{ "opencollection": "1.0.0", "info": { "name": "Malwarebytes Endpoints API", "version": "1.0.0" }, "items": [ { "info": { "name": "Endpoints", "type": "folder" }, "items": [ { "info": { "name": "Get endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "populate_diag_info", "value": "", "type": "query" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Retrieve a single ID by its universally unique identifier." }, { "info": { "name": "Delete a machine", "type": "http" }, "http": { "method": "DELETE", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Delete a machine from the console" }, { "info": { "name": "Search endpoints", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/nebula/v1/endpoints", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Search endpoints. Constraints with the suffix `keyword` indicates an exact match. Constraints without the `keyword` suffix will be tokenized.\n\n### Examples\nIf you want to find endpoints belonging to the `Default group` (the search is case insensitive), use `group_name.keyword` as a constraint.\n```json\n{\n \"group_name.keyword\": \"default group\"\n}\n```\nAlternatively, if you want to find endpoints which group includes `department_one OR department_two`, use `group_name` as a constraint.\n```json\n{\n " }, { "info": { "name": "Delete multiple machines", "type": "http" }, "http": { "method": "DELETE", "url": "https://api.threatdown.com/nebula/v1/endpoints", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Use this endpoint to mark machines as deleted.\nThis API endpoint allows you to specify queries instead of explicitly specifying endpoint ids.\n\n> **Be extremely cautious**: If you don't specify any constraint, all your endpoints will match the search and be deleted. For example, the following payload:\n```json\n \"queries\": [{}]\n```\nwill select all the machines in your account. Always test the result of your query using the [Search endpoints APIs](#operation/api.v2.nebula.post.endpoints)\n\nIf you " }, { "info": { "name": "Export endpoints", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/nebula/v1/endpoints/export", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Export dump as file." }, { "info": { "name": "Export endpoints asynchronously", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/nebula/v1/endpoints/export/async", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Export endpoints and receive email" }, { "info": { "name": "Get endpoint agent info", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/agent_info", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Retrieve agent information of a given endpoint." }, { "info": { "name": "Get endpoint assets", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/assets", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Retrieve asset information of a given endpoint." }, { "info": { "name": "Get endpoint drives", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/drives", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get drive encryption details for a specific endpoint." }, { "info": { "name": "Network information", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/network", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get network information about an endpoint." }, { "info": { "name": "All suspicious activity of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/sa", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sort_field", "value": "", "type": "query", "description": "Sort field" }, { "name": "sort_direction", "value": "", "type": "query", "description": "Sort direction" }, { "name": "next_cursor", "value": "", "type": "query", "description": "The pagination cursor for next set of results. For further documentation, check Pagination section." }, { "name": "since", "value": "", "type": "query", "description": "Since (Ex. \"2020-03-23T17:23:17.860482Z\")" }, { "name": "per_page", "value": "", "type": "query", "description": "Items per page" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Fetch suspicious activity of an endpoint." }, { "info": { "name": "Specific suspicious activity of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/sa/:sa_id/exclusions", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Fetch suspicious activity of an endpoint." }, { "info": { "name": "Remediate suspicious activity of an endpoint", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/sa/:sa_id/remediate", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Remediate suspicious activity of an endpoint." }, { "info": { "name": "Get a scan of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/scans/:scan_id", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "scan_id", "value": "", "type": "path", "description": "The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "populate_schedule_name", "value": "", "type": "query", "description": "Populate the schedule name" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get a scan of an endpoint by Id." }, { "info": { "name": "Get scans of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/scans", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "since", "value": "", "type": "query", "description": "The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")" }, { "name": "threats_detected", "value": "", "type": "query", "description": "Optional parameter to filter out scan results based on whether threats were found. If omitted defaults to returning all." }, { "name": "start_index", "value": "", "type": "query", "description": "The start index for pagination" }, { "name": "page_size", "value": "", "type": "query", "description": "The page size for pagination" }, { "name": "populate", "value": "", "type": "query" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get a list of scans of an endpoint." }, { "info": { "name": "Get the detections of a scan", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/scans/:scan_id/detections", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "scan_id", "value": "", "type": "path", "description": "The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "next_cursor", "value": "", "type": "query", "description": "The pagination cursor for next set of results. For further documentation, check Pagination section." }, { "name": "since", "value": "", "type": "query", "description": "The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get a list of detections of a scan of an endpoint." }, { "info": { "name": "Endpoint status", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/status", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get the status of an endpoint." }, { "info": { "name": "Get diagnostic logs of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/diag-log", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get diagnostic logs of an endpoint." }, { "info": { "name": "Get quarantined items", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/quarantine", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "next_cursor", "value": "", "type": "query", "description": "The pagination cursor for next set of results. For further documentation, check Pagination section." }, { "name": "name", "value": "", "type": "query", "description": "Search with quarantine threat name." }, { "name": "category", "value": "", "type": "query", "description": "Search with quarantine category." }, { "name": "type", "value": "", "type": "query", "description": "Search with quarantine type" }, { "name": "since", "value": "", "type": "query", "description": "Timestamp to filter since quarantine scan times." }, { "name": "until", "value": "", "type": "query", "description": "Timestamp to filter until quarantine scan times." } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get the quarantined items of an endpoint" }, { "info": { "name": "Reveal drive recovery key", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/drives/:volume_id/reveal", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Machine UUID" }, { "name": "volume_id", "value": "", "type": "path", "description": "Volume identifier (not necessarily a UUID)" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Reveal the recovery key for a specific encrypted drive on an endpoint." }, { "info": { "name": "Close suspicious activity of an endpoint", "type": "http" }, "http": { "method": "PUT", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/sa/:sa_id/close", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Close suspicious activity of an endpoint." }, { "info": { "name": "Open suspicious activity of an endpoint", "type": "http" }, "http": { "method": "PUT", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/sa/:sa_id/open", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Open suspicious activity of an endpoint." }, { "info": { "name": "Set endpoint tags", "type": "http" }, "http": { "method": "PUT", "url": "https://api.threatdown.com/nebula/v1/endpoints/:id/tags", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Add alias to a machine by its ids. To remove the alias, send an empty string" }, { "info": { "name": "Search grouped endpoints", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/nebula/v1/endpoints/search-groupby", "headers": [ { "name": "authorization", "value": "" }, { "name": "accountid", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Search grouped endpoints" }, { "info": { "name": "Get endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "populate_diag_info", "value": "", "type": "query" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Retrieve information of a single endpoint by its universally unique identifier." }, { "info": { "name": "Delete an endpoint", "type": "http" }, "http": { "method": "DELETE", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Delete an endpoint from the console using the endpoint ID." }, { "info": { "name": "Search endpoints across accounts", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/oneview/v1/endpoints", "headers": [ { "name": "authorization", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Search endpoints across all your managed accounts. The search will be scoped to the account_ids you specify in the request body. Constraints with the suffix `keyword` indicates an exact match. Constraints without the `keyword` suffix will be tokenized.\n\n### Examples\nIf you want to find endpoints belonging to the `Default group` (the search is case insensitive), use `group_name.keyword` as a constraint.\n```json\n{\n \"account_ids\": [\"\"],\n \"group_name.keyword\": \"default group\"\n}\n```\nAl" }, { "info": { "name": "Delete multiple endpoints across accounts", "type": "http" }, "http": { "method": "DELETE", "url": "https://api.threatdown.com/oneview/v1/endpoints", "headers": [ { "name": "authorization", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Use this endpoint to mark machines as deleted.\nThis API endpoint allows you to specify queries instead of explicitly specifying endpoint ids. See example for more details.\n\n> **Be extremely cautious**: If you don't specify any constraint, all your machines will match the search and be deleted. For example, the following payload:\n```json\n \"groups\": [{ \n \"account_ids\": [\"\", \"\"]\n }]\n```\nwill select all the machines in the two accounts. Always test the result" }, { "info": { "name": "Export endpoints (Bulk across accounts)", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/oneview/v1/endpoints/export", "headers": [ { "name": "authorization", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Export endpoint data across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search endpoints route. Refer to `POST -> /endpoints` for more information about the constraints accepted. |\n| endpoints | List of explicit endpoint ids. Accounts ids are required along with the endpoint ids |\n| p" }, { "info": { "name": "Export endpoints asynchronously", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/oneview/v1/endpoints/export/async", "headers": [ { "name": "authorization", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Export endpoints asynchronously" }, { "info": { "name": "Get endpoint agent info", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/agent_info", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Retrieve agent information of a given endpoint using its endpoint ID." }, { "info": { "name": "Get endpoint assets", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/assets", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Retrieve asset information of a given endpoint using its endpoint ID." }, { "info": { "name": "Network information", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/network", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get network information about an endpoint using its endpoint ID." }, { "info": { "name": "All suspicious activity of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/sa", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sort_field", "value": "", "type": "query", "description": "Sort field" }, { "name": "sort_direction", "value": "", "type": "query", "description": "Sort direction" }, { "name": "next_cursor", "value": "", "type": "query", "description": "The pagination cursor for next set of results. For further documentation, check Pagination section." }, { "name": "since", "value": "", "type": "query", "description": "Since (Ex. \"2020-03-23T17:23:17.860482Z\")" }, { "name": "per_page", "value": "", "type": "query", "description": "Items per page" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Fetch suspicious activity of an endpoint using its endpoint ID." }, { "info": { "name": "Specific suspicious activity of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/sa/:sa_id/exclusions", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Fetch suspicious activity of an endpoint using the endpoint ID and suspicious activity ID." }, { "info": { "name": "Remediate suspicious activity of an endpoint", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/sa/:sa_id/remediate", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Remediate suspicious activity of an endpoint using the endpoint ID and suspicious activity ID." }, { "info": { "name": "Get a scan of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/scans/:scan_id", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "account_id", "value": "", "type": "path", "description": "Valid Account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "id", "value": "", "type": "path", "description": "Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "scan_id", "value": "", "type": "path", "description": "Scan ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "populate_schedule_name", "value": "", "type": "query", "description": "Populate the schedule name" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get a scan of an endpoint by ID." }, { "info": { "name": "Get scans of an endpoint", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/scans", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "since", "value": "", "type": "query", "description": "The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")" }, { "name": "threats_detected", "value": "", "type": "query", "description": "Optional parameter to filter out scan results based on whether threats were found. If omitted defaults to returning all." }, { "name": "start_index", "value": "", "type": "query", "description": "The start index for pagination" }, { "name": "page_size", "value": "", "type": "query", "description": "The page size for pagination" }, { "name": "populate", "value": "", "type": "query" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get a list of scans of an endpoint by its endpoint ID." }, { "info": { "name": "Get the detections of a scan", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/scans/:scan_id/detections", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "scan_id", "value": "", "type": "path", "description": "The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "next_cursor", "value": "", "type": "query", "description": "The pagination cursor for next set of results. For further documentation, check Pagination section." }, { "name": "since", "value": "", "type": "query", "description": "The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get a list of detections of a scan of an endpoint." }, { "info": { "name": "Endpoint status", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/status", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get endpoint status by its ID" }, { "info": { "name": "Generate a diagnostic log", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/diag-log", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Generate a diagnostic log for an endpoint using its ID." }, { "info": { "name": "Get quarantined items", "type": "http" }, "http": { "method": "GET", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/quarantine", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "next_cursor", "value": "", "type": "query", "description": "The pagination cursor for next set of results. For further documentation, check Pagination section." }, { "name": "name", "value": "", "type": "query", "description": "Search with quarantine threat name." }, { "name": "category", "value": "", "type": "query", "description": "Search with quarantine category." }, { "name": "type", "value": "", "type": "query", "description": "Search with quarantine type" }, { "name": "since", "value": "", "type": "query", "description": "Timestamp to filter since quarantine scan times." }, { "name": "until", "value": "", "type": "query", "description": "Timestamp to filter until quarantine scan times." } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Get quarantined items by the endpoint's ID" }, { "info": { "name": "Close suspicious activity of an endpoint", "type": "http" }, "http": { "method": "PUT", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/sa/:sa_id/close", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Close suspicious activity of an endpoint by its endpoint ID and suspicious activity ID." }, { "info": { "name": "Open suspicious activity of an endpoint", "type": "http" }, "http": { "method": "PUT", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/sa/:sa_id/open", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "sa_id", "value": "", "type": "path", "description": "Suspicious activity ID" } ], "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Open suspicious activity of an endpoint by its endpoint ID and suspicious activity ID." }, { "info": { "name": "Set endpoint tags", "type": "http" }, "http": { "method": "PUT", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints/:id/tags", "headers": [ { "name": "authorization", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" }, { "name": "account_id", "value": "", "type": "path", "description": "Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Add an alias to an endpoint by its id. To remove the alias, send an empty string" }, { "info": { "name": "Search endpoints", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/endpoints", "headers": [ { "name": "authorization", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Search endpoints within an account. The search scopes to the account_id you specify in the URL. Constraints with the suffix `keyword` indicates an exact match. Constraints without the `keyword` suffix will be tokenized.\n\n### Examples\nIf you want to find endpoints belonging to the `Default group` (the search is case insensitive), use `group_name.keyword` as a constraint.\n```json\n{\n \"group_name.keyword\": \"default group\"\n}\n```\nAlternatively, if you want to find endpoints which group includes `de" }, { "info": { "name": "Search grouped endpoints", "type": "http" }, "http": { "method": "POST", "url": "https://api.threatdown.com/oneview/v1/endpoints/search-groupby", "headers": [ { "name": "authorization", "value": "" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "oauth2", "flow": "client_credentials", "accessTokenUrl": "/token", "credentials": { "clientId": "{{clientId}}", "clientSecret": "{{clientSecret}}" } } }, "docs": "Search grouped endpoints" } ] } ], "bundled": true }