Actions181
- Account Actions
- Accounts Actions
- App Block Actions
- Assets Actions
- Content Filtering Actions
- Create Content Filtering Rule
- Create Update DNS Settings
- Delete Content Filtering Rule
- Enable Disable Content Filtering Rule
- Enable Disable Content Filtering Rule For Policy
- Get A Content Filtering Rule Details
- Get A List Of Content Filtering Rules
- Get DNS Settings
- Get Domain Details
- Get Frequently Used Domain Names
- Get List Of Policies
- Update Content Filtering Rule
- CVE Actions
- Detections Actions
- Device Control Actions
- DNS Actions
- Endpoints Actions
- All Suspicious Activity Of An Endpoint
- Close Suspicious Activity Of An Endpoint
- Delete A Machine
- Delete Multiple Machines
- Endpoint Status
- Export Endpoints
- Get A Scan Of An Endpoint
- Get Endpoint
- Get Endpoint Agent Info
- Get Endpoint Assets
- Get Quarantined Items
- Get Scans Of An Endpoint
- Get The Detections Of A Scan
- Network Information
- Open Suspicious Activity Of An Endpoint
- Remediate Suspicious Activity Of An Endpoint
- Search Endpoints
- Search Grouped Endpoints
- Set Endpoint Tags
- Specific Suspicious Activity Of An Endpoint
- Events Actions
- Exclusions Actions
- Flight Recorder Actions
- Grid Actions
- Export CVEs
- Export Detections
- Export Device Control Events
- Export DNS Activity
- Export Endpoints
- Export Events
- Export OS Patches
- Export RID Rules
- Export Software Assets
- Search CVEs
- Search Detections
- Search Device Control Events
- Search DNS Activity
- Search Endpoints
- Search Events
- Search Events Groupby
- Search Grouped CVEs
- Search Grouped Detections
- Search Grouped Device Control Events
- Search Grouped DNS Activity
- Search Grouped Endpoints
- Search Grouped OS Patches
- Search Grouped RID Rules
- Search Grouped Software Assets
- Search OS Patches
- Search RID Rules
- Search Software Assets
- Groups Actions
- Installation Token Actions
- Installers Actions
- Jobs Actions
- Notifications Actions
- OS Patches Actions
- Policies Actions
- Products Actions
- Quarantine Actions
- Reports Actions
- RID Actions
- SA Actions
- Schedules Actions
- Usage Actions
- Users Actions
- Webhooks Actions
Flight Recorder → Search The Process Graph
AI-generatedSummary
Sends a POST request to the Threatdown (Malwarebytes) Flight Recorder process graph endpoint to search the process graph for a given process on an endpoint within a time window.
Inputs
- Body Fields — Collection of optional request body fields: Account ID (account_id), Machine ID (machine_id), OS Type (os_type, default Windows), Path (path), Pid (pid), Pid Version (pid_version, number, default 0), Time Range (time_range, default 7d), Time Window Gte (time_window.gte) and Time Window Lte (time_window.lte) for an explicit start/end of the window.
- Additional JSON Body — Raw JSON object merged with the Body Fields values to supply extra or overriding request body properties.
Output shape
The API response for the process graph search, normalized into n8n items (likely one or more items of JSON data).
The exact response schema is not shown in the provided source; it depends on the Threatdown API. No field is marked required in the UI, so the API may reject requests lacking identifiers such as machine_id or pid.
Examples
Example 1: Trace a suspicious process on a specific machine over the last 7 days
Body Fields: Machine ID, Pid, Pid Version, Path, OS Type=Windows, Time Range=7d.
Example 2: Search the process graph within a fixed incident window
Body Fields: Account ID, Machine ID, Pid, Time Window Gte and Time Window Lte set to ISO timestamps.
Example 3: Supply the full request from a previous node
Additional JSON Body set to an expression such as {{ JSON.stringify($json) }} with fields like machine_id and pid.