Actions181
- Account Actions
- Accounts Actions
- App Block Actions
- Assets Actions
- Content Filtering Actions
- Create Content Filtering Rule
- Create Update DNS Settings
- Delete Content Filtering Rule
- Enable Disable Content Filtering Rule
- Enable Disable Content Filtering Rule For Policy
- Get A Content Filtering Rule Details
- Get A List Of Content Filtering Rules
- Get DNS Settings
- Get Domain Details
- Get Frequently Used Domain Names
- Get List Of Policies
- Update Content Filtering Rule
- CVE Actions
- Detections Actions
- Device Control Actions
- DNS Actions
- Endpoints Actions
- All Suspicious Activity Of An Endpoint
- Close Suspicious Activity Of An Endpoint
- Delete A Machine
- Delete Multiple Machines
- Endpoint Status
- Export Endpoints
- Get A Scan Of An Endpoint
- Get Endpoint
- Get Endpoint Agent Info
- Get Endpoint Assets
- Get Quarantined Items
- Get Scans Of An Endpoint
- Get The Detections Of A Scan
- Network Information
- Open Suspicious Activity Of An Endpoint
- Remediate Suspicious Activity Of An Endpoint
- Search Endpoints
- Search Grouped Endpoints
- Set Endpoint Tags
- Specific Suspicious Activity Of An Endpoint
- Events Actions
- Exclusions Actions
- Flight Recorder Actions
- Grid Actions
- Export CVEs
- Export Detections
- Export Device Control Events
- Export DNS Activity
- Export Endpoints
- Export Events
- Export OS Patches
- Export RID Rules
- Export Software Assets
- Search CVEs
- Search Detections
- Search Device Control Events
- Search DNS Activity
- Search Endpoints
- Search Events
- Search Events Groupby
- Search Grouped CVEs
- Search Grouped Detections
- Search Grouped Device Control Events
- Search Grouped DNS Activity
- Search Grouped Endpoints
- Search Grouped OS Patches
- Search Grouped RID Rules
- Search Grouped Software Assets
- Search OS Patches
- Search RID Rules
- Search Software Assets
- Groups Actions
- Installation Token Actions
- Installers Actions
- Jobs Actions
- Notifications Actions
- OS Patches Actions
- Policies Actions
- Products Actions
- Quarantine Actions
- Reports Actions
- RID Actions
- SA Actions
- Schedules Actions
- Usage Actions
- Users Actions
- Webhooks Actions
Device Control → Search Device Control Events Group By
AI-generatedSummary
Sends a POST request to the Threatdown (Malwarebytes) Device Control search group-by endpoint to aggregate device control events by a chosen field, with cursor-based pagination.
Inputs
- Body Fields — Collection of optional request body fields: Group By (field to group events by, default "account_id"), Next Cursor (cursor from a previous response to fetch the next page), and Page Size (number of results per page, default 2000).
- Additional JSON Body — Raw JSON object with extra request body values, merged with the Body Fields. Use it for search or filter criteria not exposed as dedicated fields.
Output shape
The API response for the grouped device control event search, normalized into n8n items. Likely a list of grouped results, plus a cursor if more pages exist.
The source pack shows only function signatures, not bodies, so the exact endpoint path, merge precedence and response shape are not confirmed. To paginate, pass the returned next cursor into Next Cursor on the next call. Credentials supply the base URL and authentication.
Examples
Example 1: Count device control events grouped by account
Body Fields: Group By = account_id, Page Size = 2000. Leave Additional JSON Body empty.
Example 2: Fetch the next page of grouped results
Body Fields: Group By = account_id, Next Cursor = the cursor value from the previous response.
Example 3: Apply extra filters not offered as fields
Set Group By in Body Fields and put the additional criteria in Additional JSON Body as a JSON object.