection and management tool, offering a robust API for exporting, searching, and managing detection data. By integrating with Swimlane Turbine, security teams can automate the extraction of detailed detection information, manage false positive reporting, and perform advanced searches with fine-grained filters. This connector streamlines the process of threat detection analysis and response, enhancing the efficiency and effectiveness of security operations. ### Limitations OAuth2 client credentials authentication provides application-level access to Malwarebytes resources without user context. This form of authentication allows an application to make API requests on its own behalf using the client credentials flow. With OAuth2 client credentials authentication, you can perform actions such as: - Export detection data synchronously and asynchronously - Search detections with advanced filtering and grouping - Retrieve detailed detection information by ID - Submit false positive requests with evidence - Access comprehensive threat intelligence data ### Supported Version The Malwarebytes connector supports the following versions of the Malwarebytes API: OAuth 2.0 Client Credentials in Malwarebytes v1: - Fully supported for application-only authentication - Used for requests where user authentication is not required (accessing detection data and threat intelligence) ## Configuration ### Prerequisites To effectively utilize the ThreatDown OneView API connector with Swimlane Turbine, ensure you have the following prerequisites: - OAuth2 client credentials authentication with the following parameters: - URL: Endpoint for ThreatDown OneView API access - Client ID: Unique identifier for OAuth2 authentication - Client Secret: Confidential key for OAuth2 authentication - Token URL: Endpoint to obtain OAuth2 tokens - Account ID: Identifier for the user's account in ThreatDown OneView ## Authentication Methods ### OAuth 2.0 Client Credentials Authentication **Setup Instructions:** You will need to sign up for a Malwarebytes Nebula account and generate client credentials. Once you have those, you'll also need to obtain your account ID. Follow the steps below: 1. Log into your Malwarebytes Nebula account 2. Navigate to the **Integrate** section 3. Generate your client credentials (`client_id` and `client_secret`) 4. Note your Account ID (UUID format) from your account settings You can find the Account ID in your Malwarebytes Nebula account settings or API configuration page. **Document References:** [Malwarebytes OAuth2 Token Documentation](https://api.malwarebytes.com/nebula/v1/docs#operation/api.oauth2.token) **Troubleshoot Tips** Note that client credentials are application-specific and should be kept secure. The access token obtained through the client credentials flow is valid for a limited time and will be automatically refreshed by the connector. ## Capabilities - Export Detections - Export Detections Asynchronously - Get Detection by ID - Search Detections - Search Detections GroupBy - Submit False Positive Request ### Export Detections The export detections endpoint returns detection data in various formats (CSV, XLSX, HTML, ODS, TXT, RTF, JSON) with configurable field selection and filtering options. This endpoint allows for comprehensive data export with flexible query groups and field mapping. More details can be found [here.](https://api.malwarebytes.com/nebula/v1/docs#operation/api.v2.nebula.post.export.detections) ### Export Detections Asynchronously The asynchronous export endpoint provides the same functionality as the synchronous export but processes large datasets in the background, returning an export job ID for tracking progress and download completion. More details can be found [here.](https://api.malwarebytes.com/nebula/v1/docs#operation/api.v2.nebula.post.export.detections.async) ### Get Detection by ID The get detection by ID endpoint returns detailed information about a specific detection, including remediation status, related detections, and comprehensive metadata. More details can be found [here.](https://api.malwarebytes.com/nebula/v1/docs#operation/api.v2.nebula.get.detections.id) ### Search Detections The search detections endpoint provides comprehensive search capabilities across detection events with advanced filtering, sorting, and pagination options. Supports extensive filtering by endpoint information, plugin data, threat characteristics, and temporal ranges. More details can be found [here.](https://api.malwarebytes.com/nebula/v1/docs#operation/api.v2.nebula.search.detections) ### Search Detections GroupBy The search detections groupby endpoint enables analytics and grouping of detection data across various dimensions, providing aggregated insights and summary statistics for threat analysis and reporting. More details can be found [here.](https://api.malwarebytes.com/nebula/v1/docs#operation/api.v2.nebula.search.detections.group) ### Submit False Positive Request The submit false positive request endpoint allows security teams to report legitimate files or applications that have been incorrectly flagged as threats, facilitating continuous improvement of detection accuracy. More details can be found [here.](https://api.malwarebytes.com/nebula/v1/docs#operation/api.v2.nebula.detections.submit.fp) # Configurations ## ThreatDown OneView API Authentication Authentication configuration for ThreatDown OneView API using OAuth2 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ------------------------------------ | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | accountid | Your Nebula account ID (UUID format) | string | Required | | scope | Permission scopes for this action. | array | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Export Detections Exports a list of detections from ThreatDown OneView API in the specified format, with options to select fields and filter by groups. ### Endpoint - **URL:** `oneview/v1/detections/export` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `format` | string | Optional | The output file format | | `download` | boolean | Optional | Whether to instruct the client to download the response as a file | | `type` | string | Optional | The encoding of the output | | `select` | array | Optional | Which fields to select from the response | | `select.newField` | string | Optional | The new value | | `select.field` | string | Required | The response field to map to a new value | | `groups` | array | Optional | List of queries for filtering detections | | `groups.name` | string | Optional | Name of the query group | | `groups.account_ids` | array | Required | List of account IDs to filter detections by | ### Input Example `{"format":"string","download":true,"type":"string","select":[{"newField":"string","field":"string"}],"groups":[{"name":"Example Name","account_ids":["string"]}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":{}}` ## Export Detections Asynchronously Initiates an asynchronous export of detection data from ThreatDown OneView API in the specified format, with options to select fields and filter by groups. ### Endpoint - **URL:** `nebula/v1/detections/export/async` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `format` | string | Optional | The output file format | | `download` | boolean | Optional | Whether to instruct the client to download the response as a file | | `type` | string | Optional | The encoding of the output | | `select` | array | Optional | Which fields to select from the response | | `select.newField` | string | Optional | The new value | | `select.field` | string | Required | The response field to map to a new value | | `groups` | array | Optional | List of queries for filtering detections | | `groups.name` | string | Optional | Name of the query group | | `groups.account_ids` | array | Required | List of account IDs to filter detections by | ### Input Example `{"format":"string","download":true,"type":"string","select":[{"newField":"string","field":"string"}],"groups":[{"name":"Example Name","account_ids":["string"]}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":{}}` ## Get Detection by ID Retrieve detailed information for a specific detection using its unique ID from ThreatDown OneView API. ### Endpoint - **URL:** `nebula/v1/detections/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the detection to retrieve | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":{}}` ## Search Detections Retrieve filtered detection results from ThreatDown OneView API using specified criteria in the request body. ### Endpoint - **URL:** `nebula/v1/detections` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------- | | `protection_status` | string | Optional | Protection status of the endpoint(s) | | `scan_type` | string | Optional | Type of the scan | | `schedule_id` | string | Optional | ID of the schedule | | `schedule_etag` | string | Optional | ETAG of the schedule | | `job_id` | string | Optional | ID of the job originating this detection | | `domain_name` | string | Optional | Filter the search to the endpoints with specified domain name | | `engine_version` | string | Optional | Filter the search to the endpoints with specified engine version | | `last_user` | string | Optional | Last user that logged into the machine | | `last_user.keyword` | string | Optional | Last user that logged into the machine (exact match) | | `plugins.siem.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin | | `plugins.siem.plugin_version` | string | Optional | Filter the search to the endpoints with specified SIEM plugin version | | `plugins.browser_phishing_protection.plugin_version` | string | Optional | Filter the search to the endpoints with specified Browser Phishing Protection plugin version | | `plugins.incident_response.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by IR plugin | | `plugins.incident_response.plugin_version` | string | Optional | Filter the search to the endpoints with specified IR plugin version | | `plugins.endpoint_detection_response.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin | | `plugins.endpoint_detection_response.plugin_version` | string | Optional | Filter the search to the endpoints with specified EDR plugin version | | `plugins.endpoint_protection.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by EP plugin | | `plugins.endpoint_protection.update_package_version` | string | Optional | Filter the search to the endpoints with specified EP update package version | | `plugins.endpoint_protection.component_package_version` | string | Optional | Filter the search to the endpoints with specified EP component package version | | `plugins.endpoint_protection.sdk_version` | string | Optional | Filter the search to the endpoints with specified EP SDK version | | `plugins.endpoint_protection.plugin_version` | string | Optional | Filter the search to the endpoints with specified EP plugin version | | `plugins.asset_manager.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin | | `plugins.asset_manager.plugin_version` | string | Optional | Filter the search to the endpoints with specified asset manager plugin version | | `fully_qualified_host_name` | string | Optional | Filter the search to the endpoints with specified, fully qualified host name | | `host_name` | string | Optional | Filter the search to the endpoints with specified host name | ### Input Example `{"protection_status":"active","scan_type":"string","schedule_id":"string","schedule_etag":"string","job_id":"string","domain_name":"Example Name","engine_version":"string","last_user":"string","last_user.keyword":"string","plugins.siem.reboot_reason":"string","plugins.siem.plugin_version":"string","plugins.browser_phishing_protection.plugin_version":"string","plugins.incident_response.reboot_reason":"string","plugins.incident_response.plugin_version":"string","plugins.endpoint_detection_response.reboot_reason":"string","plugins.endpoint_detection_response.plugin_version":"string","plugins.endpoint_protection.reboot_reason":"string","plugins.endpoint_protection.update_package_version":"string","plugins.endpoint_protection.component_package_version":"string","plugins.endpoint_protection.sdk_version":"string","plugins.endpoint_protection.plugin_version":"string","plugins.asset_manager.reboot_reason":"string","plugins.asset_manager.plugin_version":"string","fully_qualified_host_name":"Example Name","host_name":"Example Name","os_info.os_release_name":"Example Name","os_info.os_architecture":"string","os_info.os_platform":"string","os_info.os_version":"string","os_info.os_type":"string","nics.description":"string","nics.mac_address":"string","nics.ips":"string","host_name.keyword":"Example Name","fully_qualified_host_name.keyword":"Example Name","engine_version.keyword":"string","domain_name.keyword":"Example Name","at_after":"string","at_before":"string","machine_name.keyword":"Example Name","machine_name":"Example Name","process_name.keyword":"Example Name","process_name":"Example Name","affected_application.keyword":"string","affected_application":"string","category":"string","not.category":"string","md5":"string","sha256":"string","path.keyword":"string"}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ----------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `detections` | array | Output field: detections | | `detections.id` | string | Unique identifier | | `detections.type` | array | Type of the resource | | `detections.status` | string | Status value | | `detections.path` | string | Output field: detections.path | | `detections.group_id` | string | Unique identifier | | `detections.group` | object | Output field: detections.group | | `detections.is_root_detection` | boolean | Output field: detections.is\_root\_detection | | `detections.machine_id` | string | Unique identifier | | `detections.account_id` | string | Unique identifier | | `detections.detection_id` | string | Unique identifier | | `detections.scanned_at` | string | Output field: detections.scanned\_at | | `detections.scanned_at_offset_seconds` | number | Output field: detections.scanned\_at\_offset\_seconds | | `detections.reported_at` | string | Output field: detections.reported\_at | | `detections.resource_created_at` | string | Output field: detections.resource\_created\_at | | `detections.resource_modified_at` | string | Output field: detections.resource\_modified\_at | | `detections.threat_name` | string | Name of the resource | | `detections.category` | string | Output field: detections.category | | `detections.action_taken` | string | Output field: detections.action\_taken | | `detections.is_rtp_stream_event` | boolean | Output field: detections.is\_rtp\_stream\_event | | `detections.process_name` | string | Name of the resource | | `detections.cleaned_at` | string | Output field: detections.cleaned\_at | | `detections.machine_name` | string | Name of the resource | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"detections":[{}],"aggregations":{},"total_count":0,"next_cursor":"eyJzdGFydF9pbmRleCI6MTAwfQ=="}}` ## Search Detections GroupBy Performs a search for grouped detections in ThreatDown OneView API, with options to specify grouping and page size. ### Endpoint - **URL:** `nebula/v1/detections/search-groupby` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------- | | `group_by` | string | Optional | The group by field Schema | | `page_size` | number | Optional | The size of the page | | `next_cursor` | string | Optional | Pagination cursor for next set of results | | `protection_status` | string | Optional | Protection status of the endpoint(s) | | `scan_type` | string | Optional | Type of the scan | | `schedule_id` | string | Optional | ID of the schedule | | `schedule_etag` | string | Optional | ETAG of the schedule | | `job_id` | string | Optional | ID of the job originating this detection | | `domain_name` | string | Optional | Filter the search to the endpoints with specified domain name | | `engine_version` | string | Optional | Filter the search to the endpoints with specified engine version | | `last_user` | string | Optional | Last user that logged into the machine | | `last_user.keyword` | string | Optional | Last user that logged into the machine (exact match) | | `plugins.siem.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin | | `plugins.siem.plugin_version` | string | Optional | Filter the search to the endpoints with specified SIEM plugin version | | `plugins.browser_phishing_protection.plugin_version` | string | Optional | Filter the search to the endpoints with specified Browser Phishing Protection plugin version | | `plugins.incident_response.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by IR plugin | | `plugins.incident_response.plugin_version` | string | Optional | Filter the search to the endpoints with specified IR plugin version | | `plugins.endpoint_detection_response.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin | | `plugins.endpoint_detection_response.plugin_version` | string | Optional | Filter the search to the endpoints with specified EDR plugin version | | `plugins.endpoint_protection.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by EP plugin | | `plugins.endpoint_protection.update_package_version` | string | Optional | Filter the search to the endpoints with specified EP update package version | | `plugins.endpoint_protection.component_package_version` | string | Optional | Filter the search to the endpoints with specified EP component package version | | `plugins.endpoint_protection.sdk_version` | string | Optional | Filter the search to the endpoints with specified EP SDK version | | `plugins.endpoint_protection.plugin_version` | string | Optional | Filter the search to the endpoints with specified EP plugin version | | `plugins.asset_manager.reboot_reason` | string | Optional | Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin | ### Input Example `{"group_by":"string","page_size":123,"next_cursor":"string","protection_status":"active","scan_type":"string","schedule_id":"string","schedule_etag":"string","job_id":"string","domain_name":"Example Name","engine_version":"string","last_user":"string","last_user.keyword":"string","plugins.siem.reboot_reason":"string","plugins.siem.plugin_version":"string","plugins.browser_phishing_protection.plugin_version":"string","plugins.incident_response.reboot_reason":"string","plugins.incident_response.plugin_version":"string","plugins.endpoint_detection_response.reboot_reason":"string","plugins.endpoint_detection_response.plugin_version":"string","plugins.endpoint_protection.reboot_reason":"string","plugins.endpoint_protection.update_package_version":"string","plugins.endpoint_protection.component_package_version":"string","plugins.endpoint_protection.sdk_version":"string","plugins.endpoint_protection.plugin_version":"string","plugins.asset_manager.reboot_reason":"string","plugins.asset_manager.plugin_version":"string","fully_qualified_host_name":"Example Name","host_name":"Example Name","os_info.os_release_name":"Example Name","os_info.os_architecture":"string","os_info.os_platform":"string","os_info.os_version":"string","os_info.os_type":"string","nics.description":"string","nics.mac_address":"string","nics.ips":"string","host_name.keyword":"Example Name","fully_qualified_host_name.keyword":"Example Name","engine_version.keyword":"string","domain_name.keyword":"Example Name","at_after":"string","at_before":"string","machine_name.keyword":"Example Name","machine_name":"Example Name","process_name.keyword":"Example Name","process_name":"Example Name","affected_application.keyword":"string","affected_application":"string","category":"string","not.category":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.file_name` | string | Name of the resource | | `results.file` | string | Result of the operation | | `next_cursor` | string | Output field: next\_cursor | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":[],"next_cursor":"string"}}` ## Submit False Positive Request Submits a false positive request to ThreatDown OneView API using detection IDs provided in the JSON body. ### Endpoint - **URL:** `nebula/v1/detections/submit-fp` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------ | | `ids` | array | Optional | Array of detection IDs to mark as false positive | | `additional_info` | string | Optional | Additional information about the false positive | | `start_date` | string | Optional | The start date of the detection | | `end_date` | string | Optional | The end date of the detection | ### Input Example `{"ids":["string"],"additional_info":"string","start_date":"string","end_date":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |