Suspicious login detection

by n8n Team ✓ · 7,406 views · created 2023-11-27 · SecOps

What this workflow does

This workflow has 33 nodes and runs when an HTTP POST request hits its webhook URL (plus 1 other trigger). Along the way it connects Postgres, Gmail and Slack. It also calls api.userparser.com over HTTP.

How it runs

Trigger: When an HTTP POST request hits its webhook URL (plus 1 other trigger).

1. Extract relevant data (Edit Fields (Set)): sets or maps fields
2. Example event (Code): runs custom JavaScript code
3. GreyNoise (HTTP Request): calls an HTTP API
4. UserParser (HTTP Request): calls api.userparser.com
5. IP API (HTTP Request): calls an HTTP API
6. Complete login info (Merge): merges the data from its input branches
7. noise? (If): checks a condition and branches into true / false
8. Merge: merges the data from its input branches
9. Unknown threat? (If): checks a condition and branches into true / false
10. Check classification (Switch): routes items into 3 branches

…plus 15 more steps. See the full node list below.

Services it uses

PostgresGmailSlack

HTTP calls to: api.userparser.com

Before you upgrade to n8n 3.0

Nodes used (13)

• Edit Fields (Set)n8n-nodes-base.set
• Webhookn8n-nodes-base.webhook
• Ifn8n-nodes-base.if
• Postgresn8n-nodes-base.postgres
• HTTP Requestn8n-nodes-base.httpRequest
• Mergen8n-nodes-base.merge
• No Operation, do nothingn8n-nodes-base.noOp
• HTMLn8n-nodes-base.html
• Gmailn8n-nodes-base.gmail
• Slackn8n-nodes-base.slack
• Switchn8n-nodes-base.switch
• Manual Triggern8n-nodes-base.manualTrigger
• Coden8n-nodes-base.code

From the author

This n8n workflow is designed for security monitoring and incident response when suspicious login events are detected. It can be initiated either manually from within the n8n UI for testing or automatically triggered by a webhook when a new login event…

View the original on n8n.io → Check your own copy