Malwarebytes connector for AI agents

Tools your security agent reaches for on Malwarebytes, scoped to your Nebula account.

CALL ANY TOOL

74 tools for endpoint security in Malwarebytes: search endpoints and detections, review quarantine and CVEs, issue jobs, and manage groups, policies, and exclusions.

malwarebytes_account_get

Get account

Get the Nebula account details for the account ID supplied. Returns license_key, id, name, options, account_token, client_id and more fields. Use to confirm the account ID and credentials work, or to find the default policy and group IDs.

Parameters

Name

Type

Required

Description

accountid

string

Required

Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

malwarebytes_app_block_rule_search

Search app block rule

malwarebytes_cve_bulk_get

Get cve bulk

malwarebytes_cve_search

Search cve

Search vulnerabilities (CVEs) found on endpoints with filters, sorting and cursor pagination. Returns results, aggregations, total_count, next_cursor fields. Use to find affected endpoints and software. Use cve_get for details of one CVE ID.

Parameters

Name

Type

Required

Description

accountid

string

Required

Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

cisa_exploitable

boolean

Optional

Filter the search by cisa_exploitable. Search for an exact match. Example: true.

cve_id

string

Optional

Filter the search by cve_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

group_id

string

Optional

Filter the search by group_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

group_name

string

Optional

Filter the search by group_name. Search for an exact match. Example: Example.

host_name

string

Optional

Filter the search by host_name. Search for an exact match. Example: Example.

installed_version

string

Optional

Filter the search by installed_version. Search for an exact match. Example: example.

known_ransomware_campaign_use

boolean

Optional

Filter the search by known_ransomware_campaign_use. Search for an exact match. Example: true.

machine_id

string

Optional

Filter the search by machine_id. Search for an exact match. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

name_multi_search

string

Optional

Filter with alises. Example: WORKSTATION-01.

next_cursor

string

Optional

Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.

only_ignored_cves

boolean

Optional

Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false. Example: true.

page_size

integer

Optional

Number of results per page. Example: 25.

product

string

Optional

Filter the search by product. Search for an exact match. Example: Example.

severity

string

Optional

Filter the search by severity. Search for an exact match. Example: example.

sort_field

string

Optional

Sort field. Example: account_id. One of: `account_id`, `account_name`, `parent_account_id`, `group_id`, `root_group_id`, `machine_id`, `object_guid`, `host_name`, `fully_qualified_host_name`, `alias`, `sort_name`, `vendor`, `normalized_vendor`, `display_vendor`, `product`, `normalized_product`, `display_product`, `installed_version`, `normalized_installed_version`, `display_installed_version`, `os_info.os_type`, `os_info.os_version`, `os_info.os_platform`, `os_info.os_architecture`, `os_info.os_release_name`, `cve_id`, `severity`, `installation_date`, `created_at`, `published_at`, `cisa_exploitable`, `known_ransomware_campaign_use`, `severity_score`, `cvss20_score`, `cvss30_score`, `group_name`, `domain_name`, `supports_update`, `supports_uninstall`, `ignored_until`, `ignored_at`, `active_directory.user.display_name`, `active_directory.machine.display_name`, `active_directory.user.ou`, `active_directory.machine.ou`, `active_directory.user.sam_account_name`, `active_directory.machine.sam_account_name`.

sort_order

string

Optional

Sorting direction. Example: asc. One of: `asc`, `desc`.

vendor

string

Optional

Filter the search by vendor. Search for an exact match. Example: 2025-01-01T00:00:00Z.

malwarebytes_endpoint_agent_info_get

Get endpoint agent info

malwarebytes_endpoint_delete

Delete endpoint

malwarebytes_endpoint_get

Get endpoint

malwarebytes_endpoint_quarantine_list

List endpoint quarantine

malwarebytes_endpoint_scans_list

List endpoint scans

malwarebytes_endpoint_search

Search endpoint

Search endpoints (managed machines) in the Nebula account with filters, sorting and cursor pagination. Returns aggregations, endpoints, total_count, next_cursor, after fields. Use to find endpoints by name, group, policy, status or IP. Use endpoint_get for one known endpoint.

Parameters

Name

Type

Required

Description

accountid

string

Required

Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

alias

string

Optional

Aliases for the machine. Example: Example.

connected

boolean

Optional

connected. Example: true.

domain_name

string

Optional

Filter the search to the endpoints with specified domain name. Example: Example.

fully_qualified_host_name

string

Optional

Filter the search to the endpoints with specified, fully qualified host name. Example: Example.

group_id

string

Optional

Filter the search by group id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

group_name

string

Optional

Filter the search by group's name. Example: Example.

has_alerts

boolean

Optional

Indicates whether the endpoint needs attention. Example: true.

host_name

string

Optional

Filter the search to the endpoints with specified host name. Example: Example.

infection_found

boolean

Optional

Filter the search to the endpoints with one or more security threats found. Example: true.

is_deleted

boolean

Optional

is_deleted filter. Example: true.

is_isolated

boolean

Optional

Indicates whether the endpoints are isolated or not. Example: true.

is_software_update_available

boolean

Optional

Indicates whether the agent has an available update. Example: true.

last_user

string

Optional

Last user that logged into the machine. Example: example.

machine_id

string

Optional

Filter the search to the endpoints with specified id. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

machine_ip

string

Optional

machine_ip filter. Example: 10.0.0.15.

name_multi_search

string

Optional

Search either alias, host name of fully qualified host name. Example: WORKSTATION-01.

next_cursor

string

Optional

Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.

page_size

integer

Optional

Number of results per page. Example: 25.

policy_id

string

Optional

Filter the search to the endpoints with specified policy (id). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

policy_name

string

Optional

Filter the search to the endpoints with specified policy (name). Example: Example.

protection_status

string

Optional

Protection status of the endpoint(s). Example: example.

reboot_required

boolean

Optional

Filter the search to the endpoints needing a reboot. Example: true.

serial_number

string

Optional

Serial number filter. Example: example.

sort_field

string

Optional

Sort field. Example: at. One of: `at`, `nics.ips`, `nics.mac_address`, `nics.description`, `os_info.os_type`, `os_info.os_version`, `os_info.os_platform`, `os_info.os_architecture`, `os_info.os_release_name`, `host_name`, `fully_qualified_host_name`, `plugins.asset_manager.plugin_version`, `plugins.asset_manager.reboot_reason`, `plugins.endpoint_protection.plugin_version`, `plugins.endpoint_protection.sdk_version`, `plugins.endpoint_protection.component_package_version`, `plugins.endpoint_protection.update_package_version`, `plugins.endpoint_protection.reboot_reason`, `plugins.endpoint_detection_and_response.plugin_version`, `plugins.endpoint_detection_and_response.reboot_reason`, `plugins.incident_response.plugin_version`, `plugins.incident_response.reboot_reason`, `plugins.siem.plugin_version`, `plugins.browser_phishing_protection.plugin_version`, `plugins.siem.reboot_reason`, `engine_version`, `domain_name`, `policy_etag`, `account_id`, `group_id`, `root_group_id`, `group_name`, `policy_name`, `policy_id`, `deleted_at`, `created_at`, `marked_for_deletion`, `is_deleted`, `last_day_seen`, `last_scanned_at`, `last_user`, `tags.alias`, `name_multi_search`, `machine_ip`, `serial_number`, `object_guid`, `vulnerabilities_found.critical`, `vulnerabilities_found.high`, `vulnerabilities_found.medium`, `vulnerabilities_found.low`, `vulnerabilities_found.none`, `vulnerabilities_found.total`, `os_patches_available`, `last_assets_scan_at`, `connected`.

sort_order

string

Optional

Whether sorting should be ascending or descending. Example: asc. One of: `asc`, `desc`.

suspicious_activity_found

boolean

Optional

Filter the search to the endpoints that have open suspicious activities. Example: true.

malwarebytes_endpoint_status_get

Get endpoint status

malwarebytes_endpoint_tags_set

Set endpoint tags

malwarebytes_exclusion_create

Create exclusion

malwarebytes_exclusion_list

List exclusion

malwarebytes_exclusion_update

Update exclusion

malwarebytes_group_delete

Delete group

malwarebytes_group_endpoints_assign

Assign group endpoints

malwarebytes_installation_token_create

Create installation token

malwarebytes_installation_token_list

List installation token

malwarebytes_job_get

Get job

malwarebytes_job_issue

Issue job

Issue a job such as scan, reboot, isolate or update to one or more endpoints by endpoint ID. Returns jobs, total_count, correlation_id fields. Use to act on specific endpoints. Use jobs_issue_bulk to target endpoints or groups by query. Track progress with job_get. Needs endpoint IDs from endpoint_search.

Parameters

Name

Type

Required

Description

accountid

string

Required

Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

command

string

Required

Job command to run on the endpoints. Common values are command.threat.scan (scan), command.asset.reboot (reboot), command.edr.isolation (isolate), command.edr.unlock (remove isolation), command.policy.refresh (refresh policy) and command.protection.update.now (check for protection updates). Example: command.threat.scan. One of: `command.threat.scan`, `command.asset.reboot`, `command.service.restart`, `command.protection.update.now`, `command.machine.update.now`, `command.asset.refresh`, `command.edr.isolation`, `command.threat.quarantine.remove`, `command.threat.quarantine.restore`, `command.bfp.rules.delete`, `command.service.diag`, `command.edr.fileupload`, `command.edr.unlock.force`, `command.edr.lock`, `command.sequence.remediate`, `command.edr.unlock`, `command.logging.level.set`, `command.threat.scan.remediate`, `command.policy.refresh`, `command.machine.plugin.updateparts`, `command.asset.patch`, `command.asset.updatesoftware`, `command.asset.uninstallsoftware`.

machine_ids

array

Required

IDs of the endpoints to run the command on. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

correlation_id

string

Optional

Correlation ID of the job (Parent job ID). Could be used to find related child jobs. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

data

object

Optional

Command-specific settings. For command.threat.scan use {"scan_settings":{"type":"ThreatScan","remove":false}}; for command.edr.isolation use {"desktop":true,"network":true,"process":true}. Omit for commands that need none. Example: {"key": "value"}.

relay_state

string

Optional

Optional relay state string attached to the job. Example: example.

requires_connected

boolean

Optional

Set true when a connection must be initiated before the job is issued, such as an active response shell. Leave empty for ordinary commands. Example: true.

source_id

string

Optional

Source ID for relating the new parent job to an existing parent job without add them as children of that parent job. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

malwarebytes_job_search

Search job

Search jobs with filters on command, status, endpoint and issue time. Returns jobs, total_count, next_cursor fields. Use to find jobs. Use job_get for one known job and parent_job_search for batches.

Parameters

Name

Type

Required

Description

accountid

string

Required

Your Nebula account ID (a UUID). Find it in the Nebula console URL, the string after the domain. Sent as the accountid header on every call. Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

cancelled_by

string

Optional

Filter the search by the id of the user who cancelled the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: example.

command

string

Optional

Filter the search by endpoint name command name. Example: command.threat.scan. One of: `command.threat.scan`, `command.asset.reboot`, `command.service.restart`, `command.protection.update.now`, `command.machine.update.now`, `command.asset.refresh`, `command.edr.isolation`, `command.threat.quarantine.remove`, `command.threat.quarantine.restore`, `command.bfp.rules.delete`, `command.service.diag`, `command.edr.fileupload`, `command.edr.unlock.force`, `command.edr.lock`, `command.sequence.remediate`, `command.edr.unlock`, `command.logging.level.set`, `command.threat.scan.remediate`, `command.policy.refresh`, `command.machine.plugin.updateparts`, `command.asset.patch`, `command.asset.updatesoftware`, `command.asset.uninstallsoftware`.

endpoint

string

Optional

Filter the search by endpoint name.. Search for occurrences of the given value in the host_name fully_qualified_host_name and alias. Example: 2025-01-01T00:00:00Z.

expires_at_after

string

Optional

Results include jobs that expire after the specified date. Example: 2025-01-01T00:00:00Z.

expires_at_before

string

Optional

Results include jobs that expire before the specified date. Example: 2025-01-01T00:00:00Z.

string

Optional

Filter the search by a single job ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

issued_at_after

string

Optional

Results include jobs that have been issued after the specified date. Example: 2025-01-01T00:00:00Z.

issued_at_before

string

Optional

Results include jobs that have been issued before the specified date. Example: 2025-01-01T00:00:00Z.

issued_by

string

Optional

Filter the search by the id of the user who issued the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: example.

issued_by_email

string

Optional

Filter the search by the email of the user who issued the job. Contains operator. Example: example.

machine_id

string

Optional

Filter the search Machine Id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f"). Example: 9256034b-7967-4253-a5d9-260663e4fa4f.

next_cursor

string

Optional

Pagination cursor. Pass the next_cursor value from the previous response to fetch the next page; leave empty for the first page. Example: cursor value from the previous response.

page_size

integer

Optional

Number of results per page. Example: 25.

sort_field

string

Optional

Sort field. Example: command. One of: `command`, `issued_by`, `issued_at`, `expires_at`, `status`, `machine_name`, `account_name`.

sort_order

string

Optional

Sorting direction. Example: asc. One of: `asc`, `desc`.

status

number

Optional

Job status filter code: 1 created, 2 sent, 4 received, 8 started, 16 timed out, 32 completed, 64 expired, 128 failed, 256 cancelled. Add codes together to match several statuses. Example: 1.

malwarebytes_jobs_cancel_pending

Jobs cancel pending

malwarebytes_policy_clone

Clone policy

malwarebytes_policy_get

Get policy

malwarebytes_policy_list

List policy

malwarebytes_quarantine_search

Search quarantine

malwarebytes_report_generate

Generate report

malwarebytes_report_list

List report

malwarebytes_schedule_get

Get schedule

For more tools, view docs.

Build your Agent

Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.

import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Malwarebytes tools available to this agent
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["malwarebytes"], toolNames: [
    "malwarebytes_detection_search",
    "malwarebytes_endpoint_get",
    "malwarebytes_job_issue"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Find endpoints with detections today and run a threat scan on them" }] });

import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["malwarebytes"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Find endpoints with detections today and run a threat scan on them" }],
  tools,
});

// Execute the tool call with the vaulted Malwarebytes service account credentials
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");

import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["malwarebytes"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Find endpoints with detections today and run a threat scan on them" }],
  tools,
});

// Tool call runs with the vaulted Malwarebytes service account credentials
await sk.tools.executeTool(msg.content, "user_123");

import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["malwarebytes"] }, pageSize: 100,
});

const agent = new Agent({
  name: "security_agent",
  model: "gemini-2.5-pro",
  instruction: "Malwarebytes tools available to this agent",
  tools,
});

await agent.run("Find endpoints with detections today and run a threat scan on them");

Try these prompts

Copy any prompt into your agent. Each maps directly to a Malwarebytes tool. Click to copy, paste into your agent, done.

Threats

Copy the prompt

Copied

Which endpoints had detections in the last 24 hours?

Copy the prompt

Copied

List quarantined items on FIN-LAPTOP-12.

Copy the prompt

Copied

Show suspicious activity across the account this week.

Response

Copy the prompt

Copied

Run a threat scan on every endpoint in the Finance group.

Copy the prompt

Copied

Isolate FIN-LAPTOP-12 from the network.

Copy the prompt

Copied

Set XDR alert 4821 to resolved.

Posture

Copy the prompt

Copied

Which CVEs on our endpoints are CISA known exploited?

Copy the prompt

Copied

List OS patches available for our Windows endpoints.

Copy the prompt

Copied

Clone the Default policy as Finance Strict.

SEE HOW AUTH WORKS

You connect Malwarebytes once with a service account, and Scalekit authenticates every call. Credentials stay vaulted, every call is scope checked, and every action is logged.

Authorize

Your user connects

Malwarebytes

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

Malwarebytes

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

Malwarebytes

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

Malwarebytes

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same vaulted auth pattern across other monitoring connectors.

Engineering Teams

DevOps assistant agent

Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

A service account still needs an audit trail

A Malwarebytes service account acts for the whole Nebula account, so Malwarebytes alone cannot tell which of your users asked the agent to isolate an endpoint. Scalekit logs every tool call with the user and tenant that triggered it, while the service account credentials stay in the vault.

// service account only
audit → svc_account

// scalekit
audit → svc_account + user_abc ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

Malwarebytes today. Ten connectors tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent use a Malwarebytes service account?

Yes. You connect Malwarebytes once with a service account, and Scalekit authenticates every call. Malwarebytes sees every action as that service account, not as an individual user, and each call also carries your Nebula account ID as the accountid header. Scalekit records which of your users triggered each call.

Where are the Malwarebytes service account credentials stored?

In Scalekit's managed AES-256 token vault, namespaced per tenant. Revocation is a single dashboard action. Credentials never appear in prompts, logs, or LLM context.

Can I limit what the agent does in Malwarebytes?

Yes. Filter by tool name in listScopedTools to expose only what you want, for example the search and report tools without malwarebytes_job_issue, which can scan, reboot, or isolate endpoints, or malwarebytes_endpoint_delete, which unregisters an endpoint. Scalekit also enforces scope checks before every API call.

What happens when the Malwarebytes connection is revoked?

The connection is invalidated on the next tool call. Subsequent requests fail closed with a clear error. Other connections in the tenant remain unaffected. The event is logged for audit.

Which Malwarebytes product does this connector cover?

Malwarebytes Nebula. Tools search endpoints, detections, quarantine, CVEs, OS patches, DNS logs, and XDR alerts, and manage groups, policies, exclusions, schedules, and jobs. malwarebytes_account_get confirms the Nebula account ID and returns its default policy and group.