--- title: "ThreatDown Nebula MCP server for AI agents - actionlake" description: "Give Claude 439 ThreatDown Nebula actions through one MCP server: grid, email protection. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/threatdown-nebula updated: 2026-10-23 --- Connectors · MSP & PSA # ThreatDown Nebula MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to ThreatDown Nebula and the rest of your systems. It gives your agent 439 ThreatDown Nebula actions (249 reads, 144 writes and 46 that wait for a confirmation) and holds the ThreatDown Nebula credential itself, so the agent never does. It paces ThreatDown Nebula's limits and records every call. [Connect ThreatDown Nebula free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "threatdown_nebula.users.list", intent: "check which ThreatDown Nebula account is connected" } # Get nebula users · read · 1 upstream call ``` - 439 actions in one signed file - 249 read look, never change - 144 write create and update - 46 wait for a yes destructive, confirmed first Set up ## Connect ThreatDown Nebula in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect ThreatDown Nebula. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` ThreatDown client ID: in the Nebula console go to Settings > API Integrations (Integrate) and add an OAuth2… - `client_secret` ThreatDown client secret (shown once when the application is created) - `account_id` Your ThreatDown Nebula account id - `scopes` Your ThreatDown Nebula scopes ``` account { op: "connections.requirements", service: "threatdown_nebula" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "threatdown_nebula.users.list" } # get nebula users · read · 1 upstream call check { action: "threatdown_nebula.users.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` ThreatDown Nebula at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `account_id` `scopes` **Limits we pace to** 360 calls a minute, per connection **API covered** ThreatDown (Malwarebytes) Nebula (endpoint security: endpoints, detections, jobs, policies, EDR, ITDR, email protection) API ThreatDown APIs 1.0.0 (OpenAPI 3.0, 441 operations)`api.threatdown.com` **Built from** ThreatDown Nebula's documentation, read 23 October 2026[cloud.malwarebytes.com](https://cloud.malwarebytes.com/api/v2/nebula/docs) [api.malwarebytes.com](https://api.malwarebytes.com/nebula/v1/docs) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 203 of 249 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 3, so ask can line ThreatDown Nebula up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in ThreatDown Nebula. 439 actions in 45 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **249** read look, never change - **144** write create and update - **46** destructive wait for a confirmation 1. ### Grid 55 41 read · 14 write · 0 destructive Export action logs · Export action logs asynchronously · Search action logs · Search grouped action logs 2. ### Email protection 48 29 read · 13 write · 6 destructive Get daily usage · Get monthly usage · Register account · Enable auto-sync 3. ### Itdr 40 17 read · 18 write · 5 destructive Post ITDR Service Respond Action · Post ITDR Config · Get all ITDR Configs · Get all ITDR Config Status 4. ### Endpoints 24 16 read · 6 write · 2 destructive Search endpoints · Get endpoint · Delete a machine · Export endpoints 5. ### Firewall management 22 7 read · 9 write · 6 destructive Create a new firewall policy · Get firewall policies · Get firewall policy history · Create a new firewall rule 6. ### Jobs 17 10 read · 4 write · 3 destructive Export jobs · Issue a job · Issue jobs · Search jobs 7. ### Content filtering 16 9 read · 6 write · 1 destructive Create content filtering rule · Get a list of content filtering rules · Get list of categories · Get DNS Global Exclusions 8. ### Policies 15 6 read · 7 write · 2 destructive Get all policies · Clone policy · Create policy · Set policy auto-isolation **37 more areas · 202 actions** - App block **13** - Copilot **13** - Case management **12** - Device control **12** - Notifications **10** - Security advisor **9** - Exclusions **8** - Reports **8** - AI detection response **7** - Flight recorder **7** - Vulnerability management **7** - Detections **6** - Groups **6** - Ignore rules **6** - Schedules **6** - Users **5** - Webhooks **5** - Assets **4** - DNS logs **4** - Drive encryption **4** - Installation tokens **4** - MXDR **4** - OS patches **4** - Preferences **4** - Quarantine **4** - Remediation **4** - Remote intrusion detection **4** - XDR **4** - Products **3** - Suspicious activity **3** - Usage **3** - Account **2** - MDR **2** - Sandbox **2** - Events **1** - Installers **1** - Licensing **1** Top actions ## The ThreatDown Nebula API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 8 of ThreatDown Nebula's 8 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `threatdown_nebula.users.list` Get nebula users | Get nebula users. | read | `identity.user.list` 474 connectors | | `threatdown_nebula.users.create` Create user | Create user. | write | `identity.user.create` 262 connectors | | `threatdown_nebula.users.update` Update user | Update user. | write | `identity.user.update` 280 connectors | | `threatdown_nebula.users.delete` Delete a nebula user | Delete a nebula user. | destructive | `identity.user.delete` 253 connectors | | `threatdown_nebula.endpoints.search` Search endpoints | Search endpoints. | read | `device.endpoint.search` 8 connectors | | `threatdown_nebula.endpoints.get` Get endpoint | Get endpoint. | read | `device.endpoint.get` 57 connectors | | `threatdown_nebula.policies.list` Get all policies | Get all policies. | read | this connector | | `threatdown_nebula.sa.list` Suspicious activity of the account | Suspicious activity of the account. | read | this connector | | `threatdown_nebula.cve.bulk` Get CVE details by ids | Get CVE details by ids. | read | this connector | | `threatdown_nebula.cve.export` Export CVE data | Export CVE data. | read | this connector | | `threatdown_nebula.dns.export` Export DNS Log data | Export DNS Log data. | read | this connector | | `threatdown_nebula.jobs.issue` Issue a job | Issue a job. | write | this connector | Try it ## Prompts to paste into Claude. Each one names the ThreatDown Nebula actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which ThreatDown Nebula devices have not checked in for a week? calls `threatdown_nebula.endpoints.search` 2. Write write Create user in ThreatDown Nebula. Show me exactly what you will send before you save it. calls `threatdown_nebula.users.create` Governance for ThreatDown Nebula ## Destructive actions wait for a yes. 46 ThreatDown Nebula actions are destructive. The first 10: - Delete a nebula user `threatdown_nebula.users.delete` - Delete a machine `threatdown_nebula.endpoints.delete` - Delete group by id `threatdown_nebula.groups.delete` - Delete report by id `threatdown_nebula.reports.delete` - Delete policy `threatdown_nebula.policies.delete` - Delete ITDR Predefined Identity Tag `threatdown_nebula.itdr_tags.delete` - Cancel pending jobs `threatdown_nebula.jobs_bulk.delete` - Delete a schedule `threatdown_nebula.schedules.delete` - Delete AIDR rule `threatdown_nebula.aidr_rules.delete` - Delete exclusion by id `threatdown_nebula.exclusions.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do threatdown_nebula.users.delete confirm_policy: **human** Delete a nebula user? **intent:** the user asked me to delete a nebula user run suspended · waiting for a named person · key _threatdown-nebula-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "threatdown-nebula-agent", allowed_actions: ["threatdown_nebula.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "threatdown_nebula.users.delete", approver: "lead@example.com" }, { match: "threatdown_nebula.endpoints.delete", approver: "lead@example.com" }, { match: "threatdown_nebula.groups.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to ThreatDown Nebula only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What ThreatDown Nebula costs on actionlake. Every ThreatDown Nebula action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call ThreatDown Nebula refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 439 ThreatDown Nebula actions - 439 actions page each page of a long list is one call - 203 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every ThreatDown Nebula action. 439 actions by area: the id your agent calls, what it does, and its effect. **Grid 55** - `threatdown_nebula.grid_action_logs.export` Export action logs read - `threatdown_nebula.grid_action_logs.export_async` Export action logs asynchronously write - `threatdown_nebula.grid_action_logs.search` Search action logs read - `threatdown_nebula.grid_action_logs.search_groupby` Search grouped action logs read - `threatdown_nebula.grid_ai_domains.export` Export AI domain activity read - `threatdown_nebula.grid_ai_domains.export_async` Export AI domain activity (async) write - and 49 more in this area **Email protection 48** - `threatdown_nebula.email_protection_account.daily_usage` Get daily usage read - `threatdown_nebula.email_protection_account.monthly_usage` Get monthly usage read - `threatdown_nebula.email_protection_account.register` Register account write - `threatdown_nebula.email_protection_account_auto_sync.create` Enable auto-sync write - `threatdown_nebula.email_protection_account.disable` Delete account destructive - `threatdown_nebula.email_protection_account_911_mailbox.delete` Delete 911 mailbox destructive - and 42 more in this area **Itdr 40** - `threatdown_nebula.itdr.respond_service_action` Post ITDR Service Respond Action write - `threatdown_nebula.itdr_config.create` Post ITDR Config write - `threatdown_nebula.itdr_config_all.list` Get all ITDR Configs read - `threatdown_nebula.itdr_config_status.list` Get all ITDR Config Status read - `threatdown_nebula.itdr_config.delete` Delete ITDR Config destructive - `threatdown_nebula.itdr_config_identity_protection_setting.get` Get ITDR Identity Protection Setting read - and 34 more in this area **Endpoints 24** - `threatdown_nebula.endpoints.delete` Delete a machine destructive - `threatdown_nebula.endpoints.export` Export endpoints read - `threatdown_nebula.endpoints.get` Get endpoint read - `threatdown_nebula.endpoints.search` Search endpoints read - `threatdown_nebula.endpoints.delete_bulk` Delete multiple machines destructive - `threatdown_nebula.endpoints.export_async` Export endpoints asynchronously write - and 18 more in this area **Firewall management 22** - `threatdown_nebula.firewall_policies.create` Create a new firewall policy write - `threatdown_nebula.firewall_policies.list` Get firewall policies read - `threatdown_nebula.firewall_policies_history.list` Get firewall policy history read - `threatdown_nebula.firewall_rules.create` Create a new firewall rule write - `threatdown_nebula.firewall_policies.delete` Delete a firewall policy destructive - `threatdown_nebula.firewall_policies.get` Get a firewall policy read - and 16 more in this area **Jobs 17** - `threatdown_nebula.jobs.export` Export jobs read - `threatdown_nebula.jobs.issue` Issue a job write - `threatdown_nebula.jobs.issue_bulk` Issue jobs write - `threatdown_nebula.jobs.search` Search jobs read - `threatdown_nebula.jobs.get` Get details about a job read - `threatdown_nebula.jobs.search_groupby` Search jobs groupBy read - and 11 more in this area **Content filtering 16** - `threatdown_nebula.content_filtering.create` Create content filtering rule write - `threatdown_nebula.content_filtering.search` Get a list of content filtering rules read - `threatdown_nebula.content_filtering_categories.list` Get list of categories read - `threatdown_nebula.content_filtering_exclusions.list` Get DNS Global Exclusions read - `threatdown_nebula.content_filtering.delete` Delete content filtering rule destructive - `threatdown_nebula.content_filtering.enable` Enable/Disable content filtering rule write - and 10 more in this area **Policies 15** - `threatdown_nebula.policies.clone` Clone policy write - `threatdown_nebula.policies.create` Create policy write - `threatdown_nebula.policies.list` Get all policies read - `threatdown_nebula.policies_auto_isolation.create` Set policy auto-isolation write - `threatdown_nebula.policies.delete` Delete policy destructive - `threatdown_nebula.policies.get` Get policy by id read - and 9 more in this area **App block 13** - `threatdown_nebula.app_block_activity.export` Export app block activity read - `threatdown_nebula.app_block_activity.export_async` Export app block activity asynchronously write - `threatdown_nebula.app_block_activity.search` Search app block activity read - `threatdown_nebula.app_block_activity.search_groupby` Search app block activity groupby read - `threatdown_nebula.app_block_rules.create` Create App Block Rule write - `threatdown_nebula.app_block_rules.delete` Delete App Block Rule destructive - and 7 more in this area **Copilot 13** - `threatdown_nebula.copilot_chats.create` Create Copilot chat write - `threatdown_nebula.copilot_chats.feedback` Post Copilot chat feedback write - `threatdown_nebula.copilot_chats.list` Get Copilot chats read - `threatdown_nebula.copilot_chats.message` Post message to Copilot chat write - `threatdown_nebula.copilot_chats.delete` Delete Copilot chat by ID destructive - `threatdown_nebula.copilot_chats.get` Get Copilot chat by ID read - and 7 more in this area **Case management 12** - `threatdown_nebula.casemgmt_cases.action` Post cases Action write - `threatdown_nebula.casemgmt_cases.requests` Post cases Requests write - `threatdown_nebula.casemgmt_cases.search` Post cases search write - `threatdown_nebula.casemgmt_cases_comments.create` Post cases comments write - `threatdown_nebula.casemgmt_cases.favorite` Put cases favorite write - `threatdown_nebula.casemgmt_cases_comments.list` Get cases comments read - and 6 more in this area **Device control 12** - `threatdown_nebula.devicecontrol.export` Export device control events read - `threatdown_nebula.devicecontrol.export_async` Export device control events asynchronously write - `threatdown_nebula.devicecontrol.search` Search device control events read - `threatdown_nebula.devicecontrol.search_groupby` Search device control events groupBy read - `threatdown_nebula.devicecontrol.get` Get device control event by ID read - `threatdown_nebula.devicecontrol_exclusions.bulk` Create device exclusions in bulk write - and 6 more in this area **Notifications 10** - `threatdown_nebula.notifications_subscriptions.change_owner` Change notification owner write - `threatdown_nebula.notifications_subscriptions.create` Create notification write - `threatdown_nebula.notifications_subscriptions.get` Get notification read - `threatdown_nebula.notifications_subscriptions.list` Get all notifications read - `threatdown_nebula.notifications_subscriptions.delete` Delete notification destructive - `threatdown_nebula.notifications_subscriptions.update` Update notification write - and 4 more in this area **Security advisor 9** - `threatdown_nebula.sam_assets.software` Issue bulk software update jobs write - `threatdown_nebula.sam_details.list` List SAM issues read - `threatdown_nebula.sam_dns_categories.list` Get supported DNS categories read - `threatdown_nebula.sam_jobs.status` Get list of ongoing SAM jobs read - `threatdown_nebula.sam_details.get` List SAM issues by category read - `threatdown_nebula.sam_policy_details.get` Get Policy protection features read - and 3 more in this area **Exclusions 8** - `threatdown_nebula.exclusions.create` Create exclusion write - `threatdown_nebula.exclusions.evaluates` Evaluate exclusions risk write - `threatdown_nebula.exclusions.get` Get exclusion by id read - `threatdown_nebula.exclusions.list` Get exclusions read - `threatdown_nebula.exclusions.delete` Delete exclusion by id destructive - `threatdown_nebula.exclusions.delete_bulk` Delete exclusions in bulk destructive - and 2 more in this area **Reports 8** - `threatdown_nebula.reports.change_owner` Change reports owner write - `threatdown_nebula.reports.create` Create report write - `threatdown_nebula.reports.generate` Generate report write - `threatdown_nebula.reports.list` Get all reports read - `threatdown_nebula.reports.delete` Delete report by id destructive - `threatdown_nebula.reports.delete_bulk` Delete reports bulk destructive - and 2 more in this area **AI detection response 7** - `threatdown_nebula.aidr_metadata.list` Get AIDR metadata read - `threatdown_nebula.aidr_rules.create` Create AIDR rule write - `threatdown_nebula.aidr_rules.list` List AIDR rules read - `threatdown_nebula.aidr_tools.search` Search AI tools read - `threatdown_nebula.aidr_rules.delete` Delete AIDR rule destructive - `threatdown_nebula.aidr_rules.get` Get AIDR rule by ID read - and 1 more in this area **Flight recorder 7** - `threatdown_nebula.flight_recorder.chart` Search occurrence of suspicious activity read - `threatdown_nebula.flight_recorder.process_graph` Search the process graph read - `threatdown_nebula.flight_recorder.processes` Search a list of processes read - `threatdown_nebula.flight_recorder.raw_events` Search a list of raw events read - `threatdown_nebula.flight_recorder.recap` Search suspicious activity read - `threatdown_nebula.flight_recorder.search` Search the flight recorder with advanced queries. read - and 1 more in this area **Vulnerability management 7** - `threatdown_nebula.cve.bulk` Get CVE details by ids read - `threatdown_nebula.cve.export` Export CVE data read - `threatdown_nebula.cve.export_async` Export CVE data asynchronously write - `threatdown_nebula.cve.ignore` Ignore CVEs write - `threatdown_nebula.cve.get` Get CVE details by id read - `threatdown_nebula.cve.search` Search CVE read - and 1 more in this area **Detections 6** - `threatdown_nebula.detections.export` Export detections read - `threatdown_nebula.detections.export_async` Export detections asynchronously write - `threatdown_nebula.detections.search` Search detections read - `threatdown_nebula.detections.search_groupby` Search detections groupBy read - `threatdown_nebula.detections.get` Get detection by ID read - `threatdown_nebula.detections.submit_fp` Submit false positive request write **Groups 6** - `threatdown_nebula.groups.create` Create group write - `threatdown_nebula.groups.get` Get group by id read - `threatdown_nebula.groups.list` Get all groups read - `threatdown_nebula.groups.machines` Assign endpoints to a group write - `threatdown_nebula.groups.delete` Delete group by id destructive - `threatdown_nebula.groups.update` Update group write **Ignore rules 6** - `threatdown_nebula.assets_ignore_rules.create` Create asset ignore rule write - `threatdown_nebula.assets_ignore_rules.get` Get asset ignore rule details read - `threatdown_nebula.assets_ignore_rules.list` Get asset ignore rules read - `threatdown_nebula.assets_ignore_rules.update` Update asset ignore rule write - `threatdown_nebula.assets_ignore_rules.delete` Delete asset ignore rule destructive - `threatdown_nebula.assets_ignore_rules.delete_bulk` Bulk delete asset ignore rules destructive **Schedules 6** - `threatdown_nebula.schedules.create` Create schedule write - `threatdown_nebula.schedules.get` Get schedule by id read - `threatdown_nebula.schedules.groups` Add groups for schedule write - `threatdown_nebula.schedules.list` Get schedules read - `threatdown_nebula.schedules.delete` Delete a schedule destructive - `threatdown_nebula.schedules.update` Update schedule write **Users 5** - `threatdown_nebula.users.create` Create user write - `threatdown_nebula.users.get` Get one user read - `threatdown_nebula.users.list` Get nebula users read - `threatdown_nebula.users.update` Update user write - `threatdown_nebula.users.delete` Delete a nebula user destructive **Webhooks 5** - `threatdown_nebula.webhooks_subscriptions.create` Create subscription write - `threatdown_nebula.webhooks_subscriptions.get` Get a subscription read - `threatdown_nebula.webhooks_subscriptions.list` Get all subscriptions read - `threatdown_nebula.webhooks_subscriptions.update` Update a subscription write - `threatdown_nebula.webhooks_subscriptions.delete` Delete subscription destructive **Assets 4** - `threatdown_nebula.assets_software.export` Export assets software read - `threatdown_nebula.assets_software.export_async` Export assets software asynchronously write - `threatdown_nebula.assets_software.search` Search assets software read - `threatdown_nebula.assets_software.search_groupby` Search assets software groupBy read **DNS logs 4** - `threatdown_nebula.dns.export` Export DNS Log data read - `threatdown_nebula.dns.export_async` Export DNS Log data asynchronously write - `threatdown_nebula.dns.search` Search DNS Logs read - `threatdown_nebula.dns.search_groupby` Search DNS Logs groupBy read **Drive encryption 4** - `threatdown_nebula.drive_encryption.export` Export drive encryption data read - `threatdown_nebula.drive_encryption.groupby` Search drive encryption grouped by a field read - `threatdown_nebula.drive_encryption.search` Search drive encryption read - `threatdown_nebula.drive_encryption_summary.get` Get drive encryption summary read **Installation tokens 4** - `threatdown_nebula.installation_token.create` Generate an installation tokens write - `threatdown_nebula.installation_token.delete` Revoke installation token destructive - `threatdown_nebula.installation_token.list` Get installation tokens read - `threatdown_nebula.installation_token.send` Send installation tokens write **MXDR 4** - `threatdown_nebula.mxdr_config.create` Post MXDR Config write - `threatdown_nebula.mxdr_config.delete` Delete MXDR Config destructive - `threatdown_nebula.mxdr_config_all.list` Get all MXDR Configs read - `threatdown_nebula.mxdr_config_status.list` Get all MXDR Config Status read **OS patches 4** - `threatdown_nebula.os_patches.export` Export OS Patches read - `threatdown_nebula.os_patches.export_async` Export OS Patches asynchronously write - `threatdown_nebula.os_patches.search` Search OS Patches read - `threatdown_nebula.os_patches.search_groupby` Search OS Patches groupBy read **Preferences 4** - `threatdown_nebula.preferences_notifications.get` Get notifications preferences read - `threatdown_nebula.preferences_notifications.update` Update notifications preferences write - `threatdown_nebula.preferences_threatdown_ai.get` Get ThreatDown AI preferences read - `threatdown_nebula.preferences_threatdown_ai.update` Update ThreatDown AI preferences write **Quarantine 4** - `threatdown_nebula.quarantine.action` Bulk quarantine action write - `threatdown_nebula.quarantine.export` Export quarantines read - `threatdown_nebula.quarantine.list` Get all quarantined items read - `threatdown_nebula.quarantine.search` Search quarantines read **Remediation 4** - `threatdown_nebula.remediation.export` Export remediation Items read - `threatdown_nebula.remediation.search` Search remediation Items read - `threatdown_nebula.remediation_remediate.create` Bulk remediation action write - `threatdown_nebula.remediation_remediate.delete` Mark remediation items as safe destructive **Remote intrusion detection 4** - `threatdown_nebula.rid_rules.export` Export RID rules read - `threatdown_nebula.rid_rules.export_async` Export RID rules asynchronously write - `threatdown_nebula.rid_rules.search` Search RID rules read - `threatdown_nebula.rid_rules.search_groupby` Search grouped RID read **XDR 4** - `threatdown_nebula.xdr_alerts.action` Set alert action taken write - `threatdown_nebula.xdr_alerts.action_bulk` Set alert action taken in bulk write - `threatdown_nebula.xdr_alerts.get` Get alert details read - `threatdown_nebula.xdr_alerts.status` Set alert status write **Products 3** - `threatdown_nebula.products.search` Search products read - `threatdown_nebula.products_categories.list` Get categories read - `threatdown_nebula.products_vendors.search` Search vendors read **Suspicious activity 3** - `threatdown_nebula.sa.details` Suspicious activity details read - `threatdown_nebula.sa.list` Suspicious activity of the account read - `threatdown_nebula.sa_process_graph.get` Suspicious activity process graph read **Usage 3** - `threatdown_nebula.usage.histogram` Search usage histogram read - `threatdown_nebula.usage_logs.search` Search logs of usage read - `threatdown_nebula.usage_logs.summary` Search summary of usage read **Account 2** - `threatdown_nebula.account.get` Get account details read - `threatdown_nebula.account_ad_structure.get` Get account AD structure read **MDR 2** - `threatdown_nebula.mdr_config.create` Configure managed settings write - `threatdown_nebula.mdr_config.list` Get managed settings read **Sandbox 2** - `threatdown_nebula.sandbox.upload` Upload file to the sandbox write - `threatdown_nebula.sandbox_submissions.search` Search the sandbox submission results read **Events 1** - `threatdown_nebula.events.list` Retrieve events read **Installers 1** - `threatdown_nebula.installers.get` Retrieve installers's links read **Licensing 1** - `threatdown_nebula.license.amend` Amend a license write This index shows a sample of each area. All 439 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The ThreatDown Nebula MCP server, answered. **Is there a ThreatDown Nebula MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 439 ThreatDown Nebula actions across grid, email protection, itdr and endpoints, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by ThreatDown Nebula. **What do I need to connect ThreatDown Nebula?** ThreatDown client ID: in the Nebula console go to Settings > API Integrations (Integrate) and add an OAuth2… and ThreatDown client secret (shown once when the application is created). Plus your account id and your scopes. The free call account { op: "connections.requirements", service: "threatdown_nebula" } lists exactly what to paste. **Can an AI agent delete or change things in ThreatDown Nebula?** Only if its key allows it, and only with an explicit confirmation. 46 ThreatDown Nebula actions are destructive, including delete a nebula user, delete a machine and delete group by id. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my ThreatDown Nebula API limit?** actionlake paces every call to the limits in the ThreatDown Nebula service file: 360 calls a minute per connection. Repeated reads are answered from cache (203 ThreatDown Nebula actions can be), which never reaches ThreatDown Nebula. **What does a ThreatDown Nebula action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (439 ThreatDown Nebula actions page). Cache hits, searches, dry runs and calls ThreatDown Nebula refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which ThreatDown Nebula API does it cover?** The ThreatDown (Malwarebytes) Nebula (endpoint security: endpoints, detections, jobs, policies, EDR, ITDR, email protection) API ThreatDown APIs 1.0.0 (OpenAPI 3.0, 441 operations) at api.threatdown.com. It is built from ThreatDown Nebula's documentation as read on 23 October 2026. 439 actions in 45 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my ThreatDown Nebula data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your ThreatDown Nebula credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like ThreatDown Nebula Shares the most action names with - [ThreatDown OneView 8](https://actionlake.com/connectors/threatdown-oneview) - [Action1 7](https://actionlake.com/connectors/action1) - [MSP360 Managed Backup 6](https://actionlake.com/connectors/msp360-managed-backup) - [ExtremeCloud IQ 5](https://actionlake.com/connectors/extremecloud-iq) - [Logz.io 5](https://actionlake.com/connectors/logz-io) - [Sublime Security 5](https://actionlake.com/connectors/sublime-security) Joins with, on shared entities - [VMware Carbon Black Cloud 3](https://actionlake.com/connectors/vmware-carbon-black-cloud) - [Microsoft 365 Users 2](https://actionlake.com/connectors/microsoft-365-users) - [Cloudflare 2](https://actionlake.com/connectors/cloudflare) - [Apple App Store Connect 2](https://actionlake.com/connectors/apple-app-store-connect) - [HashiCorp Vault 2](https://actionlake.com/connectors/hashicorp-vault) - [Okta 2](https://actionlake.com/connectors/okta) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by ThreatDown Nebula; the name is the vendor's own. Counts are from the ThreatDown Nebula service file, version 1.0.0. ## Give your agent ThreatDown Nebula today. [Connect ThreatDown Nebula free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/threatdown-nebula More: https://actionlake.com/llms.txt