Threatdown (Malwarebytes)Install

Summary

Searches Threatdown (Malwarebytes) DNS filtering logs by POSTing a filter body to the DNS search endpoint. Filters are built from the Body Fields collection and an optional JSON body, and matching log records are returned.

Inputs

• Body Fields — Collection of optional filters sent in the request body. Covers account, group, machine, policy and rule IDs and names (plus .keyword exact-match variants). Also covers action, resolved_ips, and log.* fields such as query_name, query_type, protocol, resolver_decision, src/dst IP and port, colo_id, user_id and query_size. Numeric log fields have gt/gte/lt/lte range variants. Time bounds: timestamp_after/before and log.datetime_after/before. 'Not' variants (not.*) exclude matches. Paging and sorting: page_size (default 50), next_cursor, sort_field (default machine_id), sort_order (default asc). populate.endpoint and populate.group are booleans that request endpoint and group details.
• Additional JSON Body — Raw JSON object merged with the Body Fields values. Use it for filters not exposed as fields or to override them.

Output shape

Items built from the API response, normalized by the node. This is most likely the matching DNS log records, with each record as its own item.

Results are paged. Pass next_cursor from a previous response in Body Fields to fetch the next page, and adjust page_size. The source pack shows only function signatures, so the exact output shape and pagination details are not confirmed. The property list also has no required fields, so an empty body may return unfiltered results.

Examples

Example 1: Find blocked DNS lookups for a specific domain in the last day

Body Fields: Action = blocked, Log Query Name = example.com, Timestamp After = ISO timestamp for 24 hours ago, Page Size = 100

Example 2: Exclude a trusted resolver decision while investigating one machine

Body Fields: Machine ID = , Not Log Resolver Decision = allowed, Populate Endpoint = true

Example 3: Page through all results

Body Fields: Next Cursor = value from the previous response, Page Size = 50, Sort Field = machine_id, Sort Order = asc

Links

• n8n community nodes installation guide