Threatdown (Malwarebytes)Install

Summary

Searches Threatdown (Malwarebytes) Flight Recorder for suspicious activity by sending a POST to the Flight Recorder recap endpoint with a time range or explicit time window.

Inputs

• Body Fields > Time Range — Relative lookback period sent as time_range in the request body. Defaults to 7d.
• Body Fields > Time Window Gte — Start of an explicit time window, sent as time_window.gte.
• Body Fields > Time Window Lte — End of an explicit time window, sent as time_window.lte.
• Additional JSON Body — Extra request body values as a JSON object. They are merged with the Body Fields, and the source suggests the JSON values take precedence on conflicts.

Output shape

The API response from the Flight Recorder recap endpoint, normalized into n8n items. It is likely one item per result or one item holding the response object.

The source pack shows only function signatures, so the exact response fields and normalization details are not visible. The properties' displayOptions reference the operation value postFlightRecorderRecap. Authentication uses the node's Threatdown credentials.

Examples

Example 1: Review suspicious activity from the last 24 hours.

Set Body Fields > Time Range to 24h and leave the other fields empty.

Example 2: Investigate a specific incident window.

Set Time Window Gte and Time Window Lte to the start and end timestamps. Clear Time Range, or override it, if the API rejects both together.

Example 3: Send additional API parameters not exposed in the UI.

Put the extra parameters in Additional JSON Body, for example {"time_range":"30d"}.

Links

• n8n community nodes installation guide