Malwarebytes

Connect Malwarebytes to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Malwarebytes:

   1. Get a ThreatDown API client credential pair (an OAuth2 application with a client_id and client_secret); ThreatDown says you can get a valid application through its sales team, and you also need a valid master license. The application's access can be limited to the read scope.

   Malwarebytes's public documentation does not cover every step.

   The Nebula support article (Create OAuth2 credentials for Nebula) returned HTTP 403 during verification, so its console click path could not be confirmed and was removed. The API reference confirms the client_id/client_secret pair, the read/write/execute scopes and the x-mwb-accountid header, but does not say where the account ID is shown, how to determine the Region, or whether the secret is shown only once.

   Source: support.threatdown.com, cloud.threatdown.com, checked 2026-10-07.

   The permissions Safeguard needs: read.

2. On Compliance › Connectors, open Malwarebytes, click Connect, choose API token and fill in:

   Field	What to enter
   Client ID	Required.
   Client secret	Required. Stored encrypted and never shown again.
   Account ID	Required.
   Region	Required.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Malwarebytes and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks