> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Malwarebytes

> Connect ThreatAware to Malwarebytes Nebula for endpoint threat detection and remediation

## Overview

The Malwarebytes integration enables ThreatAware to collect endpoint protection and threat detection data from your Malwarebytes Nebula console, providing visibility into endpoint security status and detected threats across your organisation.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: Malwarebytes Nebula Administrator account
</Info>

## Data collected

The Malwarebytes integration provides:

* Endpoint threat detection data
* Malware detection and remediation status
* Endpoint protection status
* Security compliance information

## Use cases

<CardGroup cols={2}>
  <Card title="Threat Detection" icon="triangle-exclamation">
    Monitor detected threats and malware across endpoints
  </Card>

  <Card title="Remediation Tracking" icon="shield-check">
    Track threat remediation and quarantine status
  </Card>

  <Card title="Endpoint Protection" icon="shield">
    Verify all endpoints have active protection
  </Card>

  <Card title="Security Reporting" icon="chart-line">
    Generate reports on threats and protection status
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Malwarebytes Nebula Console">
    Access your [Malwarebytes Nebula Console](https://cloud.malwarebytes.com/) with an administrator account.
  </Step>

  <Step title="Create Dedicated Admin Account">
    * It is recommended to create a new administrator account specifically for API integration
    * Navigate to **Settings** > **User Management** or **Administrators**
    * Create a new admin account for ThreatAware
    * Ensure the account has administrator role with access to the group(s) you want to monitor
    * Assign appropriate permissions to view all necessary data
    * Note the account credentials for later use

    <Tip>
      Creating a dedicated service account makes it easier to track API usage and manage access permissions.
    </Tip>
  </Step>

  <Step title="Generate API Credentials">
    * Navigate to **Settings** > **APIs & Integrations**
    * Click **Add** to generate new API credentials
    * Provide a descriptive name for the API credentials (e.g., "ThreatAware Integration")
    * Select the following access options:
      * **Read** - to retrieve endpoint and threat data
      * **Write** - if you want to enable threat remediation actions
      * **Execute** - if you want to enable threat remediation actions
    * Click **Save**
    * Copy the **Client ID** and **Client Secret** that are displayed

    <Warning>
      The Client Secret will only be displayed once. Copy and store it securely in your password manager before closing this screen.
    </Warning>
  </Step>

  <Step title="Retrieve Account ID">
    * Log in to your Malwarebytes Nebula console
    * Look at the URL in your browser (e.g., `https://console.malwarebytes.com/?account=12345`)
    * Copy the **Account ID** from the URL
    * This is typically a numeric identifier after the "account=" parameter
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware:

    * Open ThreatAware and navigate to **Settings** > **Integrations**
    * Search for and select **Malwarebytes**
    * Enter the required information:
      * **Account ID**: The ID from the Malwarebytes console URL
      * **Client ID**: The API Client ID generated in the previous step
      * **Client Secret**: The API Client Secret generated in the previous step
    * Click **Authorize** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, verify the integration is working:

    * Check that the **Integration Status** shows as **Active**
    * Wait up to 5 minutes for the initial endpoint and threat data sync
    * Verify threat and endpoint protection data appears in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Account ID" icon="building">
    **Field Name**: Malwarebytes Account ID
    **Type**: String
    **Description**: Your unique Malwarebytes Nebula account identifier

    Found in the URL of your Malwarebytes console (e.g., `https://console.malwarebytes.com/?account=12345`). Copy the numeric ID only.

    Example: `12345`
  </Accordion>

  <Accordion title="Client ID" icon="id-card">
    **Field Name**: Malwarebytes Client ID
    **Type**: String
    **Description**: API Client ID for authentication

    Generated in **Settings** > **APIs & Integrations** of the Malwarebytes console.

    Example: `client_a1b2c3d4e5f6g7h8`
  </Accordion>

  <Accordion title="Client Secret" icon="key">
    **Field Name**: Malwarebytes Client Secret
    **Type**: Password (encrypted)
    **Description**: API Client Secret for authentication to Malwarebytes

    Generated alongside the Client ID in **APIs & Integrations**. This credential is sensitive and should be stored securely.

    <Tip>
      Store this credential securely in your organisation's password manager. It will only be displayed once during generation.
    </Tip>
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Malwarebytes integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait up to 5 minutes for initial endpoint and threat data collection
   * Search for a known endpoint in ThreatAware
   * Verify Malwarebytes protection status and threat data appears

3. **Test Queries**
   * Create a test query to filter endpoints by Malwarebytes threat detection status
   * Verify the results match your Malwarebytes console

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration fails to authenticate

    **Solutions**:

    * Verify the **Account ID** is correct (from the Malwarebytes console URL)
    * Confirm the **Client ID** and **Client Secret** are correct
    * Ensure no extra spaces were copied with the credentials
    * Check if the API credentials have expired or been revoked
    * Regenerate new API credentials if necessary
    * Verify the admin account has not been disabled
  </Accordion>

  <Accordion title="Permission Issues" icon="ban">
    **Symptoms**: Integration connects but no endpoint data appears

    **Solutions**:

    * Verify the admin account has access to the appropriate groups in Malwarebytes
    * Confirm the API credentials have **Read** permission enabled
    * Check that the account has not been restricted to specific scopes
    * Review Malwarebytes account permissions for the admin account
    * Ensure endpoints are properly registered in Malwarebytes Nebula
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the Malwarebytes Nebula console is accessible and responsive
    * Check firewall rules allow outbound HTTPS (443) to Malwarebytes
    * Confirm your internet connection is stable
    * Test accessing the Malwarebytes console directly in a browser
    * Check Malwarebytes service status for any outages
  </Accordion>

  <Accordion title="No Data After 5 Minutes" icon="database">
    **Symptoms**: Integration shows active but no endpoint or threat data appears

    **Solutions**:

    * Verify you have endpoints enrolled in Malwarebytes Nebula
    * Confirm the API credentials have proper permissions
    * Wait up to 10 minutes for the initial data sync
    * Check Malwarebytes console to ensure data exists
    * Verify the admin account has access to the monitoring group
    * Review ThreatAware integration logs for specific errors
    * Review [Malwarebytes Documentation](https://support.malwarebytes.com/hc/en-us) for additional help
  </Accordion>

  <Accordion title="API Credential Issues" icon="key-exclamation">
    **Symptoms**: Client Secret not visible or credentials not working

    **Solutions**:

    * Regenerate new API credentials in Malwarebytes if the secret was lost
    * Ensure you copied the Client Secret immediately after generation
    * Verify the API credentials have not been revoked
    * Check that the API credentials have the required permissions (Read, Write, Execute)
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Malwarebytes Documentation" icon="book" href="https://support.malwarebytes.com/hc/en-us">
    Official Malwarebytes documentation and support portal
  </Card>

  <Card title="Malwarebytes Support" icon="life-ring" href="https://www.malwarebytes.com/support/">
    Malwarebytes support for technical assistance and account issues
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated admin account specifically for ThreatAware
  * Store API credentials securely in your organisation's password manager
  * Rotate API credentials regularly (annually or per security policy)
  * Monitor integration status to detect authentication failures early
  * Document the integration setup for future reference
</Tip>

<Tip>
  **Security Considerations**

  * Only grant necessary API permissions (typically Read is sufficient)
  * Limit the admin account to the minimum required groups and scopes
  * Monitor Malwarebytes audit logs for API account activity
  * Review endpoint protection status regularly
  * Keep integration status monitoring in place for continuity
</Tip>