DefensXInstall

Summary

Retrieves the top 20 hostnames or IP addresses where users attempted to submit credentials that were blocked by the policy.

Inputs

• Customer ID (required) — ID of the customer to query.
• Start Date — Log window start date, can be in JSON datetime or Unix timestamp format (default: beginning of the month).
• End Date — Log window end date, can be in JSON datetime or Unix timestamp format (default: end of the month).
• Output Mode — Determines how the response is returned: 'One Item Per Element' outputs one n8n item per array element, while 'Single Item (Raw)' returns the full response as a single item.

Output shape

a list of items (array) containing top 20 blocked hostname or IP records

Returns a limited list of up to 20 entries per request. The response is not paginated by this node; it relies on the API returning a fixed list of the top offenders.

Examples

Example 1: Retrieve blocked credential attempts for the current month

Customer ID: '12345', Start Date: Current month start, End Date: Current month end, Output Mode: One Item Per Element

Example 2: Get a raw view of blocked credential attempts for a specific date range

Customer ID: '67890', Start Date: '2023-01-01', End Date: '2023-01-31', Output Mode: Single Item (Raw)

Links

• n8n community nodes installation guide