Detect and route cybersecurity threats with SIEM, Slack, email and PagerDuty

by Oneclick AI Squad ✓ · 405 views · created 2025-11-07 · SecOps, AI Summarization

What this workflow does

This workflow has 16 nodes and runs on a schedule (every 15 minutes). Along the way it connects Slack and Postgres. It also calls api.threatintel.com and api.pagerduty.com over HTTP.

How it runs

Trigger: On a schedule (every 15 minutes).

1. Fetch Network Logs (HTTP Request): calls an HTTP API (POST)
2. Fetch Vulnerability Scan Results (HTTP Request): calls an HTTP API (POST)
3. Fetch Threat Intelligence Feed (HTTP Request): calls api.threatintel.com
4. Merge: merges the data from its input branches
5. Analyze & Detect Threats (Code): runs custom JavaScript code
6. Check Threat Severity (If): checks a condition and branches into true / false
7. Send Slack Alert - Critical (Slack): uses Slack
8. Send Email: sends an email over SMTP
9. Log Medium/Low Threats (HTTP Request): calls an HTTP API (POST)
10. Create PagerDuty Incident (HTTP Request): calls api.pagerduty.com (POST)

…plus 5 more steps. See the full node list below.

Services it uses

SlackPostgres

HTTP calls to: api.threatintel.com, api.pagerduty.com

Before you upgrade to n8n 3.0

Nodes used (8)

• Schedule Triggern8n-nodes-base.scheduleTrigger
• HTTP Requestn8n-nodes-base.httpRequest
• Mergen8n-nodes-base.merge
• Coden8n-nodes-base.code
• Ifn8n-nodes-base.if
• Slackn8n-nodes-base.slack
• Send Emailn8n-nodes-base.emailSend
• Postgresn8n-nodes-base.postgres

From the author

This n8n workflow proactively scans and aggregates threat intelligence, network logs, and vulnerability data every 15 minutes to detect emerging risks across the infrastructure. It analyzes anomalies, correlates indicators, assigns severity, triggers critical…

View the original on n8n.io → Check your own copy