Threatdown (Malwarebytes)Install

Summary

Searches Threatdown (Malwarebytes) Device Control events by sending a POST request with a filter body built from the chosen Body Fields and optional raw JSON. Returns matching device control events (e.g., USB/disk block events) from the Malwarebytes API.

Inputs

• Body Fields — Collection of optional filters added to the request body. Covers device_control.* attributes (block status, device ID, manufacturer, serial number, disk interface, file system, volume name/path/serial, PnP device ID, timestamp after/before), and endpoint identifiers (host name, machine name/ID, FQDN, domain, last user, group ID, NIC IPs/MAC). Also includes OS info, plugin versions, and detection/scan fields (threat name, md5, sha256, path, process name, scan ID/type). Many fields have a .keyword variant for exact match. 'Not …' variants exclude values.
• Date and time filters — Body Fields such as start_date, end_date, at_after/at_before, reported_at_after/before, scanned_at_after/before and cleaned_at_after/before. They limit results by time window. The expected format is not stated in the properties.
• Pagination and sorting — Body Fields page_size (default 2000), next_cursor (to fetch the next page), sort_field (default trace_id) and sort_order (default asc).
• Populate options — Boolean Body Fields populate.endpoint, populate.group and populate.scan_result to request enriched related data.
• Additional JSON Body — Raw JSON object merged with the Body Fields values. Use it for filters not exposed in the UI or to override fields.

Output shape

The Threatdown API response for the search, normalized into n8n items (likely one item per result record or a single response object).

Results are paged: use page_size and next_cursor to fetch more. The source shows only function signatures, so the exact response shape and item splitting are not confirmed. Note that the property displayOptions reference the operation value 'postDevicecontrol'.

Examples

Example 1: Find all blocked USB storage events for a specific host since a given date

Body Fields: Host Name = 'LAPTOP-01', Device Control Block Status = 'blocked', Device Control Timestamp After = ISO date.

Example 2: Page through a large set of events sorted by trace ID

Body Fields: Page Size = 500, Sort Order = asc; on later calls set Next Cursor from the previous response.

Example 3: Use a filter not in the UI with an exclusion

Additional JSON Body = {"group_id":""} plus Body Field Not Device Control Manufacturer = 'Acme'.

Links

• n8n community nodes installation guide