Threatdown (Malwarebytes)Install

Summary

Retrieves security events from the Threatdown (Malwarebytes) API, optionally filtered by machine, time range, severity, source, or search text, with cursor-based paging.

Inputs

• Next Cursor — Pagination cursor (query parameter nextCursor) from a previous response, used to fetch the next page of events.
• Search String — Free-text search filter sent as a query parameter.
• Machine ID — Limits events to a specific machine/endpoint.
• Start — Start of the time range to query. Plain string; the expected format isn't declared in the node.
• End — End of the time range to query. Plain string; the expected format isn't declared in the node.
• Severity Flags — Severity filter sent as a query parameter. Accepted values aren't documented in the node.
• Source — Filters events by their source.

Output shape

The API response for the events query, normalized into n8n items. Typically a list of event records, possibly with a next-cursor value for paging.

The source shows only function signatures, so the exact response shape isn't verified. Paging isn't automatic: pass the returned cursor into Next Cursor to get further pages. All inputs are optional strings and empty ones are likely omitted.

Examples

Example 1: Pull recent high-severity events for one endpoint

Set Machine ID, Start and End to the time window, and Severity Flags to the desired severity value.

Example 2: Page through a large result set

Run once with filters, then feed the returned cursor into Next Cursor on the next call (e.g. in a loop).

Links

• n8n community nodes installation guide