The Problem

Security teams need to automate alert triage, IOC enrichment, and case management, but building these integrations from scratch in n8n is time-consuming. This repository provides a set of ready-to-import n8n workflow JSON files for common blue-team tasks, cutting down the setup time for threat intelligence pipelines.

What This Does

The repo is a collection of 11 n8n workflow JSON files organized by function: CTI/ (Slack/Discord alerting, TheHive case creation, IOC normalization), incident-reponse/ (AbuseIPDB reputation checks, Jira ticket creation, HTTP retry logic), malware-analysis/ (VirusTotal hash enrichment), and recon/ (Crt.sh certificate search). Each file is a complete n8n workflow that can be imported directly into an n8n instance.

All workflows use environment variables for API keys ({{ $env.VT_API_KEY }}, {{ $env.ABUSEIPDB_API_KEY }}) rather than hardcoded secrets. The README.md documents the intended usage and lists the workflows in a table with their inputs and outputs.

How It Is Wired

These are static JSON workflow definitions, not a codebase with a call graph. Execution starts when you import a workflow into n8n and trigger it via a webhook, cron schedule, or manual execution. Each JSON file defines a graph of n8n nodes that call external APIs (VirusTotal, AbuseIPDB, Slack, Discord, Jira, TheHive) over HTTP. The workflows are self-contained; there is no shared code or module dependency between them.

Each file is responsible for one automation task: vt_hash_enrichment.json takes a file hash and returns VirusTotal verdicts, abuseipdb_ip_reputation.json checks an IP against AbuseIPDB, jira_incident_from_alert.json creates a Jira issue from an alert payload, and so on. The http_retry_backoff_subflow.json is a reusable sub-workflow for HTTP error handling. The wiring between workflows is not mapped—they are independent.

How To Use It

Setup: Clone the repository and import workflows into n8n v1.40+ (self-hosted, Desktop, or Cloud).

git clone https://github.com/moses-y/n8n-cybersecurity-projects.git

Configuration: Create an .env file with your API keys (VirusTotal, AbuseIPDB, Slack/Discord webhooks, etc.) and reference them in n8n Credentials. The README states to copy .env.example to .env, but the .env.example file is not present in the repo structure—you will need to create it manually.

Running: In the n8n editor, use Workflow → Import from File to load a JSON, create the required credentials, add a trigger node (webhook or cron), and activate the workflow. The README documents these steps.

Real-World Use

A SOC analyst receives an alert containing a suspicious hash. The vt_hash_enrichment.json workflow takes that hash, queries VirusTotal, and posts the verdict to a Slack channel via Slack-Daily-Threat-Digest.json. If the verdict is malicious, thehive_auto_case_from_webhook.json creates a TheHive case for investigation, and jira_incident_from_alert.json opens a Jira ticket for tracking.

Code Health & Issues

Static analysis (not opinion) found the following:

  • Medium - No test files detected - untested workflow logic - repository-wide
  • Medium - No CI/CD pipeline detected - no automated validation of workflow JSON - .github/ or CI config
  • Medium - No LICENSE file - unclear usage rights despite README claiming MIT - root

The README references .env.example and a workflows/ directory, neither of which exists in the file structure—the JSON files sit in category folders at the root. The README also lists a shodan_host_footprint.json workflow that is not present.

The Bottom Line

A practical collection of n8n workflows for common security automation tasks, useful as a starting point for teams already using n8n. The lack of tests, CI, and a license file means you should validate each workflow before production use and clarify licensing with the original author (JoasASantos). Forked from a 383-star upstream repo, so the workflows have community traction, but this fork has no additional changes evident.