Threatdown (Malwarebytes)Install

Summary

Sends a POST request to the Threatdown (Malwarebytes) DNS search group-by endpoint, returning DNS log results aggregated by a chosen field (default: rule_id), with cursor-based pagination.

Inputs

• Body Fields > Group By — Field to group DNS logs by, sent as group_by in the request body. Defaults to rule_id.
• Body Fields > Next Cursor — Pagination cursor, sent as next_cursor, used to fetch the next page of results from a previous response.
• Body Fields > Page Size — Number of results per page, sent as page_size. Defaults to 2000.
• Additional JSON Body — Extra request body values as JSON, merged with the Body Fields. Use it for filters or other search criteria not exposed as fields.

Output shape

The API response for the grouped DNS log search, normalized into n8n items (grouped results, plus a next cursor if more pages exist).

The exact response fields are not visible in the source pack. The operation fetches one page per call, so to get more results, pass the returned cursor into Next Cursor. The Additional JSON Body must be valid JSON.

Examples

Example 1: Summarize DNS activity by rule

Leave Group By as rule_id and Page Size at 2000. Run with no other settings.

Example 2: Page through grouped results

Set Next Cursor to the cursor value from the previous response, and keep Group By and Page Size the same.

Example 3: Filter grouped results with extra criteria

Set Group By to the desired field and put the additional search criteria in Additional JSON Body.

Links

• n8n community nodes installation guide