Threatdown (Malwarebytes)Install

Summary

Closes a suspicious activity (SA) on a specific Threatdown (Malwarebytes) endpoint by sending a PUT request to the endpoint's SA close route, identified by endpoint ID and SA ID.

Inputs

• ID (required) — Path parameter: the ID of the endpoint that owns the suspicious activity.
• SA ID (required) — Path parameter: the ID of the suspicious activity to close.
• JSON Body — Optional JSON request body sent with the PUT request, for any close-related fields the API accepts. The source pack is signature-level only, so the exact body handling and accepted fields aren't visible.

Output shape

The Threatdown API response for the close request, normalized into n8n items.

The source pack shows only function signatures (e.g. normalizeResponse), not bodies, so the exact response shape isn't confirmed. Expect it to be whatever the API returns for this PUT, which may be empty or a status object. Base URL and authentication come from the node's credentials.

Examples

Example 1: Automatically close a suspicious activity after an analyst marks it as a false positive in a ticketing system.

Set ID to the endpoint ID and SA ID to the suspicious activity ID from earlier nodes via expressions. Leave JSON Body empty.

Example 2: Close a suspicious activity and pass additional data required by the API.

Set ID and SA ID, then provide a JSON Body such as {"note":"Reviewed"}. Field names must match the Threatdown API.

Links

• n8n community nodes installation guide