name: Malwarebytes display: Malwarebytes fromversion: 5.0.0 sectionorder: - Connect - Collect category: Endpoint provider: Malwarebytes commonfields: id: Malwarebytes version: -1 configuration: - display: Account ID name: accountid required: true type: 0 section: Connect - display: Client ID name: clientid required: true type: 0 section: Connect - display: Client Secret name: clientsecret required: true type: 4 section: Connect - display: Region name: region required: true type: 15 section: Connect defaultvalue: US additionalinfo: "The ThreatDown Nebula region (US for cloud.threatdown.com or EU for cloud.euc1.threatdown.com)." options: - US - EU - display: Fetch incidents name: isFetch type: 8 section: Collect required: false - display: Incident type name: incidentType type: 13 section: Connect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - display: "Fetch Event List" name: Fetch_Event_List defaultvalue: "RTP Detections (EP)" type: 15 options: - Suspicious Activity (EPR) - RTP Detections (EP) section: Collect advanced: true required: false - display: "RTP Detections Threat Category" name: rtp_threat_category defaultvalue: "Malware" type: 16 options: - Malware - PUP - PUM - Exploit - Ransomware - Website section: Collect advanced: true required: false - display: "Suspicious Activity Severity" name: suspicious_activity_severity defaultvalue: "High" type: 16 options: - High - Medium - Low section: Collect advanced: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - display: E-Mail name: email additionalinfo: "E-Mail will be collected by Malwarebytes for Usage Analytics if entered. Note: Both Company Name and E-mail must be entered if the user prefers to send the data to Malwarebytes." type: 0 section: Connect advanced: true required: false - display: Company Name name: company_name additionalinfo: "Company Name will be collected by Malwarebytes for Usage Analytics if entered. Note: Both Company Name and E-mail must be entered if the user prefers to send the data to Malwarebytes." type: 0 section: Connect advanced: true required: false description: Scan and Remediate threats on endpoints in the Malwarebytes cloud. script: commands: - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Initiate Scan and Remediate action on an endpoint based on IP or Hostname. name: malwarebytes-scan-and-remediate outputs: - contextPath: Malwarebytes.Scan.Machine_ID description: Endpoint ID of the host. type: string - contextPath: Malwarebytes.Scan.Job_ID description: Job ID of the scanned host. type: string - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Initiate Scan and report action on an endpoint based on IP or Hostname. name: malwarebytes-scan-and-report outputs: - contextPath: Malwarebytes.Scan.Machine_ID description: Endpoint ID of the host. type: string - contextPath: Malwarebytes.Scan.Job_ID description: Job ID of the scanned host. type: string - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Initiate Isolation action on an endpoint based on IP or Hostname. This action isolate an endpoint by Process, Network and Desktop. name: malwarebytes-isolate-endpoint outputs: - contextPath: Malwarebytes.Scan.Machine_ID description: Endpoint ID of the host. type: string - contextPath: Malwarebytes.Scan.Job_ID description: Job ID of the scanned host. type: string - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Initiate Process Isolation action on an endpoint based on IP or Hostname. name: malwarebytes-isolate-process outputs: - contextPath: Malwarebytes.Scan.Machine_ID description: Endpoint ID of the host. type: string - contextPath: Malwarebytes.Scan.Job_ID description: Job ID of the scanned host. type: string - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Initiate Desktop Isolation action on an endpoint based on IP or Hostname. name: malwarebytes-isolate-desktop outputs: - contextPath: Malwarebytes.Scan.Machine_ID description: Endpoint ID of the host. type: string - contextPath: Malwarebytes.Scan.Job_ID description: Job ID of the scanned host. type: string - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Initiate Network Isolation action on an endpoint based on IP or Hostname. name: malwarebytes-isolate-network outputs: - contextPath: Malwarebytes.Scan.Machine_ID description: Endpoint ID of the host. type: string - contextPath: Malwarebytes.Scan.Job_ID description: Job ID of the scanned host. type: string - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Initiate Deisolation action on an endpoint based on IP or Hostname. This action deisolate an endpoint by Process, Network and Desktop. name: malwarebytes-deisolate-endpoint outputs: - contextPath: Malwarebytes.Scan.Machine_ID description: Endpoint ID of the host. type: string - contextPath: Malwarebytes.Scan.Job_ID description: Job ID of the scanned host. type: string - arguments: - name: endpoints defaultValue: all auto: PREDEFINED predefined: - all - online - offline description: Enter value 'all' to get all endpoints and value 'online' or 'offline' to get online/offline endpoints. description: List all/online/offline endpoints available in the Malwarebytes Cloud. name: malwarebytes-list-endpoints outputs: - contextPath: Malwarebytes.Endpoint.total_count description: total count of all/online/offline endpoints. type: int - arguments: - name: hostname description: Hostname of an endpoint in Malwarebytes Cloud. - name: ip description: IP of an endpoint in Malwarebytes Cloud. description: Lists more granular information about an endpoint. name: malwarebytes-list-endpoint-info outputs: - contextPath: Malwarebytes.Endpoint.Assets description: Asset information of the endpoint. type: string - contextPath: Malwarebytes.Endpoint.Hostname description: The hostname that is mapped to this endpoint. type: string - contextPath: Malwarebytes.Endpoint.IPAddress description: The IP address of the endpoint. type: string - contextPath: Malwarebytes.Endpoint.Domain description: The domain of the endpoint. type: string - contextPath: Malwarebytes.Endpoint.MACAddress description: The MAC address of the endpoint. type: string - contextPath: Malwarebytes.Endpoint.OS description: Endpoint OS. type: string - contextPath: Malwarebytes.Endpoint.OSVersion description: OS version. type: string - contextPath: Malwarebytes.Endpoint.Model description: The model of the machine or device. type: string - contextPath: Malwarebytes.Endpoint.Memory description: Memory on this endpoint. type: int - contextPath: Endpoint.Hostname description: The hostname that is mapped to this endpoint. type: string - contextPath: Endpoint.IPAddress description: The IP address of the endpoint. type: string - contextPath: Endpoint.Domain description: The domain of the endpoint. type: string - contextPath: Endpoint.MACAddress description: The MAC address of the endpoint. type: string - contextPath: Endpoint.OS description: Endpoint OS. type: string - contextPath: Endpoint.OSVersion description: OS version. type: string - contextPath: Endpoint.Model description: The model of the machine or device. type: string - contextPath: Endpoint.Memory description: Memory on this endpoint. type: int - arguments: - name: job_id description: Job ID of the initiated Scan actions only. required: true description: Lists detections from an endpoint for the scans initiated from Demisto. name: malwarebytes-get-scan-detections outputs: - contextPath: Malwarebytes.Scan.Job_ID description: Job_Id of the initiated Scan/Isolation/Deisolation actions. type: string - contextPath: Malwarebytes.Scan.Status description: Scan Status for the host. type: string - contextPath: Malwarebytes.Scan.Detections description: Scan detections for the host. type: string - arguments: - name: job_id description: Job_Id of the initiated Scan/Isolation/Deisolation actions. required: true description: Lists scan/isolation/deisolation status of the endpoint for the scan/isolation/deisolation initated from Demisto. name: malwarebytes-get-job-status outputs: - contextPath: Malwarebytes.Scan.Job_ID description: Job_Id of the initiated Scan/Isolation/Deisolation actions. type: string - contextPath: Malwarebytes.Scan.Status description: Scan Status for the host. type: string - arguments: - name: machine_id description: Machine ID of an endpoint where Suspicious Activity is found. required: true - name: detection_id description: Detection ID of the Suspicious Activity. required: true description: Open Suspicious Activity for investigation in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID. name: malwarebytes-open-sa-incident outputs: - contextPath: Malwarebytes.SA.Machine_ID description: Machine ID of the Suspicious host. type: string - arguments: - name: machine_id description: Machine ID of an endpoint in Malwarebytes Cloud where Suspicious Activity is found. required: true - name: detection_id description: Detection ID of the Suspicious Activity. required: true description: Remediate Suspicious Activity from Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID. name: malwarebytes-remediate-sa-incident outputs: - contextPath: Malwarebytes.SA.Machine_ID description: Machine ID of the Suspicious host. type: string - arguments: - name: machine_id description: Machine ID of an endpoint in Malwarebytes Cloud where Suspicious Activity is found. required: true - name: detection_id description: Detection ID of the Suspicious Activity. required: true description: Close Suspicious Activity Incident in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID. name: malwarebytes-close-sa-incident outputs: - contextPath: Malwarebytes.SA.Machine_ID description: Machine ID of the Suspicious host. type: string - arguments: - name: hostname description: Hostname of the endpoint. - name: path description: Path of the file to be searched in suspicious activities. description: Lists all suspicious activities from hostname value and list all the hostnames from path of file. name: malwarebytes-get-sa-activities outputs: - contextPath: Malwarebytes.Endpoint.Suspicious_Activities description: Suspicious Activities for the host. type: string dockerimage: demisto/auth-utils:1.0.0.10608895 isfetch: true runonce: false script: '-' subtype: python3 type: python tests: - No Tests- non-certified partner, test was moved to non circle folder.