Actions181
- Account Actions
- Accounts Actions
- App Block Actions
- Assets Actions
- Content Filtering Actions
- Create Content Filtering Rule
- Create Update DNS Settings
- Delete Content Filtering Rule
- Enable Disable Content Filtering Rule
- Enable Disable Content Filtering Rule For Policy
- Get A Content Filtering Rule Details
- Get A List Of Content Filtering Rules
- Get DNS Settings
- Get Domain Details
- Get Frequently Used Domain Names
- Get List Of Policies
- Update Content Filtering Rule
- CVE Actions
- Detections Actions
- Device Control Actions
- DNS Actions
- Endpoints Actions
- All Suspicious Activity Of An Endpoint
- Close Suspicious Activity Of An Endpoint
- Delete A Machine
- Delete Multiple Machines
- Endpoint Status
- Export Endpoints
- Get A Scan Of An Endpoint
- Get Endpoint
- Get Endpoint Agent Info
- Get Endpoint Assets
- Get Quarantined Items
- Get Scans Of An Endpoint
- Get The Detections Of A Scan
- Network Information
- Open Suspicious Activity Of An Endpoint
- Remediate Suspicious Activity Of An Endpoint
- Search Endpoints
- Search Grouped Endpoints
- Set Endpoint Tags
- Specific Suspicious Activity Of An Endpoint
- Events Actions
- Exclusions Actions
- Flight Recorder Actions
- Grid Actions
- Export CVEs
- Export Detections
- Export Device Control Events
- Export DNS Activity
- Export Endpoints
- Export Events
- Export OS Patches
- Export RID Rules
- Export Software Assets
- Search CVEs
- Search Detections
- Search Device Control Events
- Search DNS Activity
- Search Endpoints
- Search Events
- Search Events Groupby
- Search Grouped CVEs
- Search Grouped Detections
- Search Grouped Device Control Events
- Search Grouped DNS Activity
- Search Grouped Endpoints
- Search Grouped OS Patches
- Search Grouped RID Rules
- Search Grouped Software Assets
- Search OS Patches
- Search RID Rules
- Search Software Assets
- Groups Actions
- Installation Token Actions
- Installers Actions
- Jobs Actions
- Notifications Actions
- OS Patches Actions
- Policies Actions
- Products Actions
- Quarantine Actions
- Reports Actions
- RID Actions
- SA Actions
- Schedules Actions
- Usage Actions
- Users Actions
- Webhooks Actions
Flight Recorder → Search A List Of Processes
AI-generatedSummary
Search Threatdown (Malwarebytes) Flight Recorder for process events by sending a POST request with filters such as hostname, process name, hashes, PID, user and time range.
Inputs
- Body Fields (op73_bodyFields) — Collection of optional filters sent in the request body: event_category (default 'process'), machine_id, pc_hostname, os_type, user, process_name, process_path, pid, pid_version, md5, sha1, sha256, sha512, time_range (default '7d'), first_activity_gte/lte, last_activity_gte/lte, and time_window.gte/lte. All are strings.
- Additional JSON Body (op73_body) — Raw JSON object merged with the Body Fields into the request body. Use it for fields not listed above or to override values.
Output shape
The Flight Recorder API response for the process search, normalized into n8n items (typically a list of matching process records).
The exact response fields and any pagination depend on the Threatdown API. The source pack shows only function signatures, so the response handling isn't fully visible. Invalid JSON in Additional JSON Body may cause an error.
Examples
Example 1: Find all runs of a suspicious executable by hash in the last 7 days
Body Fields: sha256 =
Example 2: List processes on a specific host for a custom window
Body Fields: pc_hostname = WS-0142, time_window.gte and time_window.lte set to timestamps; process_name optional.
Example 3: Use a field not exposed in the UI
Set Additional JSON Body to a JSON object with the extra keys; it is merged with Body Fields.