225 workflows, ready to run.
Community-built n8n automations, searchable live from the template library. Open one on n8n.io and import the JSON straight into your instance.
New TheHive Case Slack Notification BotStreamline Case Management in TheHive via Slack!
Our TheHive Slack Integration empowers SOC analysts by allowing them to efficiently manage and update case attributes directly wit…HTTP Request · Slack · TheHive 5510 views
↗Save Qualys Reports to TheHiveAutomate Report Generation with n8n & Qualys Introducing the Save Qualys Reports to TheHive Workflow—a robust solution designed to automate the retrieval and storage of Qualys rep…HTTP Request · TheHive 5971 views
↗Qualys Scan Slack Report SubworkflowIntroducing the Qualys Scan Slack Report Subworkflow—a robust solution designed to automate the generation and retrieval of security reports from the Qualys API. This workflow is …HTTP Request · Slack1.1k views
↗Qualys Vulnerability Trigger Scan SubWorkflowThis workflow is triggered by a parent workflow initiated via a Slack shortcut. Upon activation, it collects input from a modal window in Slack and initiates a vulnerability scan u…HTTP Request · Slack2.4k views
↗Enhance Security Operations with the Qualys Slack Shortcut Bot!Enhance Security Operations with the Qualys Slack Shortcut Bot! Our Qualys Slack Shortcut Bot is strategically designed to facilitate immediate security operations directly from S…HTTP Request1.1k views
↗Venafi Cloud Slack Cert BotEnhance Security Operations with the Venafi Slack CertBot! Venafi Presentation - Watch Video Our Venafi Slack CertBot is strategically designed to facilitate immediate security …HTTP Request · Slack · Venafi TLS Protect Cloud · OpenAI944 views
↗Validate TOTP Token (without creating a credential)TOTP Validation with Function Node This template allows you to verify if a 6-digit TOTP code is valid using the corresponding TOTP secret. It can be used in an authentication syst…Code508 views
↗Parse DMARC reports, save them in database and notify on DKIM or SPF errorWho is it for If you are a postmaster or you manage email server, you can set up DKIM and SPF records to ensure that spoofing your email address is hard. On your domain you can als…Send Email · Slack · MySQL · Compression2.4k views
↗Slack Webhook - Verify SignatureDescription This template will help you verify that incoming calls from a Slack webhook actually come from Slack and not some unknown third-party services. It is mainly used to pr…Crypto · Code1.6k views
↗Suspicious Login DetectionThis n8n workflow is designed for security monitoring and incident response when suspicious login events are detected. It can be initiated either manually from within the n8n UI fo…HTTP Request · Postgres · Slack · Gmail · Code6.4k views
↗Analyze Email Headers for IPs and SpoofingThis n8n workflow is designed to analyze email headers received via a webhook. The workflow splits into two main paths based on the presence of the received and authentication resu…HTTP Request · Code4.7k views
↗Weekly Shodan Query - Report AccidentsThis n8n workflow, which runs every Monday at 5:00 AM, initiates a comprehensive process to monitor and analyze network security by scrutinizing IP addresses and their associated p…HTTP Request · TheHive · HTML5.4k views
↗Receive and analyze emails with rules in Sublime SecurityThis n8n workflow provides a comprehensive automation solution for processing email attachments, specifically targeting enhanced security protocols for organizations that use platf…HTTP Request · Slack · Code2k views
↗Notify User in Slack of Quarantined Email and Create Jira Ticket if OpenedThis n8n workflow serves as an incident response and notification system for handling potentially malicious emails flagged by Sublime Security. It begins with a Webhook trigger tha…HTTP Request · Slack · Jira Software · Code1.8k views
↗Monitor Security AdvisoriesThis n8n workflow automates the monitoring and notification of Palo Alto Networks security advisories. It is triggered manually from within the n8n UI or scheduled to run daily at …Jira Software · Gmail · Customer Datastore (n8n training)5.6k views
↗Analyze CrowdStrike Detections - Search for IOCs in VirusTotal - Create a Ticket in Jira, and Post a Message in SlackThis n8n workflow automates the handling of security detections from CrowdStrike, streamlining incident response and notification processes. The workflow is triggered daily at midn…HTTP Request · Slack · Jira Software4.2k views
↗URL and IP lookups through Greynoise and VirusTotalThis n8n workflow serves as a powerful cybersecurity and threat intelligence tool to look up URLs or IP addresses through industry standard threat intelligence vendors. It starts w…HTTP Request · Slack · Gmail · Code8.6k views
↗Send TheHive Alerts Using SIGNL4This sample workflow allows you to forward alerts from TheHive 5 to SIGNL4 in order to send reliable alerts to your team. There are two nodes for testing the TheHive connection ("…SIGNL4 · TheHive897 views
↗
↗Save Qualys Reports to TheHiveAutomate Report Generation with n8n & Qualys Introducing the Save Qualys Reports to TheHive Workflow—a robust solution designed to automate the retrieval and storage of Qualys rep…HTTP Request · TheHive 5971 views
↗Qualys Scan Slack Report SubworkflowIntroducing the Qualys Scan Slack Report Subworkflow—a robust solution designed to automate the generation and retrieval of security reports from the Qualys API. This workflow is …HTTP Request · Slack1.1k views
↗Qualys Vulnerability Trigger Scan SubWorkflowThis workflow is triggered by a parent workflow initiated via a Slack shortcut. Upon activation, it collects input from a modal window in Slack and initiates a vulnerability scan u…HTTP Request · Slack2.4k views
↗Enhance Security Operations with the Qualys Slack Shortcut Bot!Enhance Security Operations with the Qualys Slack Shortcut Bot! Our Qualys Slack Shortcut Bot is strategically designed to facilitate immediate security operations directly from S…HTTP Request1.1k views
↗Venafi Cloud Slack Cert BotEnhance Security Operations with the Venafi Slack CertBot! Venafi Presentation - Watch Video Our Venafi Slack CertBot is strategically designed to facilitate immediate security …HTTP Request · Slack · Venafi TLS Protect Cloud · OpenAI944 views
↗Validate TOTP Token (without creating a credential)TOTP Validation with Function Node This template allows you to verify if a 6-digit TOTP code is valid using the corresponding TOTP secret. It can be used in an authentication syst…Code508 views
↗Parse DMARC reports, save them in database and notify on DKIM or SPF errorWho is it for If you are a postmaster or you manage email server, you can set up DKIM and SPF records to ensure that spoofing your email address is hard. On your domain you can als…Send Email · Slack · MySQL · Compression2.4k views
↗Slack Webhook - Verify SignatureDescription This template will help you verify that incoming calls from a Slack webhook actually come from Slack and not some unknown third-party services. It is mainly used to pr…Crypto · Code1.6k views
↗Suspicious Login DetectionThis n8n workflow is designed for security monitoring and incident response when suspicious login events are detected. It can be initiated either manually from within the n8n UI fo…HTTP Request · Postgres · Slack · Gmail · Code6.4k views
↗Analyze Email Headers for IPs and SpoofingThis n8n workflow is designed to analyze email headers received via a webhook. The workflow splits into two main paths based on the presence of the received and authentication resu…HTTP Request · Code4.7k views
↗Weekly Shodan Query - Report AccidentsThis n8n workflow, which runs every Monday at 5:00 AM, initiates a comprehensive process to monitor and analyze network security by scrutinizing IP addresses and their associated p…HTTP Request · TheHive · HTML5.4k views
↗Receive and analyze emails with rules in Sublime SecurityThis n8n workflow provides a comprehensive automation solution for processing email attachments, specifically targeting enhanced security protocols for organizations that use platf…HTTP Request · Slack · Code2k views
↗Notify User in Slack of Quarantined Email and Create Jira Ticket if OpenedThis n8n workflow serves as an incident response and notification system for handling potentially malicious emails flagged by Sublime Security. It begins with a Webhook trigger tha…HTTP Request · Slack · Jira Software · Code1.8k views
↗Monitor Security AdvisoriesThis n8n workflow automates the monitoring and notification of Palo Alto Networks security advisories. It is triggered manually from within the n8n UI or scheduled to run daily at …Jira Software · Gmail · Customer Datastore (n8n training)5.6k views
↗Analyze CrowdStrike Detections - Search for IOCs in VirusTotal - Create a Ticket in Jira, and Post a Message in SlackThis n8n workflow automates the handling of security detections from CrowdStrike, streamlining incident response and notification processes. The workflow is triggered daily at midn…HTTP Request · Slack · Jira Software4.2k views
↗URL and IP lookups through Greynoise and VirusTotalThis n8n workflow serves as a powerful cybersecurity and threat intelligence tool to look up URLs or IP addresses through industry standard threat intelligence vendors. It starts w…HTTP Request · Slack · Gmail · Code8.6k views
↗Send TheHive Alerts Using SIGNL4This sample workflow allows you to forward alerts from TheHive 5 to SIGNL4 in order to send reliable alerts to your team. There are two nodes for testing the TheHive connection ("…SIGNL4 · TheHive897 views
↗