Threatdown (Malwarebytes)

Interact with the ThreatDown Nebula API by Malwarebytes

Actions181

Account Actions
- Get Account Details
Accounts Actions
- Get Notifications Preferences
- Put Notifications Preferences
App Block Actions
- Create App Block Rule
- Create App Block Settings
- Delete App Block Rule
- Export App Block Activity
- Get App Block Rule
- Get App Block Settings
- Search App Block Activity
- Search App Block Activity Groupby
- Search App Block Rules
- Update App Block Rule
Assets Actions
- Export Assets Software
- Search Assets Software
- Search Assets Software Group By
Content Filtering Actions
- Create Content Filtering Rule
- Create Update DNS Settings
- Delete Content Filtering Rule
- Enable Disable Content Filtering Rule
- Enable Disable Content Filtering Rule For Policy
- Get A Content Filtering Rule Details
- Get A List Of Content Filtering Rules
- Get DNS Settings
- Get Domain Details
- Get Frequently Used Domain Names
- Get List Of Policies
- Update Content Filtering Rule
CVE Actions
- Export CVE Data
- Get CVE Details By ID
- Search CVE
- Search CVE Group By
Detections Actions
- Export Detections
- Get Detection By ID
- Search Detections
- Search Detections Group By
Device Control Actions
- Export Device Control Events
- Get Device Control Event By ID
- Search Device Control Events
- Search Device Control Events Group By
DNS Actions
- Export DNS Log Data
- Search DNS Logs
- Search DNS Logs Group By
Endpoints Actions
- All Suspicious Activity Of An Endpoint
- Close Suspicious Activity Of An Endpoint
- Delete A Machine
- Delete Multiple Machines
- Endpoint Status
- Export Endpoints
- Get A Scan Of An Endpoint
- Get Endpoint
- Get Endpoint Agent Info
- Get Endpoint Assets
- Get Quarantined Items
- Get Scans Of An Endpoint
- Get The Detections Of A Scan
- Network Information
- Open Suspicious Activity Of An Endpoint
- Remediate Suspicious Activity Of An Endpoint
- Search Endpoints
- Search Grouped Endpoints
- Set Endpoint Tags
- Specific Suspicious Activity Of An Endpoint
Events Actions
- Retrieve Events
Exclusions Actions
- Create Exclusion
- Delete Exclusion By ID
- Get Exclusion By ID
- Get Exclusions
- Update Exclusion
Flight Recorder Actions
- Search A List Of Processes
- Search A List Of Raw Events
- Search Occurrence Of Suspicious Activity
- Search Suspicious Activity
- Search Suspicious Activity Receiving Impact Information On An Endpoint
- Search The Flight Recorder With Advanced Queries
- Search The Process Graph
Grid Actions
- Export CVEs
- Export Detections
- Export Device Control Events
- Export DNS Activity
- Export Endpoints
- Export Events
- Export OS Patches
- Export RID Rules
- Export Software Assets
- Search CVEs
- Search Detections
- Search Device Control Events
- Search DNS Activity
- Search Endpoints
- Search Events
- Search Events Groupby
- Search Grouped CVEs
- Search Grouped Detections
- Search Grouped Device Control Events
- Search Grouped DNS Activity
- Search Grouped Endpoints
- Search Grouped OS Patches
- Search Grouped RID Rules
- Search Grouped Software Assets
- Search OS Patches
- Search RID Rules
- Search Software Assets
Groups Actions
- Assign Endpoints To A Group
- Create Group
- Delete Group By Its ID
- Get All Groups
- Get Group By ID
- Update Group
Installation Token Actions
- Generate An Installation Tokens
- Get Installation Tokens
- Revoke Installation Token
- Send Installation Tokens
Installers Actions
- Retrieve Installerss Links
Jobs Actions
- Cancel Pending Jobs
- Export Jobs
- Get Details About A Job
- Issue A Job
- Issue Jobs
- Search Jobs
- Search Jobs Group By
Notifications Actions
- Create Notification
- Delete Notification
- Delete Notification Bulk
- Get All Notifications
- Get Notification
- Update Notification
- Update Notification Bulk
OS Patches Actions
- Export OS Patches
- Search OS Patches
- Search OS Patches Group By
Policies Actions
- Add Isolation Image
- Clone Policy
- Create Policy
- Delete Policy
- Delete Policy Isolation Image
- Get Policy By ID Get Policies
- Get Policy By ID Get Policies By ID
- Get Policy Isolation Image By ID
- Get Policy Secret By ID
- Get System Default Policy
- Promote Policy
- Set Policy Secret By ID
- Update Policy
Products Actions
- Search Products
- Search Vendors
Quarantine Actions
- Bulk Quarantine Action
- Export Quarantines
- Get All Quarantined Items
Reports Actions
- Create Report
- Delete Report By ID
- Delete Reports Bulk
- Generate Report
- Get All Reports
- Get Report By ID
- Update Report
RID Actions
- Export RID Rules
- Search Grouped RID
- Search RID Rules
SA Actions
- Suspicious Activity Details
- Suspicious Activity Of The Account
- Suspicious Activity Process Graph
Schedules Actions
- Add Groups For Schedule
- Create Schedule
- Delete A Schedule
- Get Schedule By ID
- Get Schedules
- Update Schedule
Usage Actions
- Search Logs Of Usage
- Search Summary Of Usage
- Search Usage Histogram
Users Actions
- Create User
- Delete A Nebula User
- Get Nebula Users
- Get One User
- Update User
Webhooks Actions
- Create Subscription
- Delete Subscription
- Get A Subscription
- Get All Subscriptions
- Update A Subscription

Detections → Search Detections

AI-generated

Summary

Searches Threatdown (Malwarebytes) endpoint detections by sending a POST request with filter, pagination, and sorting fields built from the Body Fields collection and an optional JSON body.

Inputs

Body Fields — Collection of optional request body fields. Filters include detection_id, parent_detection_id, trace_id, threat_name, category, type, status, path, process_name, md5, sha256, host/machine names and IDs, group_id, last_user, domain_name, OS info, NIC details, plugin versions, scan_id, scan_type, job_id, and schedule_id. Most string filters have a .keyword variant for exact matching. Negation filters are not.category, not.type and not.scan_result.device.disk_model. Date range filters are start_date/end_date, at_after/at_before, reported_at_after/before, scanned_at_after/before and cleaned_at_after/before. Boolean flags are aggregate_by_account, is_root_detection, is_rtp_stream_event, populate.endpoint, populate.group and populate.scan_result. Paging and sort fields are page_size (default 2000), next_cursor, sort_field (default trace_id) and sort_order (default asc).
Additional JSON Body — JSON object merged with the Body Fields values. Use it for any request body keys not exposed as fields.

Output shape

The parsed API response, normalized into n8n items. The response is most likely a list of matching detection records, plus a pagination cursor if the API returns one.

The source pack shows only function signatures, so the exact response shape and any pagination handling are not confirmed. To fetch further pages, pass next_cursor from a previous response. The fields' defaults (page_size 2000, sort_field trace_id, sort_order asc) are declared in the properties and may be sent even if untouched.

Examples

Example 1: Pull recent detections of a specific threat for triage

Body Fields: threat_name = 'Malware.Generic', start_date = '2026-09-01', end_date = '2026-09-30', page_size = 500.

Example 2: List detections on one host with endpoint details included

Body Fields: host_name = 'WS-042', populate.endpoint = true, sort_order = 'desc'.

Example 3: Page through results

Set next_cursor in Body Fields to the cursor returned by the previous run, keeping the same filters.

Threatdown (Malwarebytes)Install