Actions181
- Account Actions
- Accounts Actions
- App Block Actions
- Assets Actions
- Content Filtering Actions
- Create Content Filtering Rule
- Create Update DNS Settings
- Delete Content Filtering Rule
- Enable Disable Content Filtering Rule
- Enable Disable Content Filtering Rule For Policy
- Get A Content Filtering Rule Details
- Get A List Of Content Filtering Rules
- Get DNS Settings
- Get Domain Details
- Get Frequently Used Domain Names
- Get List Of Policies
- Update Content Filtering Rule
- CVE Actions
- Detections Actions
- Device Control Actions
- DNS Actions
- Endpoints Actions
- All Suspicious Activity Of An Endpoint
- Close Suspicious Activity Of An Endpoint
- Delete A Machine
- Delete Multiple Machines
- Endpoint Status
- Export Endpoints
- Get A Scan Of An Endpoint
- Get Endpoint
- Get Endpoint Agent Info
- Get Endpoint Assets
- Get Quarantined Items
- Get Scans Of An Endpoint
- Get The Detections Of A Scan
- Network Information
- Open Suspicious Activity Of An Endpoint
- Remediate Suspicious Activity Of An Endpoint
- Search Endpoints
- Search Grouped Endpoints
- Set Endpoint Tags
- Specific Suspicious Activity Of An Endpoint
- Events Actions
- Exclusions Actions
- Flight Recorder Actions
- Grid Actions
- Export CVEs
- Export Detections
- Export Device Control Events
- Export DNS Activity
- Export Endpoints
- Export Events
- Export OS Patches
- Export RID Rules
- Export Software Assets
- Search CVEs
- Search Detections
- Search Device Control Events
- Search DNS Activity
- Search Endpoints
- Search Events
- Search Events Groupby
- Search Grouped CVEs
- Search Grouped Detections
- Search Grouped Device Control Events
- Search Grouped DNS Activity
- Search Grouped Endpoints
- Search Grouped OS Patches
- Search Grouped RID Rules
- Search Grouped Software Assets
- Search OS Patches
- Search RID Rules
- Search Software Assets
- Groups Actions
- Installation Token Actions
- Installers Actions
- Jobs Actions
- Notifications Actions
- OS Patches Actions
- Policies Actions
- Products Actions
- Quarantine Actions
- Reports Actions
- RID Actions
- SA Actions
- Schedules Actions
- Usage Actions
- Users Actions
- Webhooks Actions
Endpoints → Get The Detections Of A Scan
AI-generatedSummary
Retrieves the detections recorded for a specific scan on a specific endpoint from the Threatdown (Malwarebytes) API, using the endpoint ID and scan ID. Supports optional cursor pagination and a "since" filter.
Inputs
- ID (required) — Endpoint ID, sent as a path parameter.
- Scan ID (required) — ID of the scan whose detections should be returned, sent as a path parameter.
- Next Cursor — Pagination cursor query parameter, used to fetch the next page of results. Leave empty for the first page.
- Since — Query parameter to restrict results by a starting point (format not specified in the node; likely a timestamp).
Output shape
The API response for the scan's detections, normalized into n8n items (likely a list of detection records).
The source shows only function signatures, so the exact response fields are not visible. Pagination is manual: pass the cursor returned by the API into Next Cursor on the next call. Empty optional parameters are presumably omitted.
Examples
Example 1: Review the threats found in a particular scan of an endpoint.
Set ID to the endpoint ID and Scan ID to the scan's ID; leave Next Cursor and Since empty.
Example 2: Fetch the next page of detections for a large scan.
Use the same ID and Scan ID, and set Next Cursor to the cursor value from the previous response.