---
title: "Malwarebytes Nebula"
slug: "malwarebytes-nebula"
tags: ["Self Service Ingestion"]
updated: 2026-02-28T21:51:26Z
published: 2026-02-28T21:51:26Z
canonical: "docs.hunters.ai/malwarebytes-nebula"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Malwarebytes Nebula

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Malwarebytes Nebula Events |  |  | ✅ |  | malwarebytes_nebula_events | NDJSON | API |
| Malwarebytes Nebula Detections | ✅ |  | ✅ |  | malwarebytes_nebula_detections | NDJSON | API |

---

## Overview

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/4a78f6f-image.png)[Malwarebytes](https://www.malwarebytes.com/) is an anti-malware software for Microsoft Windows, macOS, ChromeOS, Android, and iOS that finds and removes malware.

Integrating Malwarebytes Nebula into Hunters allows the collection and ingestion of key data types into the data lake. Furthermore, alerts will be created over the logs, auto-investigated and correlated to other related signals.

## Supported data types

### Malwarebytes Nebula Events

**Table name:** `malwarebytes_nebula_events`

Recorded activities and incidents detected by the platform across the network's endpoints. These events can range from detections of malware and potentially unwanted programs (PUPs) to indications of attempted exploits and ransomware activity.

### Malwarebytes Nebula Detections

**Table name:** `malwarebytes_nebula_detections`

Specific instances when the platform identifies and flags malicious software, suspicious activities, or potentially unwanted programs (PUPs) across an organization's endpoints. Built on the robust Malwarebytes cybersecurity framework, Nebula is designed to offer comprehensive endpoint protection and remediation services, leveraging advanced technologies like anomaly detection, behavior matching, and application hardening to protect against a wide spectrum of cyber threats.

## Send data to Hunters

Hunters supports the collection of logs from Malwarebytes Nebula using API.

**To connect Malwarebytes Nebula logs:**

1. Follow [these guidelines](https://service.malwarebytes.com/hc/en-us/articles/10594516370835-Create-OAuth2-credentials-for-Nebula) to acquire an API token from Malwarebytes Nebula.

> [!NOTE]
> 📘Note
> 
> Use the `read` scope for the API permissions.
2. Acquire the following information from Malwarebytes Nebula:
  - `Client ID` - for example `mwb-cloud-12344321abcddcba12344321abcddcba`
  - `Account ID` - for example `abcdef12-5467-ffff-aaaa-abcdef12adda`
  - `Client Secret` - for example `abcdeedcbaff6abcdeedcbaff6abcdeedcbaff6abcdeedcbaff6abcdeedcbaff6`
3. Complete the process on the Hunters platform, following [this guide](https://hunters.document360.io/docs/connect-a-data-source).

## Expected format

Logs are expected in JSON format.

### Malwarebytes Nebula Events Sample

```json
{"id": "123", "machine_name": "123456.local", "machine_id": "123", "user_id": "00000000-0000-0000-0000-000000000000", "source": 5, "source_name": "scan.threat", "type": 62, "type_name": "scheduled.threat.scan.success", "friendly_type": "scheduled.threat.scan.success", "severity": 4, "severity_name": "information", "details": {"scan_id": "123", "schedule_id": "123", "schedule_name": "Daily Threat Scan - Clients", "schedule_command_data": "{\"scan_settings\": {\"type\": \"ThreatScan\", \"remove\": true}, \"schedule_for_mac\": true, \"mac_scan_settings\": {\"remove\": true, \"pup_detection\": \"Detect\"}, \"schedule_for_linux\": false, \"linux_scan_settings\": {}, \"schedule_for_chrome\": true, \"schedule_for_android\": true, \"schedule_for_windows\": true}"}, "timestamp": "2023-01-01T19:22:26.45453Z"}
```

### Malwarebytes Nebula Detections Sample

```json
{"path": "C:\\USERS\\USER\\APPDATA\\LOCAL\\GOOGLE\\CHROME\\USER DATA\\Profile 1\\Preferences", "type": [ "file" ], "status": "quarantined", "trace_id": "123", "group_id": "123", "id": "123", "is_root_detection": true, "threat_name": "Trojan.ChromeHijacker.D", "scan_id": "123", "machine_id": "123", "account_id": "123", "detection_id": "123", "scanned_at": "2023-06-28T10:38:27Z", "scanned_at_offset_seconds": 3600, "reported_at": "2023-06-28T10:45:07.865552397Z", "category": "MALWARE", "is_rtp_stream_event": false, "md5": "123456", "sha256": "1234567", "cleaned_at": "2023-06-28T10:38:27Z", "machine_name": "123456.123.LOCAL", "machine_ip": "1.10.11.12", "child_trace_count": 0, "account": { "parent": "123", "name": "User.com Transport Limited", "deleted": false }, "last_user": "123\\USER"}
```