Actions181
- Account Actions
- Accounts Actions
- App Block Actions
- Assets Actions
- Content Filtering Actions
- Create Content Filtering Rule
- Create Update DNS Settings
- Delete Content Filtering Rule
- Enable Disable Content Filtering Rule
- Enable Disable Content Filtering Rule For Policy
- Get A Content Filtering Rule Details
- Get A List Of Content Filtering Rules
- Get DNS Settings
- Get Domain Details
- Get Frequently Used Domain Names
- Get List Of Policies
- Update Content Filtering Rule
- CVE Actions
- Detections Actions
- Device Control Actions
- DNS Actions
- Endpoints Actions
- All Suspicious Activity Of An Endpoint
- Close Suspicious Activity Of An Endpoint
- Delete A Machine
- Delete Multiple Machines
- Endpoint Status
- Export Endpoints
- Get A Scan Of An Endpoint
- Get Endpoint
- Get Endpoint Agent Info
- Get Endpoint Assets
- Get Quarantined Items
- Get Scans Of An Endpoint
- Get The Detections Of A Scan
- Network Information
- Open Suspicious Activity Of An Endpoint
- Remediate Suspicious Activity Of An Endpoint
- Search Endpoints
- Search Grouped Endpoints
- Set Endpoint Tags
- Specific Suspicious Activity Of An Endpoint
- Events Actions
- Exclusions Actions
- Flight Recorder Actions
- Grid Actions
- Export CVEs
- Export Detections
- Export Device Control Events
- Export DNS Activity
- Export Endpoints
- Export Events
- Export OS Patches
- Export RID Rules
- Export Software Assets
- Search CVEs
- Search Detections
- Search Device Control Events
- Search DNS Activity
- Search Endpoints
- Search Events
- Search Events Groupby
- Search Grouped CVEs
- Search Grouped Detections
- Search Grouped Device Control Events
- Search Grouped DNS Activity
- Search Grouped Endpoints
- Search Grouped OS Patches
- Search Grouped RID Rules
- Search Grouped Software Assets
- Search OS Patches
- Search RID Rules
- Search Software Assets
- Groups Actions
- Installation Token Actions
- Installers Actions
- Jobs Actions
- Notifications Actions
- OS Patches Actions
- Policies Actions
- Products Actions
- Quarantine Actions
- Reports Actions
- RID Actions
- SA Actions
- Schedules Actions
- Usage Actions
- Users Actions
- Webhooks Actions
App Block → Search App Block Activity
AI-generatedSummary
Searches Threatdown (Malwarebytes) application block activity by sending a POST request with filter, sort, and pagination fields in the request body.
Inputs
- Body Fields — Collection of optional filters sent as request body fields. Includes account name, group ID/name, policy name, rule ID/name, file path, last user, status, OS info (platform, type, version, release name), engine version, NIC IPs, and name multi-search. Also covers time ranges (start_date, end_date, scanned_at_after, scanned_at_before, histogram_time_zone). Some fields have .keyword variants for exact matching. Pagination and sorting use page_size (default 2000), next_cursor, sort_field (default scanned_at) and sort_order (default asc).
- Additional JSON Body — Raw JSON object merged with the Body Fields collection. Use it for body values that aren't exposed as fields.
Output shape
The parsed API response, normalized into n8n items. Expect app block activity records matching the filters, and probably a cursor for paging.
The source pack shows only function signatures, not bodies, so the exact response shape and the merge precedence between Body Fields and the JSON body are unconfirmed. For more results, pass the returned next cursor in Next Cursor. The properties don't document date formats.
Examples
Example 1: Find recent blocks triggered by a specific rule
Body Fields: Rule Name = a rule name, Start Date and End Date set to the window, Sort Order = desc, Page Size = 100.
Example 2: Page through all activity for a group
Body Fields: Group ID = the group's ID. On each follow-up call, set Next Cursor to the cursor from the previous response.