Threatdown (Malwarebytes)Install

Summary

Retrieves the suspicious activity records for a single Threatdown (Malwarebytes) endpoint by its ID, with optional sorting, time filtering and cursor-based pagination.

Inputs

• ID (required) — Endpoint ID, sent as a path parameter.
• Sort Field — Field to sort results by (query parameter sortField).
• Sort Direction — Sort order, e.g. ascending or descending (query parameter sortDirection). Free-text; accepted values are not defined in the node.
• Next Cursor — Pagination cursor from a previous response to fetch the next page.
• Since — Time filter limiting results to activity since the given value (query parameter since). Format is not specified in the node.
• Per Page — Number of results per page (query parameter perPage).

Output shape

The API's JSON response for the endpoint's suspicious activity, normalized into n8n items.

The source pack shows only function signatures, so the exact response shape isn't visible. Pagination is manual: pass Next Cursor from the prior response to get further pages. All parameters are string inputs, and empty optional ones are likely omitted from the request.

Examples

Example 1: Investigate recent suspicious activity on a flagged machine

Set ID to the endpoint's ID, Since to a recent timestamp, Per Page to 50.

Example 2: Page through all activity for an endpoint

Set ID, then feed the Next Cursor value from the previous response into a loop on this node.

Links

• n8n community nodes installation guide