Malwarebytes Connector Guide

Malwarebytes Endpoint Protection is a cloud-based security platform that combines detection and remediation technologies into a single cloud-managed agent. The Balbix integration with Malwarebytes ingests IT Infrastructure assets and associated vulnerabilities discovered by Malwarebytes.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

Integration Summary

This table provides a summary of the Balbix integration for the Malwarebytes connector.

Integration Type	Fetch: An inbound API integration used to fetch infrastructure assets, OS vulnerabilities, software vulnerabilities and patch information.
Types of Assets Fetched	Host devices (includes servers, virtual machines, desktops, laptops).
Types of Data Fetched	Asset names, hardware information, interface information (MAC address, IP address), OS information, software information, patch information, system information, compliance and misconfiguration information, timestamps (e.g., patch_install_date, patch_release_date, software_install_date, cve_first_observed_at).

Prerequisites

To configure the Balbix connector, you must first create Malwarebytes API credentials with the appropriate permissions. These credentials are required for completing the configuration process. Here are the steps you need to complete:

Get an access token: Retrieve an authentication token that allows you to send authenticated requests to all the API endpoints.

Get an Access Token

Use this endpoint to obtain an authentication token for sending authenticated requests to all API endpoints. To do so, you’ll first need a valid client_id and client_secret pair.

Here’s how to generate the client id/client secret pair:

Open the Nebula console.
Navigate to Settings > APIs & Integrations.
Click the Add button.
Complete and submit the form.
Use the generated client_id and client_secret pair in your Base64 string.

After obtaining the access_token, include it in all requests to the public APIs using the Authorization header, as shown:

Authorization: Bearer <access_token>

API Request

Headers

Add the following headers to your API request.

Name	Description	Type	Required	Default
Authorization	base64 encoded credential pair as basic authorization Basic base64(<client_id>:<client_secret>) client_secret and encode in base64.	string	yes	“
Content-Type	Set to 'application/x-www-form-urlencoded'	string	yes	“

Refer to the following Javascript example to get the correct header's value:

In the browser:

Basic ${window.btoa(${clientId}:${clientSecret}`)}`

NodeJS:

Basic ${Buffer.from(${clientId}:${clientSecret}`).toString('base64')}`

Body

Send the following body with the request.

Name	Description	Type	Required	Default
scope	The scope of the token. Can be read write execute or any subset of those space-separated scopes	string	yes	“
grant_type	The grant_type. Set it to client_credentials	string	yes	“

API Response

If your request successfully processed, our server will respond with a 200 status code and send a JSON body, which will include:

Name	Description	Type	Can Be Blank
access_token	The access token. You need this token to access all other API endpoints.	string	no
expires_in	Expiry time in seconds of the access_token	number	no
scope	The scope. Can be read write execute or a subset of those. Space separate the scope you want to request	string	no
token_type	The type of the token	string	no

You can use the access_token to send requests to all the other HTTP endpoints.

Create and Configure the Connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for Malwarebytes.

Step 1: Select the Connector

Start by selecting a connector using the steps outlined below:

Go to Data Sources from the left navigation bar.
In the Connectors table, click + Add Connector.
Click Select a Connector to Configure to expand the window and view the list of available connectors.
Click the + icon on the Malwarebytes tile.
Click Next to configure the connector.

Step 2: Configure the Connector

Configure the connector using the steps outlined below.

Fill in the required configuration fields.

	Instance Name
	Malwarebytes API Base URL
	Malwarebytes API Client ID	Enter the client ID for the user account with the necessary permissions to fetch assets.
	Malwarebytes API Client Secret
	Malwarebytes API Account ID	Enter the account ID for the user account with the necessary permissions to fetch assets.