Threatdown (Malwarebytes)Install

Summary

Updates an existing Threatdown (Malwarebytes) policy by ID with a PUT request, sending the supplied body fields and/or custom JSON as the request body.

Inputs

• ID (required) — Path parameter: the ID of the policy to update.
• Body Fields — Collection of optional body fields: name, etag, contents.status, contents.schema_version, contents.policy.protect_service, contents.policy.sirius_update_schedule, contents.policy.startup_options.toggle_on, and endpoint interface options (allow_run_threat_scan, display_rtp_events, limit_endpoint_agent_control, show_threat_scan_shortcuts, show_windows_contextmenu). Each is mapped to its nested JSON path in the request body.
• Additional JSON Body — Raw JSON object merged with the Body Fields values, useful for policy settings not exposed as fields. The source indicates it is parsed and merged with the Body Fields.

Output shape

The API response for the updated policy, normalized into n8n items (typically the policy object returned by the Threatdown API).

The exact response shape depends on the Threatdown API. Boolean fields have a default of false, so only add the fields you intend to change. The source pack is signature-level only, so merge precedence between Body Fields and the JSON body is not confirmed.

Examples

Example 1: Rename a policy and enable the protect service

ID = policy ID; Body Fields: Name = 'Workstations', Contents Policy Protect Service = true.

Example 2: Set an update schedule using the etag from a prior fetch

ID = policy ID; Body Fields: Etag = value from Get Policy, Contents Policy Sirius Update Schedule = desired schedule string.

Example 3: Send a full policy payload built upstream

ID = policy ID; Additional JSON Body = {{ JSON.stringify($json.policyBody) }}.

Links

• n8n community nodes installation guide