{
  "opencollection": "1.0.0",
  "info": {
    "name": "Malwarebytes Flight Recorder API",
    "version": "1.0.0"
  },
  "items": [
    {
      "info": {
        "name": "Flight-recorder",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Search occurrence of suspicious activity",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/nebula/v1/flight-recorder/chart",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              },
              {
                "name": "accountid",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search occurrence of suspicious activity. Wildcards are not supported."
        },
        {
          "info": {
            "name": "Search suspicious activity receiving impact information on an endpoint",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/nebula/v1/flight-recorder/endpoints",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              },
              {
                "name": "accountid",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search suspicious activity receiving impact information on an endpoint. Wildcards are not supported."
        },
        {
          "info": {
            "name": "Search a list of processes",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/nebula/v1/flight-recorder/processes",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              },
              {
                "name": "accountid",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Retrieve a list of processes matching the search input. Having time_range/window and any of the\n      filters (event_category, first_activity, last_activity, machine_id, md5, os_type, pc_hostname,\n      pid, pid_version, process_name, sha1, sha256, sha512, user, page, page_size) or advanced_filters is required.\n      Advanced_filters are allowed to be combined only with first_activity_gte, first_activity_lte, last_activity_gte, last_activity_lte, machine_id, os_type, user"
        },
        {
          "info": {
            "name": "Search suspicious activity",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/nebula/v1/flight-recorder/recap",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              },
              {
                "name": "accountid",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search suspicious activity. Wildcards are not supported."
        },
        {
          "info": {
            "name": "Search the flight recorder with advanced queries.",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/nebula/v1/flight-recorder/search",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              },
              {
                "name": "accountid",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search the flight recorder with advanced queries"
        },
        {
          "info": {
            "name": "Search the process graph",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/nebula/v1/flight-recorder/process_graph",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              },
              {
                "name": "accountid",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search the process graph."
        },
        {
          "info": {
            "name": "Search a list of raw events",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/nebula/v1/flight-recorder/raw_events",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              },
              {
                "name": "accountid",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Retrieve a list of raw events matching the given filters for the specified endpoint."
        },
        {
          "info": {
            "name": "Search occurrence of suspicious activity",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/flight-recorder/chart",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search occurrence of suspicious activity. Wildcards are not supported."
        },
        {
          "info": {
            "name": "Search flight recorder by process parameters",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/flight-recorder/endpoints",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search flight recorder for endpoints that had processes with the selected parameters."
        },
        {
          "info": {
            "name": "Search a list of processes",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/flight-recorder/processes",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Retrieve a list of processes matching the search input for the specified endpoint."
        },
        {
          "info": {
            "name": "Search suspicious activity",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/flight-recorder/recap",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search suspicious activity. Wildcards are not supported."
        },
        {
          "info": {
            "name": "Search the flight recorder with advanced queries",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/flight-recorder/search",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search the flight recorder with advanced queries."
        },
        {
          "info": {
            "name": "Search the process graph",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/flight-recorder/process_graph",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Search the process graph."
        },
        {
          "info": {
            "name": "Search a list of raw events",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://api.threatdown.com/oneview/v1/accounts/:account_id/flight-recorder/raw_events",
            "headers": [
              {
                "name": "authorization",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "oauth2",
              "flow": "client_credentials",
              "accessTokenUrl": "/token",
              "credentials": {
                "clientId": "{{clientId}}",
                "clientSecret": "{{clientSecret}}"
              }
            }
          },
          "docs": "Retrieve a list of raw events matching the given filters for the specified endpoint."
        }
      ]
    }
  ],
  "bundled": true
}