ThreatDown Protection

The ThreatDown Protection check monitors local ThreatDown (Malwarebytes) health: agent, real-time protection, signature age, and quarantine. It runs on Windows, macOS, and Linux every 5 minutes by default. The check reads local data; OneView credentials are not required.

Prerequisites

• ThreatDown and the octoja agent must be installed on the monitored device.

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → ThreatDown Protection.
3. Adjust the thresholds if needed.
4. Click Add Check.

To roll it out to many devices at once, use a config package.

Settings

If Signature age — warning (hours) is higher than Signature age — critical (hours), the check swaps the two values before evaluating. The same applies to the two quarantine thresholds, unless Quarantine — critical (count) is 0.

Results

• On Windows and macOS, the check calculates signature age from the date in the signature version (on Windows counted from midnight of that day); on Linux, from the modification time of the signature database.
• If the local query takes longer than 60 seconds, the check stops and reports Failure.

FAQ

Why can the ThreatDown quarantine count differ from OneView?

The check reads the local device's quarantine, not OneView. Compare the same device and the filters shown in each view; the difference alone does not establish a cloud-sync delay.