MalwareBytes ThreatDown
Configure MalwareBytes ThreatDown integration with RAD Security for advanced malware detection and removal.
This guide walks you through integrating MalwareBytes ThreatDown with RAD Security for advanced malware detection, ransomware protection, and exploit mitigation, enabling you to correlate endpoint security events with container and cloud runtime activity.
MalwareBytes ThreatDown provides comprehensive protection against malware, ransomware, exploits, and advanced threats with real-time threat intelligence.
Prerequisites
Before you begin, ensure you have:
- Access to MalwareBytes Cloud Console
- Administrator privileges in MalwareBytes
- Access to RAD Security workspace with integration permissions
Administrator Required: You must have administrator privileges in the MalwareBytes Cloud Console to create API clients and access the Integrate section.
Step 1: Access MalwareBytes Cloud Console
Log in to MalwareBytes Console
Log in to your MalwareBytes Cloud Console with administrator privileges
Navigate to Integrate Section
Click on the Integrate section in the console navigation
Step 2: Create API Client
Add New Client
In the Integrate section, click the Add Client button
Configure Client Permissions
Configure the API client with the following permission:
- ☑️ Read - Access to query endpoint data and detections
The Read permission is required for the integration to function properly. RAD Security only reads malware-detection alerts from MalwareBytes, so no Write or Execute permission is needed.
Save API Client
Click Save to generate the API client
Copy OAuth2.0 Credentials
Immediately copy and save the following values:
- Client ID
- Client Secret
Save these values now! The Client Secret may only be displayed once. If you lose it, you'll need to create a new API client.
Step 3: Get Account ID
The Account ID is required to identify your MalwareBytes tenant for API calls.
Navigate to Dashboard
From the MalwareBytes Cloud Console, navigate to your tenant Dashboard
Copy Dashboard URL
Copy the URL from your browser's address bar. The URL will be in the format:
https://cloud.malwarebytes.com/{account_identifier}/dashboard
Example:
https://cloud.malwarebytes.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/dashboard
Extract Account ID
Extract the Account ID (UUID) from the URL:
- The Account ID is the UUID between
cloud.malwarebytes.com/and/dashboard - In the example above, the Account ID is:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
The Account ID is a UUID in the format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (8-4-4-4-12 hexadecimal characters separated by hyphens)
Save Account ID
Copy and save the Account ID for use in the integration configuration
Flexible Format: The RAD Security integration accepts either the raw UUID Account ID or the full dashboard URL. Both formats work correctly.
Step 4: Configure in RAD Security
Navigate to your RAD Security workspace and configure the MalwareBytes ThreatDown integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Client ID | OAuth2.0 Client ID from Step 2 | abc123-def456-ghi789 |
| Client Secret | OAuth2.0 Client Secret from Step 2 | your-client-secret-here |
| Account ID | Account ID (UUID) from Step 3 or full URL | xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx |
| Base URL | Provide the complete dashboard URL | https://cloud.malwarebytes.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/dashboard |
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > EDR in RAD Security
- Locate your MalwareBytes ThreatDown integration
- Check the connection status shows as Connected
- Verify endpoint data is being synced
Your MalwareBytes ThreatDown integration is now configured! RAD Security can now correlate endpoint malware detections with container and cloud runtime events.
What Data is Synced
Once configured, RAD Security will sync the following data from MalwareBytes ThreatDown:
Use Cases
Malware Correlation Correlate MalwareBytes malware detections on endpoints with container activity to detect supply chain attacks.
Ransomware Protection Identify ransomware behavior across endpoints and containerized infrastructure for coordinated response.
Exploit Detection Detect exploit attempts that span endpoints and cloud workloads with unified visibility.
Threat Intelligence Leverage MalwareBytes threat intelligence with RAD Security's runtime context for enhanced detection accuracy.
Troubleshooting
Security Best Practices
Use Dedicated Clients Create dedicated API clients for each integration rather than sharing credentials across services.
Least Privilege Access Only assign the required Read permission. Avoid granting Write, Execute, or any other unnecessary permissions.
Rotate Credentials Regularly Periodically create new API clients and delete old ones to maintain security.
Secure Credential Storage Store Client ID and Secret in a secure password manager or secrets vault. Never commit to version control.
Monitor API Usage Regularly review API client activity in MalwareBytes Console to detect anomalous behavior.
Audit Client Access Periodically review all API clients and remove unused or outdated ones from the Integrate section.
API Client Management
To manage your MalwareBytes API clients:
View Existing Clients
Navigate to Integrate section in MalwareBytes Console to view all active API clients
Rotate Credentials
- Create a new API client with the same permissions
- Update RAD Security with the new Client ID and Secret
- Verify the integration works
- Delete the old API client
Revoke Compromised Credentials
If credentials are compromised, immediately delete the API client in MalwareBytes and create a new one
Additional Resources
MalwareBytes Documentation
Official MalwareBytes support and documentation
MalwareBytes Cloud Console
Access your MalwareBytes Cloud Console