Actions181
- Account Actions
- Accounts Actions
- App Block Actions
- Assets Actions
- Content Filtering Actions
- Create Content Filtering Rule
- Create Update DNS Settings
- Delete Content Filtering Rule
- Enable Disable Content Filtering Rule
- Enable Disable Content Filtering Rule For Policy
- Get A Content Filtering Rule Details
- Get A List Of Content Filtering Rules
- Get DNS Settings
- Get Domain Details
- Get Frequently Used Domain Names
- Get List Of Policies
- Update Content Filtering Rule
- CVE Actions
- Detections Actions
- Device Control Actions
- DNS Actions
- Endpoints Actions
- All Suspicious Activity Of An Endpoint
- Close Suspicious Activity Of An Endpoint
- Delete A Machine
- Delete Multiple Machines
- Endpoint Status
- Export Endpoints
- Get A Scan Of An Endpoint
- Get Endpoint
- Get Endpoint Agent Info
- Get Endpoint Assets
- Get Quarantined Items
- Get Scans Of An Endpoint
- Get The Detections Of A Scan
- Network Information
- Open Suspicious Activity Of An Endpoint
- Remediate Suspicious Activity Of An Endpoint
- Search Endpoints
- Search Grouped Endpoints
- Set Endpoint Tags
- Specific Suspicious Activity Of An Endpoint
- Events Actions
- Exclusions Actions
- Flight Recorder Actions
- Grid Actions
- Export CVEs
- Export Detections
- Export Device Control Events
- Export DNS Activity
- Export Endpoints
- Export Events
- Export OS Patches
- Export RID Rules
- Export Software Assets
- Search CVEs
- Search Detections
- Search Device Control Events
- Search DNS Activity
- Search Endpoints
- Search Events
- Search Events Groupby
- Search Grouped CVEs
- Search Grouped Detections
- Search Grouped Device Control Events
- Search Grouped DNS Activity
- Search Grouped Endpoints
- Search Grouped OS Patches
- Search Grouped RID Rules
- Search Grouped Software Assets
- Search OS Patches
- Search RID Rules
- Search Software Assets
- Groups Actions
- Installation Token Actions
- Installers Actions
- Jobs Actions
- Notifications Actions
- OS Patches Actions
- Policies Actions
- Products Actions
- Quarantine Actions
- Reports Actions
- RID Actions
- SA Actions
- Schedules Actions
- Usage Actions
- Users Actions
- Webhooks Actions
Flight Recorder → Search Occurrence Of Suspicious Activity
AI-generatedSummary
Sends a POST request to the Threatdown (Malwarebytes) Flight Recorder chart endpoint to search for occurrences of suspicious activity over a time range. The request body is built from the Body Fields collection and an optional JSON body.
Inputs
- Body Fields — Collection of optional request body fields: Time Range (sent as time_range, default "7d"), Time Window Gte (time_window.gte) and Time Window Lte (time_window.lte) for an explicit start and end of the search window.
- Additional JSON Body — Extra request body values as a JSON object. They are merged with the Body Fields values. Use this for any other API body parameters, such as search criteria. The source helpers suggest that values from this JSON override Body Fields on conflict, but the source pack doesn't show the exact precedence.
Output shape
The API response from the Flight Recorder chart endpoint, normalized into n8n items. Its exact structure depends on the Malwarebytes API.
The source pack shows only function signatures, not bodies. The exact endpoint path, response shape and error handling are therefore not confirmed here. Authentication uses the node's configured credentials.
Examples
Example 1: Look at suspicious activity over the past 24 hours.
Body Fields: Time Range = "24d" changed to "1d"; leave Additional JSON Body empty.
Example 2: Search a fixed window with extra criteria.
Body Fields: Time Window Gte and Time Window Lte set to start and end timestamps; Additional JSON Body holds any extra query fields as JSON.