š SecOps & Security Automation
277 templates ā š Security operations, threat detection, vulnerability scanning, compliance monitoring, and incident response.
š Templates
| Template | Description | š Key Nodes | š Views |
|---|---|---|---|
| š Phishing analysis - URLScan.io and VirusTotal | This n8n workflow automates the analysis of email messages received in a Microsoft Outlook inbox to identify indicators of compromise (IOCs), specifically suspicious URLs. It can be triggered manuaā¦ | HTTP Request, Slack, Microsoft Outlook, urlscan.io, Filter | 81,390 |
| š„ WebSecScan: AI-powered website security auditor | This n8n workflow provides comprehensive website security analysis by leveraging OpenAIās models to detect vulnerabilities, configuration issues, and security misconfigurations. The workflow generaā¦ | HTTP Request, Gmail, AI Agent, OpenAI Chat Model, n8n Form Trigger | 36,177 |
| š„ Analyze email headers for IP reputation and spoofing detection - Gmail | This workflow is ideal for IT professionals, security analysts, and organizations looking to enhance their email security practices. It is particularly useful for those who need to analyze Gmail emā¦ | HTTP Request, Webhook, Gmail Trigger | 27,911 |
| š„ Intelligent AI digest for security, privacy, and compliance feeds | How it works | RSS Read, Gmail, Schedule Trigger, Filter, AI Agent, Google Gemini Chat Model | 27,892 |
| Weekly Shodan query - report accidents | This n8n workflow, which runs every Monday at 5:00 AM, initiates a comprehensive process to monitor and analyze network security by scrutinizing IP addresses and their associated ports. It begins bā¦ | HTTP Request, TheHive, Markdown, Schedule Trigger, Filter | 19,267 |
| Website scam risk detector with GPT-4o and SerpAPI | This intelligent workflow simplifies the complex task of determining whether a website is legitimate or potentially a scam. | AI Agent, OpenAI Chat Model, SerpApi (Google Search), n8n Form Trigger | 18,081 |
| Ssl expiry alert with SSL-Checker.io | Managing SSL certificates manually can be time-consuming and error-prone, often leading to unexpected downtime or security risks due to expired certificates. | Google Sheets, HTTP Request, Gmail, Schedule Trigger | 17,097 |
| Automate SIEM alert enrichment with MITRE ATT&CK, Qdrant & Zendesk in n8n | This workflow is ideal for: | Google Drive, Zendesk, AI Agent, Embeddings OpenAI, OpenAI Chat Model, Simple Memory | 14,750 |
| Monitor data breaches in real-time with Have I Been Pwned | HTTP Request, Schedule Trigger, Read/Write Files from Disk, Convert to File, Extract from File | 12,506 | |
| Comprehensive SSL certificate monitoring with Discord alerts and Notion integration | !Screenshot 20250704 at 18.13.54.png | HTTP Request, Discord, Notion, SSH, Schedule Trigger | 12,247 |
| Automated URL phishing & threat analysis with NixGuard AI | Stop manually checking suspicious links. This free n8n workflow provides the foundation for a powerful, automated URL analysis pipeline. Using the NixGuard AI engine, you can instantly analyze suspā¦ | Slack, Webhook, Execute Sub-workflow | 11,659 |
| URL and IP lookups through Greynoise and VirusTotal | This n8n workflow serves as a powerful cybersecurity and threat intelligence tool to look up URLs or IP addresses through industry standard threat intelligence vendors. It starts with either a formā¦ | HTTP Request, Slack, Webhook, Gmail, Filter, n8n Form Trigger | 9,972 |
| Analyze & sort suspicious email contents with ChatGPT | This workflow is tailored for IT security teams, managed service providers (MSPs), and organizations aiming to streamline the detection and reporting of phishing emails. Itās especially useful for ā¦ | HTTP Request, Jira Software, Gmail Trigger, Convert to File, Microsoft Outlook Trigger, OpenAI | 9,311 |
| Suspicious login detection | This n8n workflow is designed for security monitoring and incident response when suspicious login events are detected. It can be initiated either manually from within the n8n UI for testing or autoā¦ | HTTP Request, Postgres, Slack, Webhook, Gmail | 7,411 |
| Analyze emails with S1EM | With workflow, you analyze Email with TheHive/Cortex | Email Trigger (IMAP), Start, Cortex, TheHive | 7,377 |
| Monitor security advisories | This n8n workflow automates the monitoring and notification of Palo Alto Networks security advisories. It is triggered manually from within the n8n UI or scheduled to run daily at midnight using thā¦ | RSS Read, Jira Software, Gmail, Customer Datastore (n8n training), Schedule Trigger, Filter | 6,879 |
| Analyze CrowdStrike detections - Search for IOCs in VirusTotal - Create a ticket in Jira, and post a message in Slack | This n8n workflow automates the handling of security detections from CrowdStrike, streamlining incident response and notification processes. The workflow is triggered daily at midnight by the Schedā¦ | HTTP Request, Slack, Jira Software | 6,194 |
| š² Creating a Secure Webhook - MUST HAVE | This workflow demonstrates a fundamental pattern for securing a webhook by requiring an API key. It acts as a gatekeeper, checking for a valid key in the request header before allowing the request ā¦ | HTTP Request, Webhook, Filter | 6,046 |
| Analyze email headers for IP reputation and spoofing detection - Outlook | This workflow is ideal for security teams, IT Ops professionals, and managed service providers (MSPs) responsible for monitoring and validating email traffic. Itās especially useful for organizatioā¦ | HTTP Request, Webhook, Microsoft Outlook Trigger | 5,653 |
| Analyze email headers for IPs and spoofing | This n8n workflow is designed to analyze email headers received via a webhook. The workflow splits into two main paths based on the presence of the received and authentication results headers. | HTTP Request, Webhook | 5,174 |
| Ssl certificate expiry notifier (no paid APIs) | Great ā hereās a complete Workflow Description for your n8n Creator submission based on the JSON you shared: | Send Email, Google Sheets, HTTP Request, Schedule Trigger | 5,157 |
| Network vulnerability scanner with NMAP and automated CVE reporting | This n8n workflow provides comprehensive network vulnerability scanning with automated CVE enrichment and professional report generation. It performs Nmap scans, queries the National Vulnerability ā¦ | Send Email, Webhook, Telegram, Schedule Trigger, n8n Form Trigger, Read/Write Files from Disk | 4,847 |
| Analyze suspicious email contents with ChatGPT Vision | This workflow is designed for IT teams, security professionals, and managed service providers (MSPs) looking to automate the process of detecting, analyzing, and reporting phishing emails. | HTTP Request, Jira Software, Gmail Trigger, Microsoft Outlook Trigger, OpenAI | 4,826 |
| Create executive security briefings with NixGuard AI & Wazuh alerts | Drowning in security alerts? Spending hours translating technical logs from Wazuh, your SIEM, or other tools into business-friendly reports for leadership? This n8n workflow is your automated Securā¦ | Send Email, Execute Sub-workflow, Schedule Trigger | 4,557 |
| Track CVE vulnerability details & history with NVD API and Google Sheets | NVD (National Vulnerability Database) data is essential for security analysts, vulnerability managers, and DevSecOps professionals who need to perform both CVE lookups and monitor historical changeā¦ | Google Sheets, HTTP Request, Webhook | 4,394 |
| Get real-time security insights with NixGuard RAG and Wazuh integration | Effortlessly integrate NixGuard API into your n8n workflows for real-time security insights using your API key. This connector enables seamless interaction with Nix, providing rapid Retrieval-Augmeā¦ | HTTP Request, Execute Workflow Trigger, Chat Trigger | 3,937 |
| Parse DMARC reports, save them in database and notify on DKIM or SPF error | If you are a postmaster or you manage email server, you can set up DKIM and SPF records to ensure that spoofing your email address is hard. On your domain you can also set up DMARC record to receivā¦ | Email Trigger (IMAP), Send Email, Rename Keys, Slack, MySQL, Extract from File | 3,706 |
| Malicious file detection & response: Wazuh to VirusTotal with Slack alerts | This workflow helps SOC teams automate the detection and reporting of potentially malicious files using Wazuh alerts, VirusTotal hash validation, and integrated summary/report generation. Itās ideaā¦ | HTTP Request, Slack, Webhook, Gmail, ServiceNow | 3,310 |
| Monitor SSL certificate of any domain with uProc | Do you want to check the SSL certificate expiration dates of your customers or servers? | Function Item, Start, Telegram, uProc | 3,135 |
| Qualys vulnerability trigger scan subWorkflow | - Trigger: Launched by a parent workflow through a Slack shortcut with modal input. | HTTP Request, Slack, Execute Workflow Trigger | 3,000 |
| MFA multi-factor authentication (Voice call and Email) with ClickSend and SMTP | This workflow automates the process of sending voice calls for verification purposes and combines it with email verification. It uses the ClickSend API for voice calls and integrates with SMTP for ā¦ | Send Email, HTTP Request, n8n Form Trigger, n8n Form | 2,960 |
| Automate Wazuh alert triage and reporting with GPT-4o-mini and Telegram | This n8n workflow supercharges your SOC by fully automating triage, analysis, and notification for Wazuh alertsāblending event-driven automation, OpenAI-powered contextual analysis, and real-time cā¦ | Webhook, Telegram, Summarization Chain, OpenAI Chat Model | 2,817 |
| Subdomain enumeration with Subfinder, HTTPX & GPT-4-Mini for security reconnaissance | Generates a wordlist of 1,000ā15,000 subdomains created by an AI agent by correlating detected technologies and recurring patterns. | HTTP Request, Webhook, SSH, Convert to File, Extract from File, Summarize | 2,804 |
| Audit Google Drive file permissions for access control management | File Sharing Permissions are routinely abused when access needs and scopes expand to many colleagues, clients and users. Often, granting excessively open permissions means you can get back to work ā¦ | Google Sheets, Google Drive, Gmail, Schedule Trigger, Filter | 2,739 |
| Filter cybersecurity news for your tech stack (OpenAI + Pinecone RAG) | Collects cybersecurity news from trusted RSS feeds and uses OpenAIās Retrieval-Augmented Generation (RAG) capabilities with Pinecone to filter for content that is directly relevant to your organizaā¦ | RSS Read, Gmail, Schedule Trigger, AI Agent, Embeddings OpenAI, OpenAI Chat Model | 2,737 |
| AI privacy-minded router: PII detection for privacy, security, & compliance | Organizations need AI capabilities while ensuring: | AI Agent, Ollama Chat Model, Simple Memory, Chat Trigger, OpenRouter Chat Model | 2,652 |
| AI-powered vulnerability scanner with Nessus, risk triage & Google Sheets reporting | Security teams, DevOps engineers, vulnerability analysts, and automation builders who want to eliminate repetitive Nessus scan parsing, AI-based risk triage, and manual reporting. Designed for orgsā¦ | Send Email, Function, Google Sheets, HTTP Request, Schedule Trigger | 2,570 |
| IP reputation check & SOC alerts with Splunk, VirusTotal and AlienVault | This workflow automates IP reputation analysis using Splunk alerts, enriches data via VirusTotal and AlienVault OTX, and generates actionable threat summaries for SOC teams ā all without any coding. | HTTP Request, Slack, Webhook, Gmail, ServiceNow | 2,512 |
| Monitor software compliance with Jamf patch summaries in Slack | š§© Jamf Patch Summary to Slack | HTTP Request, Slack, Filter | 2,429 |
| Receive and analyze emails with rules in Sublime Security | This n8n workflow provides a comprehensive automation solution for processing email attachments, specifically targeting enhanced security protocols for organizations that use platforms like Outlookā¦ | Email Trigger (IMAP), HTTP Request, Slack, Convert to/from binary data | 2,369 |
| Automate free IP analysis: NixGuard AI summaries & Wazuh integration | Stop wasting time manually investigating suspicious IP addresses. This workflow template is your launchpad to automating real-time IP cybersecurity analysis using the NixGuard platform, which you cā¦ | Slack, Webhook, Execute Sub-workflow | 2,342 |
| Automated CVE scanning of Bug Bounty programs with Nuclei and Project Discovery | Automates daily CVE-driven scanning against bug bounty scopes. It fetches bug-bounty domains, pulls newly published Project Discovery templates, converts them to Nuclei rules, runs targeted scans, ā¦ | HTTP Request, Gmail, SSH, Schedule Trigger, Filter, Convert to File | 2,314 |
| Cybersecurity assistant with GPT-4, Telegram bot & command execution | QuantumDefender AI is a next-generation intelligent cybersecurity assistant designed to harness the symbolic strength of quantum computingās promise alongside cutting-edge AI capabilities. This sopā¦ | Telegram, Telegram Trigger, AI Agent, OpenAI Chat Model, Simple Memory, Calculator | 2,301 |
| AI-Powered Vendor Policy & RSS Feed Analysis with Integrated Risk Scoring | A dual-engine, AI-driven n8n workflow that automates the monitoring of both vendor policy webpages and compliance-related RSS feeds. It intelligently detects recent updates, evaluates their potentiā¦ | HTTP Request, RSS Read, Gmail, Schedule Trigger, Filter, AI Agent | 2,270 |
| Monitor SSL certificate expiry with Google Sheets and multi-channel alert | This workflow is ideal for administrators or IT professionals responsible for monitoring SSL certificates of multiple websites to ensure they do not expire unexpectedly. | Google Sheets, HTTP Request, Telegram, Gmail, Schedule Trigger | 2,215 |
| Slack webhook - verify signature | This template will help you verify that incoming calls from a Slack webhook actually come from Slack and not some unknown third-party services. | Stop and Error, Execute Workflow Trigger | 2,141 |
| Generate, retrieve and download a report using the SecurityScorecard | This workflow allows you to generate, retrieve and download a report using the SecurityScorecard node. | Start, SecurityScorecard | 2,135 |
| Encrypt some data using the crypto node | Companion workflow for Crypto node docs | Start | 2,091 |
| Create, update and get a case in TheHive | !workflow-screenshot | Start, TheHive | 2,082 |
| Notify user in Slack of quarantined email and create Jira ticket if opened | This n8n workflow serves as an incident response and notification system for handling potentially malicious emails flagged by Sublime Security. It begins with a Webhook trigger that Sublime Securitā¦ | HTTP Request, Slack, Webhook, Jira Software | 2,059 |
| Automated SSL Certificate Monitoring and Renewal with Notion and Telegram | Automatically fetch existing domains from Notionās Database and verify the validity of SSL certificates through SSL-Checker. If the validity period is less than 14 days, send a Telegram message notā¦ | HTTP Request, Telegram, Execute Sub-workflow, Notion, SSH, Execute Workflow Trigger | 1,905 |
| Automate security alert triage with NixGuard AI and route to Slack or Jira | Are you drowning in a sea of security notifications? Do your analysts spend more time sifting through low-level logs than investigating real threats? This workflow transforms n8n into an autonomousā¦ | Slack, Execute Sub-workflow, Schedule Trigger | 1,816 |
| Report phishing websites to Steam and CloudFlare | Webhook to report through Mailgun phishing websites to Steam and CloudFlare (if the domain is on CloudFlare) | Mailgun, Start, Webhook | 1,786 |
| AI-powered domain & IP security check automation | !AI5.png!AI4.png | Google Sheets, HTTP Request, Schedule Trigger, AI Agent, Simple Memory, OpenRouter Chat Model | 1,737 |
| Complete guide to setting up and generating TOTP codes in n8n š | 1. Receive the QR Code from the 2FA service | TOTP | 1,555 |
| Scan single URLs for security vulnerabilities with GPT-4 (JS, PHP, Python) | This workflow automates static security analysis for JavaScript, PHP, and Python codebases. | Google Drive, Filter, AI Agent, OpenAI Chat Model, n8n Form Trigger | 1,491 |
| Scan URLs for security threats with urlscan.io and GPT-4o mini | ā¢ Webhook ā urlscan.io ā GPT-4o mini ā Gmail | Webhook, Gmail, urlscan.io, OpenAI | 1,454 |
| Automated GitHub scanner for exposed AWS IAM keys | This n8n workflow automatically scans GitHub for exposed AWS IAM access keys associated with your AWS account, helping security teams quickly identify and respond to potential security breaches. Whā¦ | HTTP Request, Slack | 1,405 |
| Monitor new CVEs for bug bounty hunting with Gemini AI and Slack alerts | Automatically monitors NISTās CVE database every hour for new vulnerabilities and uses AI to assess their relevance for bug bounty hunting, delivering actionable intelligence directly to Slack. | HTTP Request, Slack, Schedule Trigger, AI Agent, Google Gemini Chat Model | 1,393 |
| Automate AI vulnerability monitoring with GPT-4 and ServiceNow incident creation | This n8n workflow automatically monitors RSS feeds for the latest AI vulnerability news, extracts key threat details, and creates a corresponding Security Incident in ServiceNow for each item. | RSS Read, ServiceNow, Schedule Trigger, OpenAI Chat Model, Information Extractor, Jina AI | 1,389 |
| Enhance security operations with the Qualys Slack shortcut bot! | !n8n | HTTP Request, Webhook, Execute Sub-workflow | 1,355 |
| Automate CVE monitoring with OpenAI processing for ServiceNow security incidents | This n8n workflow automatically fetches the latest CVE data at scheduled intervals, extracts relevant security details, and creates a corresponding Security Incident in ServiceNow for each new vulnā¦ | HTTP Request, ServiceNow, Schedule Trigger, OpenAI Chat Model, Information Extractor | 1,288 |
| Prevent prompt injection attacks with a GPT-4O security defense system | Protect your AI workflows from prompt injection attacks, XSS attempts, and malicious content with this multi-layer security sanitization system. | Send Email, Webhook, OpenAI | 1,250 |
| Qualys scan Slack report subworkflow | This workflow is a sub workflow of the Qualys Slack Shortcut Bot workflow. It is triggered when someone fills out the modal popup in slack generated by the Qualys Slack Shortcut Bot. | HTTP Request, Slack, Execute Workflow Trigger | 1,244 |
| Automated security alert analysis with Sophos, Gemini AI, and VirusTotal | This workflow automates the analysis of security alerts from Sophos Central, turning raw events into actionable intelligence. It uses the official Sophos SIEM integration tool to fetch data, enrichā¦ | HTTP Request, Webhook, Telegram, AI Agent, Simple Memory, Google Gemini Chat Model | 1,235 |
| Save Qualys reports to TheHive | !n8n | HTTP Request, Execute Sub-workflow, n8n, Schedule Trigger, Filter, TheHive 5 | 1,231 |
| Detect multi-source transaction fraud and reconcile finances with OpenAI, Nvidia NIM, Gmail, Slack and Google Sheets | This workflow automates financial transaction surveillance by monitoring multiple payment systems, analyzing transaction patterns with AI, and triggering instant fraud alerts. Designed for finance ā¦ | HTTP Request, Postgres, Slack, Webhook, Gmail, Schedule Trigger | 1,215 |
| Manage group members in Bitwarden automatically | This workflow allows you to create a group, add members to the group, and get the members of the group. | Bitwarden | 1,207 |
| Automated lead generation & qualification with Google Maps, GPT-4 & HubSpot | This n8n workflow automates end-to-end lead generation, from scraping local businesses to qualifying and sending high-quality prospects directly into your CRM. | Google Sheets, HTTP Request, Slack, HubSpot, OpenAI | 1,183 |
| Venafi Cloud Slack cert bot | Venafi Presentation - Watch Video | HTTP Request, Slack, Webhook, Execute Sub-workflow, Venafi TLS Protect Cloud, OpenAI | 1,136 |
| Monitor authentication IPs from SaaS alerts & email reports via SMTP2Go | This n8n workflow automates the process of collecting sign-in IP addresses from SaaS Alerts over the past 24 hours and emailing the results using SMTP2Go. Designed for security teams, IT administraā¦ | HTTP Request, Convert to/from binary data, n8n Form Trigger, Convert to File | 1,123 |
| Auto remediate endpoint infections with Wazuh, ClamAV, and GPT-4 | Reduce human delays between malware detection and remediation in MSSP/SOC environments. This workflow automates full endpoint antivirus scanning immediately after high-severity endpoint infection wā¦ | Webhook, Telegram, SSH, AI Agent, Summarization Chain, OpenAI Chat Model | 1,122 |
| š ļø TheHive tool MCP server | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 1,105 |
| Send TheHive alerts using SIGNL4 | This sample workflow allows you to forward alerts from TheHive 5 to SIGNL4 in order to send reliable alerts to your team. | Start, Webhook, SIGNL4, TheHive | 1,043 |
| Automated AWS IAM key compromise response with Slack & Claude AI | This n8n workflow provides a secure, enterprise-grade response system for AWS IAM access key compromises with built-in form submission and human approval mechanisms. When an AWS access key is suspeā¦ | HTTP Request, Slack, AI Agent, Anthropic Chat Model, n8n Form Trigger, AWS IAM | 1,024 |
| Receive updates when an event occurs in TheHive | !workflow-screenshot | Start, TheHive Trigger | 1,013 |
| Monitor CISA critical vulnerability alerts with RSS feed & Slack notifications | This concise workflow efficiently captures, filters, and delivers crucial cybersecurity-related mentions. | Slack, RSS Feed Trigger | 984 |
| Get the job details using the Cortex node | !workflow-screenshot | Start, Cortex | 979 |
| Automate cybersecurity threat analysis with GPT-4o, CVSS scoring and risk routing | This workflow automates end-to-end cybersecurity threat analysis using a multi-agent AI architecture, targeting Security Operations Centre (SOC) analysts, security engineers, and IT risk teams respā¦ | AI Agent, OpenAI Chat Model, Structured Output Parser, Calculator, Code Tool, AI Agent Tool | 958 |
| Check suspicious links via Telegram with GPT-4 analysis of VirusTotal & urlscan.io results | The workflow is designed to scan submitted URLs using urlscan.io and VirusTotal, combine the results into a single structured summary, and send the report via Telegram. | Google Sheets, HTTP Request, Telegram, Telegram Trigger, urlscan.io, AI Agent | 917 |
| Govern stale Entra ID guest accounts with SharePoint and Microsoft Teams | This template runs two scheduled workflows to govern Microsoft Entra ID (Azure AD) guest accounts by detecting stale users via Microsoft Graph, staging deletions in SharePoint with a 72-hour windowā¦ | HTTP Request, Microsoft Teams, Schedule Trigger, Microsoft Entra ID, Microsoft SharePoint | 914 |
| Fraudulent booking detector: Identify suspicious travel transactions with Google Gemini | This automated n8n workflow detects and manages fraudulent booking transactions through comprehensive AI-powered analysis and multi-layered security checks. The system processes incoming travel booā¦ | Google Sheets, HTTP Request, Webhook, Gmail, AI Agent, Google Gemini Chat Model | 914 |
| Monitor cybersecurity brand mentions on X and send alerts to Slack | This concise workflow efficiently captures, filters, and delivers crucial cybersecurity-related mentions. | Slack, X (Formerly Twitter), Schedule Trigger | 889 |
| Automate cybersecurity incident response with Claude AI, VirusTotal and Slack | This workflow automates end-to-end cybersecurity incident response by ingesting alerts from multiple sources, enriching threat intelligence, assessing severity with Claude AI, executing containmentā¦ | Google Sheets, HTTP Request, Webhook, AI Agent, Anthropic Chat Model | 888 |
| Automate regulatory compliance monitoring with ScrapeGraphAI and email alerts | This workflow automatically monitors government regulatory changes and provides comprehensive compliance tracking and executive alerts. | Send Email, Schedule Trigger | 887 |
| Extract actionable security insights from HackerOne reports with Google Gemini | A streamlined AI-powered tool that extracts actionable technical insights from HackerOne security reports for advanced bug bounty hunters. | AI Agent, Chat Trigger, Google Gemini Chat Model | 875 |
| Send organized security CVE digests from NVD with AI-polished summaries to Gmail | Summary | HTTP Request, Gmail, Schedule Trigger, OpenAI | 804 |
| Automate CVE detection with AI-powered Nuclei template generation & Google Drive | Automates collection, technical extraction, and automatic generation of Nuclei templates from public CVE PoCs. | HTTP Request, Google Drive, SSH, Schedule Trigger, AI Agent, OpenAI Chat Model | 800 |
| New TheHive case Slack notification bot | !theHive | HTTP Request, Slack, Webhook, TheHive 5, TheHive 5 Trigger | 720 |
| Intelligent real-time financial fraud detection and risk scoring engine | Automates fraud risk detection for financial transactions by analyzing real-time webhook events through AI-powered scoring. Target audience: fintech companies, payment processors, and banking teamsā¦ | Send Email, Google Sheets, HTTP Request, Slack, Webhook, AI Agent | 704 |
| Monitor VPS security with GPT-4 mini analysis via SSH and Telegram alerts | This n8n template automatically monitors your VPS for suspicious processes and network connections using AI analysis. It connects to your server via SSH, analyzes running processes, and sends Telegā¦ | Telegram, SSH, Schedule Trigger, Basic LLM Chain, OpenAI Chat Model, Structured Output Parser | 702 |
| Monitor SSL certificate expiry with Google Sheets and email alerts | This n8n template automatically monitors SSL certificates of websites listed in a Google Sheet and sends email alerts if any are expiring within 14 days. It helps ensure you avoid downtime, securitā¦ | Send Email, Google Sheets, HTTP Request, Schedule Trigger | 664 |
| Validate TOTP token (without creating a credential) | This template allows you to verify if a 6-digit TOTP code is valid using the corresponding TOTP secret. It can be used in an authentication system. | 660 | |
| Monitor domains & IPs on AbuseIPDB blacklist with Slack alerts | The automated blacklist monitor is designed to be a proactive, not reactive, tool. Here is the high-level process: | HTTP Request, Slack, Schedule Trigger | 612 |
| IP geolocation & HTTP port scanning with Google Sheets | This n8n template automatically enriches IP addresses with geolocation data and performs HTTP port scanning when new IPs are added to a Google Sheets document. Perfect for network monitoring, securā¦ | Google Sheets, HTTP Request, Google Sheets Trigger | 571 |
| Automated weekly security audit reports with Gmail delivery | This workflow automatically generates and emails a comprehensive security audit report for your N8N instance every week. It identifies potential security risks related to: | Cron, Gmail, n8n | 550 |
| Kubernetes deployment & pod monitoring with Telegram alerts | - Open the āKubeconfig Setupā node | Write Binary File, Telegram, Schedule Trigger | 526 |
| Proxy detection by IP2Proxy - MCP server | Complete MCP server exposing 1 IP2Proxy Proxy Detection API operations to AI agents. | MCP Server Trigger | 503 |
| IAM compliance automation: enforce MFA and clean up access keys in AWS | > This workflow leverages AWS IAM APIs and n8n automation to ensure strict security compliance by continuously monitoring IAM users for MFA (Multi-Factor Authentication) enforcement. | HTTP Request, Slack, Schedule Trigger, Filter, AWS IAM | 453 |
| Monitor remote server file integrity with SSH and Slack alerts | This workflow efficiently performs a scheduled file integrity audit. | Cron, Slack, SSH | 437 |
| Triage AWS security misconfigurations with GPT-4.1 Mini and send alerts to Gmail | Automatically triages risky AWS misconfigurations and alerts your team. | Airtable, HTTP Request, Webhook, Gmail, OpenAI | 434 |
| Discord server anti-impersonation / scammer tracker with data tables | This n8n template demonstrates how to automatically monitor and track username and nickname changes across your Discord server members. Perfect for community moderation, security monitoring, and maā¦ | Discord, Schedule Trigger, Data table | 430 |
| Detect and route cybersecurity threats with SIEM, Slack, email and PagerDuty | This n8n workflow proactively scans and aggregates threat intelligence, network logs, and vulnerability data every 15 minutes to detect emerging risks across the infrastructure. It analyzes anomaliā¦ | Send Email, HTTP Request, Postgres, Slack, Schedule Trigger | 405 |
| Automated APK security scanning & PDF reporting with MobSF, AI & Google Drive | This workflow automatically analyzes any newly uploaded APK file and produces a clean, professional PDF security report. When an APK appears in Google Drive, the workflow downloads it, sends it to ā¦ | HTTP Request, Google Drive, Google Drive Trigger, OpenAI | 395 |
| Monitor zero-day threats with Anthropic Claude, Airtable, Slack and Jira | This workflow continuously monitors CVE databases, threat intelligence feeds, and public security advisories to surface emerging zero-day threats, correlates them against your registered infrastrucā¦ | Airtable, Send Email, Google Sheets, HTTP Request, Webhook, Schedule Trigger | 394 |
| Monitor security logs for failed login attempts with Slack alerts | This workflow efficiently processes logs to detect anomalies. | HTTP Request, Slack, Schedule Trigger | 393 |
| Automated DNS records lookup for subdomains with HackerTarget API reports | š§ EnumX: Auto DNS Lookup for Subdomains with Markdown Export | HTTP Request, Gmail | 393 |
| Monitor email data breaches with HIBP API and send Slack alerts | This workflow efficiently performs a scheduled data breach scan. | HTTP Request, Slack, Schedule Trigger | 388 |
| Report spam and phishing URLs from IMAP mailboxes to Spamhaus | This workflow automates URL reporting to Spamhaus based on incoming spam/phishing sample emails. It watches one or more IMAP folders, extracts URLs from each email body, removes duplicates and commā¦ | Email Trigger (IMAP), HTTP Request, Filter | 387 |
| File hash verification for AI agents with hashlookup CIRCL API | Complete MCP server exposing 11 hashlookup CIRCL API operations to AI agents. | MCP Server Trigger | 381 |
| Auto-renew AWS certificates with Slack approval workflow | - SRE/DevOps teams managing many ACM certs. | Slack, AWS Certificate Manager, Schedule Trigger, Filter | 350 |
| AI-powered security analysis for n8n with Google Gemini and n8n audit API | This workflow provides a deep-dive security assessment of an n8n instance using the native Audit API and AI analysis. | HTTP Request, Basic LLM Chain, Structured Output Parser, n8n Form Trigger, Google Gemini Chat Model, n8n Form | 345 |
| š ļø Elastic Security Tool MCP Server šŖ all 14 operations | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 338 |
| Analyze domain threats via Telegram with VirusTotal, AbuseCH, and Gemini AI | !WorkFlow.png | HTTP Request, Telegram, Telegram Trigger, Google Gemini | 330 |
| Monitor cybersecurity compliance and send weekly reports via SIEM, Jira, PostgreSQL, Slack and email | This n8n workflow automates continuous compliance monitoring across IT, OT, and cloud environments by aggregating security controls, validating policies (ISO 27001, NIST, GDPR, SOC2), detecting anoā¦ | Send Email, HTTP Request, Postgres, Schedule Trigger, Filter | 321 |
| Monitor & alert on inactive AWS IAM users with Slack notifications | > Weekly job that finds IAM users with no activity for > 90 days and notifies a Slack channel. | HTTP Request, Slack, Schedule Trigger, Filter, AWS IAM | 314 |
| Detect and isolate ransomware with Claude (Anthropic), EDR, SIEM and Slack | This workflow provides real-time detection of ransomware encryption patterns using Claude AI, with automated system isolation and incident response. | Send Email, Google Sheets, HTTP Request, Slack, Webhook, AI Agent | 306 |
| SSL/TLS certificate expiry monitor with Slack alert | This workflow efficiently monitors your domains for certificate expiry. | HTTP Request, Slack, Schedule Trigger | 295 |
| Cyberpulse AI GRC: Automate security questionnaire responses | Description | Google Sheets, Webhook, Google Drive, Gmail, OpenAI | 293 |
| BlueOps Auto CVE & IOC feed ingestor with OpenAI risk triage & email alerts | This Blue Team workflow ingests threat intelligence from public CVE and IOC feeds, merges the data, performs automated triage using OpenAI, and routes actionable alerts via email. | Send Email, Google Sheets, HTTP Request, Schedule Trigger | 293 |
| Send Slack alerts for AWS IAM access keys older than 365 days | HTTP Request, Slack, Schedule Trigger, Filter, AWS IAM | 290 | |
| Check phishing URL reputation with VirusTotal and log to Google Sheets | This n8n template helps you automatically analyze URLs for phishing and malicious activity using VirusTotalās multi-engine threat intelligence platform. It validates incoming URLs, submits them forā¦ | Google Sheets, HTTP Request, Webhook | 274 |
| Prevent phishing emails with GPT-4, VirusTotal, Slack, and Google Sheets | This n8n workflow automates real-time phishing detection by ingesting incoming emails, extracting indicators, analyzing content with AI (GPT-4), calculating risk scores, and taking immediate actionā¦ | Send Email, Google Sheets, HTTP Request, Webhook, AI Agent, OpenAI Chat Model | 272 |
| Monitor SSL certificates for brand-impersonating domains with crt.sh, Urlscan.io and Slack | This workflow monitors SSL certificate logs to find and scan new domains that might be impersonating your brand. | HTTP Request, Slack, urlscan.io, Schedule Trigger | 270 |
| Scan URLs with urlscan.io and send results via Gmail | Receive a URL via Webhook, submit it to urlscan.io, wait ~30 seconds for artifacts (e.g., screenshot), then email a clean summary with links to the result page, screenshot, and API JSON. | Webhook, Gmail, urlscan.io | 262 |
| n8n enterprise AI security firewall ā guardrails for secure agents | This workflow provides a complete testing rig for evaluating text against seven essential AI guardrails used in production systems. | Google Sheets, Google Gemini Chat Model, Guardrails | 253 |
| š ļø Microsoft Entra ID tool MCP server šŖ all 12 operations | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 247 |
| Automated Wazuh rule deployment pipeline with GitHub, XML validation & Telegram alerts | š Say Goodbye to Manual Rule Deployments in Wazuh! | Github Trigger, HTTP Request, Telegram, SSH | 237 |
| Secure user emails with AES-256 encryption and verification system | Professional-Grade AES-256 Data Protection for n8n | 234 | |
| Track software security patents with ScrapeGraphAI, Notion, and Pushover alerts | !Workflow Preview Image | HTTP Request, Pushover, Notion, Schedule Trigger | 232 |
| Prioritize and report Wazuh vulnerabilities with EPSS and CISA KEV | This workflow runs daily (or manually) to pull vulnerability findings from Wazuh Indexer, enriches CVEs with FIRST EPSS and the CISA KEV catalog, calculates a priority score, tracks finding lifecycā¦ | Send Email, HTTP Request, Schedule Trigger, Data table | 226 |
| Real-time security threat dashboard with Google Sheets, AI risk analysis & email alerts | š¤ Who itās for | Send Email, Google Sheets, HTTP Request, Schedule Trigger | 215 |
| Monitor SSL certificate expiry dates with Google Sheets & Slack alerts | !image.png | Google Sheets, Slack, Schedule Trigger | 214 |
| Check file hash reputation with VirusTotal and Slack alerts | File Hash Reputation Checker is a security automation workflow that validates file hashes (MD5, SHA1, SHA256) and checks their reputation using the VirusTotal API. It is designed for SOC teams, secā¦ | HTTP Request, Slack, Webhook | 212 |
| Test WAF security interactively with an AI agent and WAFtester MCP | A conversational AI agent that connects to WAFtester via MCP (Model Context Protocol) for interactive Web Application Firewall security testing. Type natural language requests ā the agent picks theā¦ | AI Agent, OpenAI Chat Model, Chat Trigger, MCP Client Tool | 207 |
| Monitor exposed secrets in GitHub and CI logs with WhatsApp alerts | This workflow runs every 6 hours (or on demand) to scan GitHub commits and CI/CD logs for leaked secrets, verify suspected credentials against GitHub and Stripe when possible, score risk severity, ā¦ | HTTP Request, WhatsApp Business Cloud, Schedule Trigger | 204 |
| š ļø Microsoft Graph Security Tool MCP server šŖ all 5 operations | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 202 |
| š ļø MISP tool MCP server šŖ all 44 operations | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 197 |
| Monitor compliance with GPT-4 analysis of system logs and generate audit reports | This solution centralizes communication data from Slack, Microsoft Teams, Gmail, and GitHub into a unified AI-powered analysis and documentation workflow for teams managing distributed knowledge. Mā¦ | HTTP Request, Gmail, Schedule Trigger, AI Agent, OpenAI Chat Model, Structured Output Parser | 186 |
| Automate vulnerability triage from Snyk with Jira, Slack & Airtable integration | This workflow receives vulnerability data(e.g., Snyk, Dependabot or any security scanner) from Snyk through a webhook, standardizes and validates the payload, checks Jira for duplicates using a uniā¦ | Airtable, Function, Slack, Webhook, Jira Software | 184 |
| Auto-classify security incidents with GPT-4 and Google Sheets for SOC teams | Blue Team leads, SOC analysts, and IT responders looking to automatically classify security alerts using AI-driven logic and asset-based risk signals. | Google Sheets, HTTP Request, Schedule Trigger | 183 |
| Monitor SSL certificate expiry with Google Sheets and SMTP email alerts | DevOps engineers, sysadmins, and website owners who manage multiple domains and need proactive SSL certificate expiration monitoring without manual checks. | Send Email, Google Sheets, Schedule Trigger | 180 |
| Orchestrate security vulnerability remediation with Port, OpenAI, Jira and Slack | Complete security workflow from vulnerability detection to automated remediation, with severity-based routing and full organizational context from Portās catalog. This template provides end-to-end ā¦ | HTTP Request, Slack, Webhook, Jira Software, OpenAI | 180 |
| Automated failed login detection with Jira tasks, Slack alerts & Notion logging | Webhook: Failed Login Attempts ā Jira Security Case ā Slack Warnings | Function, Slack, Webhook, Jira Software, Notion | 180 |
| š ļø Okta tool MCP server šŖ all 5 operations | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 175 |
| š ļø SecurityScorecard tool MCP server šŖ all 19 operations | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 174 |
| Monitor Zoho CRM changes & alert on suspicious activity with Google Sheets | This n8n workflow automatically monitors selected Zoho CRM modules for record changes, identifies suspicious modification patterns, logs all activity into a Google Sheet, generates an audit JSON fiā¦ | Function, Google Sheets, HTTP Request, Gmail | 169 |
| Enrich IP addresses with country attribution using IPinfo and Slack alerts | IP Enrichment & Country Attribution is a lightweight cybersecurity automation that enriches IP addresses with geographic and network intelligence. It validates incoming IPs, filters out private or ā¦ | HTTP Request, Slack, Webhook | 164 |
| CYBERPULSE AI GRC: automate PCI DSS control evaluation and compliance tracking | Description | Google Sheets, Filter | 164 |
| Send a daily prioritized CVE digest from NVD to Slack and Gmail with EPSS and CISA KEV | Security teams often struggle to keep up with the volume of newly published CVEs and manually determine which vulnerabilities are actually relevant to their environment. | HTTP Request, Slack, Gmail, Schedule Trigger, Extract from File | 161 |
| Export Jamf policies to Slack as CSV for instant auditing | Quickly export and review your entire Jamf policy configurationāincluding triggers, frequencies, and scopeādirectly in Slack. | HTTP Request, Slack, Webhook, Convert to File | 155 |
| Run weekly WAF security audits with WAFtester and Slack alerts | Automated weekly WAF security assessments with Slack reporting. Detects your WAF vendor, runs a security assessment, grades your protection, and alerts your team when the grade drops below threshold. | HTTP Request, Slack, Schedule Trigger | 153 |
| Orchestrate multi-agent compliance monitoring and audit logging with GPT-4o and Slack | This workflow automates enterprise compliance governance using a multi-agent AI architecture. It targets compliance officers, legal teams, and risk managers who need continuous, jurisdiction-aware ā¦ | Send Email, Webhook, Schedule Trigger, AI Agent, OpenAI Chat Model, Simple Memory | 151 |
| š ļø Bitwarden tool MCP server šŖ all 19 operations | Need help? Want access to this workflow + many more paid workflows + live Q&A sessions with a top verified n8n creator? | MCP Server Trigger | 148 |
| CYBERPULSE AI RedOps: internal phishing simulation for security training | Simulate phishing awareness campaigns using OpenAI-generated emails. Send to target lists, log clicks with a webhook, and store results in Google Sheets. Built for internal testing and cyber awarenā¦ | Google Sheets, Webhook, Gmail, AI Agent, OpenAI Chat Model | 147 |
| Scan incoming Gmail attachments for threats with VirusTotal and GPT-4o-mini | Small teams, solo operators, and security-conscious individuals who receive email attachments from external senders. Useful for freelancers, agencies, HR teams, and anyone handling CVs, invoices, oā¦ | Google Sheets, HTTP Request, Slack, Google Drive, Gmail, Gmail Trigger | 145 |
| Secure AI agent webhook with HMAC, replay protection, and OpenAI GPT-5 | > I am not a cybersecurity expert. | Webhook, AI Agent, OpenAI Chat Model | 142 |
| Manage vulnerabilities end-to-end with GPT-4, Jira, Slack and Google Sheets | Automates the full vulnerability lifecycle ā from scheduled scanning and data aggregation to intelligent prioritization, ticket creation, real-time alerting, weekly reporting, and centralized trackā¦ | Send Email, Google Sheets, HTTP Request, Webhook, Schedule Trigger, AI Agent | 136 |
| Audit Confluence space permissions and public links for compliance | This workflow scans selected Confluence spaces for public exposure risks, helping teams identify unintended access and potential data leakage. | HTTP Request, GraphQL | 132 |
| Generate incident response reports with Supabase, Gemini and Claude | This workflow ingests incident and playbook content from GitHub into Supabase (including pgvector embeddings with Google Gemini) and, on a webhook trigger, enriches a test incident with historical ā¦ | HTTP Request, Webhook, Supabase, AI Agent, Basic LLM Chain, Structured Output Parser | 128 |
| Detect WooCommerce order fraud and send alerts to Slack | This workflow automatically monitors WooCommerce orders, evaluates them for fraud using multiple checks (address mismatch, high-value orders, suspicious emails, admin orders), calculates a fraud scā¦ | Slack, WooCommerce, Schedule Trigger | 127 |
| Automate security incident response with Google Sheets, email alerts and EDR isolation | š¤ Who itās for | Send Email, Google Sheets, HTTP Request, Schedule Trigger | 125 |
| Monitor GitHub repo access and push events with GitHub and Slack alerts | This workflow monitors GitHub for high-risk activities to ensure that only authorized users can modify the repository. It periodically polls GitHub for events such as PushEvent, MemberEvent, and Puā¦ | HTTP Request, Slack, Schedule Trigger, Data table | 124 |
| Filter fraudulent leads with GPT-4o-mini, AbstractAPI, Google Sheets and Slack | This n8n template serves as a security layer for your marketing efforts, ensuring that only high-quality, human-verified leads reach your CRM while automatically blacklisting bots and VPN-based subā¦ | Google Sheets, HTTP Request, Slack, Webhook, OpenAI | 116 |
| Secure GET webhooks with query parameter validation for limited authentication cases | Webhooks are special URLs that instantly trigger workflows when they receive an incoming HTTP request (like GET or POST). Theyāre perfect for connecting external tools to n8n in real time. | Webhook, Stop and Error | 115 |
| Detect transaction fraud and manage compliance with GPT-4 and Airtable | This workflow automates financial transaction monitoring, fraud detection, and regulatory compliance using OpenAI GPT-4 across coordinated specialist agents. It targets compliance officers, fraud aā¦ | Airtable, Schedule Trigger, AI Agent, OpenAI Chat Model, Structured Output Parser, AI Agent Tool | 109 |
| Aggregate endpoint security risk scores with EDR, vulnerability data & Google Sheets | š¤ Who itās for | Cron, Function, Google Sheets, HTTP Request | 105 |
| Verify property ownership with blockchain, GPT-4 fraud detection, and compliance tracking | This workflow automates property registration verification, fraud detection, and blockchain-based compliance tracking by systematically assessing fraud risk, validating transactions, ensuring data ā¦ | Google Sheets, HTTP Request, Webhook, AI Agent, OpenAI Chat Model, Structured Output Parser | 104 |
| Collect SOC 2 AWS IAM evidence to Google Sheets with Gmail alerts | Your automated compliance assistant that pulls, formats, and logs AWS infrastructure evidence to Google Sheets on a recurring schedule. | Google Sheets, Gmail, Schedule Trigger, AWS IAM | 103 |
| Monitor Jamf policy integrity and send Slack alerts for changes | š”ļø Jamf Policy Integrity Monitor | HTTP Request, Slack, Webhook, Schedule Trigger, Data table | 103 |
| CYBERPULSE AI redOps: phishing simulation with redirect tracking | Simulate cloaked phishing links that redirect through a controlled proxy. This module tracks if secure email gateways (SEGs) or sandboxes trigger the redirect before users do. Logs access, responseā¦ | Google Sheets | 103 |
| CYBERPULSE AI redOps: credential trap sim: fake login page simulation | Simulate a phishing login page to test user behavior and SOC response. This controlled workflow sends trap links to predefined targets and logs simulated interaction resultsāwithout capturing real ā¦ | Google Sheets | 99 |
| CYBERPULSE AI RedOps: generate daily RedOps security simulation reports | Automatically compiles a daily HTML report of all RedOps simulations (Modules 1ā5), summarizing offensive activity, response logs, and module effectiveness. Designed for GRC teams, Red/Purple teamsā¦ | Google Sheets, Gmail | 93 |
| CYBERPULSE AI BlueOps: asset enrichment engine | š¤ Who itās for | Cron, Send Email, Function, Google Sheets | 92 |
| Investigate scam URLs with URLScan.io, Telegram, Gmail, and Data Tables | This workflow accepts a suspected scam URL via an n8n form, enriches it with RDAP, certificate transparency, DNS/IP hosting data, urlscan.io results, and HTML fingerprints, then correlates findingsā¦ | HTTP Request, Telegram, Gmail, n8n Form Trigger, Data table | 91 |
| Monitor Have I Been Pwned breaches with Google Sheets, Gmail, and Slack | Checks Have I Been Pwned daily for new breaches, scores each one against your own risk criteria and watchlist, logs every result to Google Sheets, and sends Gmail and Slack alerts only when a breacā¦ | Send Email, Google Sheets, HTTP Request, Gmail, Schedule Trigger | 89 |
| Analyze vendor security risk from Jira tickets using Grok, Claude and Slack | When a new vendor ticket is created in Jira, this workflow automatically performs a comprehensive security due-diligence investigation and posts the findings back as a Jira comment plus a Slack notā¦ | Slack, Webhook, Jira Software, AI Agent, OpenRouter Chat Model, AI Agent Tool | 88 |
| Assess Wazuh platform health and email HTML reports with SSH and SMTP | This workflow runs a manual health assessment of a Wazuh deployment by querying the Wazuh Manager API, Wazuh Indexer API, and host metrics over SSH, then scores the results, generates prioritized rā¦ | Send Email, HTTP Request, SSH, Data table | 84 |
| Automate risk treatment tasks with Google Sheets for GRC compliance | Description | Google Sheets, Schedule Trigger | 84 |
| Detect and route gameplay security anomalies with GPT-4o, Slack and Sheets | This workflow automates cybersecurity incident detection and response for security operations centers (SOCs) managing constant threat landscapes. Designed for security analysts, IT operations teamsā¦ | Send Email, Google Sheets, Slack, Schedule Trigger, AI Agent, OpenAI Chat Model | 82 |
| CYBERPULSE AI RedOps: validate email security gateways generated payloads | Description: | Google Sheets, OpenAI | 82 |
| Monitor PKI certificates & CRLs for expiration with Telegram & SMS alerts | This n8n workflow provides automated monitoring of Public Key Infrastructure (PKI) components including CA certificates, Certificate Revocation Lists (CRLs), and associated web services. It extractā¦ | HTTP Request, Write Binary File, Schedule Trigger | 80 |
| Hunt brand impersonation and deepfake threats with Claude, Google Sheets and SendGrid | This workflow runs every 4 hours to search a brand-monitoring API for lookalike accounts and mentions, uses Anthropic Claude to classify impersonation risk, logs results to Google Sheets, and sendsā¦ | HTTP Request, Schedule Trigger, AI Agent, Anthropic Chat Model | 77 |
| Assess blockchain smart contract and tokenomics risk with GPT-4o and Gmail | This workflow automates blockchain risk assessment using a multi-agent AI architecture, targeting DeFi developers, blockchain auditors, and Web3 project teams who need rigorous smart contract and tā¦ | Gmail, AI Agent, OpenAI Chat Model, Structured Output Parser, Calculator, Code Tool | 75 |
| Track policy expiry dates and ownership with Google Sheets and Gmail notifications | Purpose | Google Sheets, Gmail | 74 |
| Audit Website Security Headers with AI Remediation and Google Sheets Reporting | An automated workflow for auditing website security headers and generating | Google Sheets, HTTP Request, Gmail, AI Agent, n8n Form Trigger, OpenRouter Chat Model | 72 |
| Audit workflows for hardcoded secrets with GitHub and Telegram | Scans every workflow on your n8n instance for credentials, tokens, and personal data pasted straight into node parameters. Findings are reported to Telegram by severity, and the snapshot committed ā¦ | GitHub, Telegram, n8n, Schedule Trigger, Filter | 67 |
| Run weekly security audits via the n8n API, Data Tables, and Telegram | The native n8n security audit misses tokens pasted into node parameters, active workflows without an error handler, plain http:// calls and leftover pinned data. This workflow runs the native auditā¦ | Telegram, n8n, Schedule Trigger, Data table | 66 |
| Filter URLs with AI-powered robots.txt compliance & source verification | Version : 1.0 | HTTP Request, Postgres, Execute Workflow Trigger, Schedule Trigger, Mistral Cloud Chat Model, Google Gemini Chat Model | 66 |
| Route IAM events with GPT-4o-mini, forgeLLM, Slack, email, and audit logs | This workflow automates Identity and Access Management (IAM) event governance using an AI agent, targeting security operations teams, compliance officers, and IT governance teams managing cloud or ā¦ | Webhook, AI Agent, OpenAI Chat Model, Simple Memory, Structured Output Parser, AI Agent Tool | 65 |
| Detect and enforce abuse cases with OpenAI, Slack, Gmail and Sheets | This workflow automates platform trust and safety operations by deploying a multi-agent AI system that detects abuse signals, investigates behaviour, scores risk, checks policy compliance, and enfoā¦ | Send Email, Slack, Webhook, AI Agent, OpenAI Chat Model, Structured Output Parser | 60 |
| Detect fraud in user activity with PostgreSQL, OpenAI and Slack | > n8n + PostgreSQL + OpenAI + Slack | Function, Postgres, Slack, Webhook, OpenAI | 59 |
| Red-team AI agents with jailbreak probes using Groq, Discord, and data tables | This workflow red-teams an AI agent by replaying stored jailbreak and safety probes against a Groq-hosted model, scoring behavior from tool calls and responses, saving results to n8n Data Tables, aā¦ | Discord, Schedule Trigger, AI Agent, Basic LLM Chain, Structured Output Parser, Code Tool | 56 |
| Monitor n8n security advisories from GitHub, NVD, JPCERT and JVN with Claude and Slack | This workflow runs hourly to monitor n8n-related security information from GitHub Advisories, NVD (NIST) CVE data, GitHub n8n security release notes, and JPCERT/JVN RSS feeds, then summarizes new fā¦ | HTTP Request, Slack, Schedule Trigger, Anthropic | 55 |
| Audit website security and send AI reports via Claude, Gmail, Slack and WhatsApp | This advanced n8n workflow is designed for web developers, system administrators, security analysts, and agency owners who need to automate the monitoring of website security posture. It acts as a ā¦ | Google Sheets, HTTP Request, Slack, Gmail, Schedule Trigger, AI Agent | 51 |
| Monitor website uptime and SSL expiry with Cert Spotter and Telegram alerts | This workflow monitors website uptime every 5 minutes and SSL certificate expiry daily at 8:00, sending Telegram alerts only when a site changes state (down/recovered) or when a certificate is nearā¦ | HTTP Request, Telegram, Schedule Trigger | 50 |
| Detect and remediate leaked secret on repo with GitHub, AWS, Jira, Slack, Claude | SecretOps is an n8n security automation workflow that monitors Git push events, detects high-risk secrets in commits, and automatically responds in real time. | Github Trigger, HTTP Request, Slack, Jira Software, AI Agent, OpenRouter Chat Model | 47 |
| Triage AWS security posture changes with Claude, Slack, email, and WhatsApp alerts | Automated AWS security posture triage: detects changes in security findings, enriches with asset context, uses Claude to assess risk severity, then routes critical cases for manager approval while ā¦ | Send Email, Slack, WhatsApp Business Cloud, Schedule Trigger, AI Agent, Anthropic Chat Model | 46 |
| Review GitHub PR security with DeepSeek and Gmail alerts | Most teams donāt have a security reviewer on every PR. This workflow gives you one: it reads the diff, catches hardcoded secrets and risky code, posts a real GitHub status check, comments inline onā¦ | GitHub, Github Trigger, HTTP Request, Gmail, AI Agent, Structured Output Parser | 46 |
| Run a weekly n8n security audit and email changes with Supabase and Gmail | If your main Error Diagnosis workflow fails for any reason, this backup workflow sends an alert email to the workflow owner. | Gmail, Supabase, n8n, Schedule Trigger | 46 |
| Assess credential risk and route mitigation actions with GPT-4o-mini | This workflow automates comprehensive enterprise risk assessment and mitigation planning for organizations managing complex operational, financial, and compliance risks. Designed for risk managers,ā¦ | AI Agent, OpenAI Chat Model, Structured Output Parser, AI Agent Tool | 44 |
| Scan Gmail links with VirusTotal and send alerts to WhatsApp, Teams, and Sheets | This n8n workflow is designed for IT security professionals, email administrators, and organizations that want to automatically scan URLs received in emails for potential security threats. It proviā¦ | Google Sheets, HTTP Request, Microsoft Teams, Gmail Trigger | 41 |
| Monitor website domain, SSL, and uptime with Google Sheets and Telegram | This workflow runs daily and checks each site listed in Google Sheets for domain expiry (RDAP), SSL certificate expiry (nslookup.io), and HTTP uptime, then sends priority-based tiered alerts and a ā¦ | Google Sheets, HTTP Request, Telegram, Schedule Trigger | 39 |
| Monitor Entra ID high-risk users with Microsoft Graph, TheHive and Slack | This workflow polls Microsoft Entra ID Protection for new high-risk risk detections, aggregates them per user, enriches them with risky-user and recent sign-in context from Microsoft Graph, then crā¦ | HTTP Request, Slack, Schedule Trigger, TheHive 5 | 38 |
| Redact and restore PII in OpenAI prompts with Enterprise PII Guardrails | This workflow masks sensitive PII in a customer prompt using Enterprise PII Guardrails, sends the sanitized text through a simulated LLM step, and then restores the original values in the LLM respoā¦ | OpenAI | 38 |
| Analyze pentest reports and create remediation tickets with OpenAI and Slack | This workflow receives a penetration test report via webhook, uses OpenAI to extract and normalize vulnerability findings, alerts Slack when critical issues are present, and creates severity-routedā¦ | HTTP Request, Slack, Webhook, AI Agent, OpenAI Chat Model | 37 |
| Send Prey missing-device alerts with Claude and Slack and log events to Sheets | This workflow receives Prey device webhook events, sends devicemissing incidents to Anthropic Claude to generate an urgent Slack alert, and appends both missing and non-missing device lifecycle eveā¦ | Google Sheets, Slack, Webhook, AI Agent, Anthropic Chat Model | 37 |
| Protect public webhooks with Ainoflow Guard rate limiting | Stop webhook flooding before it starts. Add production-grade rate limiting to any n8n webhook in minutes - reject abusive traffic before expensive workflow logic executes. | HTTP Request, Webhook | 36 |
| Collect SOC 2 and ISO 27001 evidence with GitHub, Google Workspace, AWS, and GPT-4o | This workflow runs monthly to collect SOC 2 and ISO 27001 evidence from GitHub, Google Workspace, and AWS IAM, then logs results to Google Sheets, archives a JSON snapshot to Google Drive, and postā¦ | Google Sheets, HTTP Request, Slack, Google Drive, Schedule Trigger, Convert to File | 33 |
| Summarize daily security logs with OpenAI and send briefings via WhatsApp and email | This workflow pulls the last 24 hours of aggregated security logs from a SIEM API, normalizes and deduplicates events, uses OpenAI to generate a daily risk briefing with optional escalation gating,ā¦ | Send Email, HTTP Request, WhatsApp Business Cloud, Schedule Trigger, Basic LLM Chain, OpenAI Chat Model | 33 |
| Check offboarding credential risks with RelayShield, Slack, Notion and Gmail | This workflow receives offboarding events via webhook, checks the departing employeeās email in RelayShield for breach, infostealer, and OAuth exposure signals, then logs the outcome to Notion and,ā¦ | Slack, Webhook, Gmail, Notion | 32 |
| Audit workflow compliance risk with GPT-4o, Gmail and Google Sheets | This workflow receives workflow audit events via a webhook, validates and normalizes the payload, uses OpenAI (GPT-4o) to assess compliance risk, logs results to Google Sheets, and sends Gmail alerā¦ | Google Sheets, Webhook, Gmail, OpenAI | 31 |
| Monitor DNS and domain security drift with DNSSEC, expiry checks and alerts | This workflow runs hourly (or manually) to resolve DNS records for configured domains using Node.js DNS lookups, compares them to an expected baseline, and classifies detected changes as standard lā¦ | HTTP Request, Schedule Trigger | 30 |
| Send certification expiry alerts from Google Sheets with Gmail | This workflow runs every Monday at 08:00 to read a Google Sheets roster, calculate days until each agentās certification expiry date, and send a consolidated HTML alert email via Gmail to the confiā¦ | Google Sheets, Gmail, Schedule Trigger, Filter | 30 |
| Monitor Gmail for compliance risks with Google Gemini and Google Sheets | > Gmail + Gemini + Google Sheets | Google Sheets, Gmail, Markdown, Filter, AI Agent, Google Gemini Chat Model | 29 |
| Analyze URL phishing risk with VirusTotal, Safe Browsing, Gemini, and Slack | Youtube Video: https://youtu.be/ekCMYUeee6Y?si=fphlFmKkarUKUBKg | Google Sheets, HTTP Request, Slack, Basic LLM Chain, Structured Output Parser, n8n Form Trigger | 27 |
| Score Cloudflare firewall bot threats and suggest manual block actions | This workflow runs on a schedule (or manually) to read Cloudflare firewall events via the Cloudflare GraphQL API, aggregate activity by client IP, and compute deterministic bot-risk scores with eviā¦ | HTTP Request, Schedule Trigger | 24 |
| Monitor brand domains and typosquat variants with DomainKits and email | This workflow runs daily to monitor newly registered domains matching your brand keyword and to check typosquat variants of your brand domain using DomainKits, then compiles WHOIS/DNS details into ā¦ | Send Email, Schedule Trigger, Convert to File | 23 |
| Check JWT security of API endpoints with HTTP requests and Google Sheets | This workflow reads API endpoints and JWTs from Google Sheets, tests each endpoint with multiple token scenarios using HTTP requests, and writes a risk-scored security summary back to Google Sheets. | Google Sheets, HTTP Request, Schedule Trigger, Filter | 23 |
| Audit browser and proxy fingerprint/IP integrity with GPT-4o, Sheets and Slack | This workflow performs a comprehensive security audit on your web scraping infrastructure to detect potential IP leaks or bot detection flags. It iterates through a list of fingerprinting services ā¦ | Google Sheets, Slack, AI Agent, Structured Output Parser, OpenRouter Chat Model | 23 |
| Triage new certificate transparency subdomains with Google Sheets, Slack, Gmail and OpenAI | This workflow monitors certificate transparency for new subdomains on your apex domains via crt.name, records them in Google Sheets, probes a capped set over HTTPS, optionally refines triage with aā¦ | Google Sheets, HTTP Request, Slack, Gmail, Schedule Trigger, Filter | 22 |
| Scan WordPress plugins and themes for vulnerabilities with WPScan and email | This workflow runs nightly to inventory your WordPress plugins and themes via the WordPress REST API, checks them against the WPScan vulnerability database within your API quota, stores scan historā¦ | Send Email, HTTP Request, Schedule Trigger, Data table | 21 |
| Submit NKSC NIVS cyber incident reports from a webhook or XLSX file | This example workflow demonstrates how to use the NKSC NIVS n8n community nodes to submit cyber incident reports to NKSC NIVS. It provides a reference integration that can be adapted to your own seā¦ | Webhook, Convert to File, Extract from File | 21 |
| Triage scam messages and alert family with Claude and Google Sheets | This workflow analyzes suspicious calls, WhatsApp messages, and emails using AI to detect scams, explain risks simply, suggest safe actions, alert trusted family members about high-risk fraud, and ā¦ | HTTP Request, Webhook, AI Agent, Anthropic Chat Model | 20 |
| Detect GitHub Actions supply-chain risks with Gemini and Slack | This workflow runs daily to scan GitHub Actions workflow files across a GitHub org or user, flags supply-chain risk patterns and unpinned actions, uses Google Gemini to review new or changed workflā¦ | GitHub, HTTP Request, Slack, Schedule Trigger, Filter, Basic LLM Chain | 19 |
| Assess AWS security posture changes with Claude and Slack alerts | This workflow polls or manually checks AWS security findings via HTTP endpoints, compares them to a stored baseline, enriches changes with asset inventory data, uses Anthropic Claude to assess seveā¦ | Send Email, HTTP Request, Slack, Schedule Trigger, AI Agent, Anthropic Chat Model | 19 |
| Audit vendor security risk with OpenAI, Google Sheets, Slack and Gmail | This workflow runs on a schedule to audit a vendorās security posture using website header checks, RDAP domain age lookup, and the Have I Been Pwned breaches list, then uses OpenAI to generate a stā¦ | Google Sheets, HTTP Request, Slack, Gmail, Schedule Trigger, AI Agent | 19 |
| Create OPNsense firewall and NAT rules from Telegram with AI | Create OPNsense firewall and destination NAT rules directly from Telegram using natural-language requests and AI-assisted rule interpretation. | HTTP Request, Telegram, Telegram Trigger, AI Agent, OpenAI Chat Model, Structured Output Parser | 17 |
| Triage security vulnerability alerts with NVD, Gemini, Supabase, and Jira | Youtube Video: https://youtu.be/8f-TzjNmbFI?si=V46dC5o45LGv28S0 | HTTP Request, Redis, Webhook, Jira Software, Supabase, AI Agent | 17 |
| Monitor SSL/TLS certificate expiry via an HTTP certificate inventory API | This workflow runs daily (or manually) to fetch an SSL/TLS certificate inventory over HTTP, calculates days until expiry, classifies each certificate by urgency, and prepares standard renewal reminā¦ | HTTP Request, Schedule Trigger | 17 |
| Generate website security audit PDFs with ScrapingBee, Claude, Gotenberg and Outlook | This workflow accepts a website URL via an n8n form, scrapes the page with ScrapingBee, and uses Anthropic Claude to audit HTTP security headers and client-side vulnerabilities. It then generates aā¦ | HTTP Request, Microsoft Outlook, AI Agent, Anthropic Chat Model, n8n Form Trigger, Convert to File | 16 |
| Monitor Hostinger email DNS records weekly and send alert emails via SMTP | This workflow runs every Monday at 8am to check email-related DNS records (MX, SPF, DMARC, and DKIM) for all domains in your Hostinger account and sends an HTML alert email when it detects missing ā¦ | Send Email, Schedule Trigger | 16 |
| Remediate critical attack paths with Neo4j, OpenAI, GitHub and Jira | This workflow scans a Neo4j-compatible security graph on a schedule or manually, automatically identifies and remediates the riskiest attack paths between internet-facing assets and crown-jewel resā¦ | HTTP Request, Schedule Trigger, AI Agent, OpenAI Chat Model | 15 |
| Detect compromised GitHub dependencies with Gemini and Slack alerts | Know within an hour when a hijacked or malicious npm, PyPI or other open-source package lands in any of your GitHub repositories. This workflow checks new GitHub malware and critical advisories agaā¦ | GitHub, HTTP Request, Slack, Schedule Trigger, Filter, Basic LLM Chain | 14 |
| Assess GDPR breach risk and 72-hour deadlines with Groq and data tables | This workflow collects suspected personal data breach reports via an n8n form, scores them against GDPR risk factors stored in n8n Data Tables, uses Groq to validate additional risk factors from thā¦ | Discord, Schedule Trigger, Basic LLM Chain, Structured Output Parser, n8n Form Trigger, Groq Chat Model | 14 |
| Triage security alerts with AbuseIPDB, VirusTotal, ipinfo.io, OpenAI, and Slack | This workflow receives security alerts via a webhook, normalizes and enriches them with AbuseIPDB, ipinfo.io, and VirusTotal lookups, then uses OpenAI to generate a SOC-style triage (severity, summā¦ | HTTP Request, Webhook, AI Agent, OpenAI Chat Model | 13 |
| Deduplicate security alerts into unified cases with Claude and Slack | This workflow ingests SIEM, EDR, and cloud security alerts via webhooks, normalizes and buffers them, then runs a scheduled deduplication pass that uses Anthropic Claude only for ambiguous clustersā¦ | HTTP Request, Slack, Webhook, Schedule Trigger, AI Agent, Anthropic Chat Model | 11 |
| Monitor SSL certificate expiries with Google Sheets, Slack and Linear | 8AM daily trigger | Google Sheets, Slack, Linear, Schedule Trigger | 9 |
| Investigate phishing emails from Google Sheets with MCP server and Telegram | This workflow monitors a Google Sheet for newly submitted phishing emails, downloads the attached .eml/.msg from Google Drive, analyzes headers and IOCs via an MCP server, and sends a consolidated ā¦ | Telegram, Google Drive, Google Sheets Trigger, MCP Client | 8 |
| Monitor SSL certificate expiry with Google Sheets, Slack, Gmail and Jira | This workflow runs daily to check SSL certificate expiry for domains listed in Google Sheets, using ssl-checker.io to fetch certificate details, then creating Jira issues and sending Slack and Gmaiā¦ | Google Sheets, HTTP Request, Slack, Jira Software, Gmail, Schedule Trigger | 8 |
| Triage software risk using NVD, EPSS, CISA KEV, GitHub and Claude | This workflow receives software vetting requests via a webhook, gathers vulnerability and supply-chain evidence from NVD, EPSS, CISA KEV (via NVD), Google News RSS, SEC EDGAR, GitHub, OpenSSF Scoreā¦ | HTTP Request, Webhook, Microsoft Outlook, Anthropic, Data table | 7 |
| Monitor attack surface changes with OpenAI, Slack, Postgres and email | This workflow runs every 6 hours to collect attack-surface assets from three HTTP APIs, normalize and deduplicate them, compare them to a Postgres baseline, and use OpenAI to generate risk narrativā¦ | Send Email, HTTP Request, Postgres, Slack, Schedule Trigger, AI Agent | 5 |
| Audit security questionnaire answers with Google Sheets and Google Drive evidence | This workflow runs manually or on a schedule to audit the freshness of security-questionnaire answers stored in Google Sheets by checking linked Google Drive evidence metadata, updating answer and ā¦ | Google Sheets, HTTP Request, Slack, Stop and Error, Schedule Trigger | 4 |
| Triage actively exploited GitHub SBOM vulnerabilities with OSV and Jira | Every six hours, this checks the software libraries your products use against public lists of security holes that hackers are actively using right now. For each real match it opens a Jira ticket wiā¦ | GitHub, HTTP Request, Jira Software, Stop and Error, Schedule Trigger | 4 |
| Notify on anomalous Google Drive access and send weekly email summaries | This workflow monitors Google Workspace Drive audit logs on an hourly and weekly schedule, detecting bulk downloads, access bursts, and new access IPs, then emailing security alerts and a weekly acā¦ | Send Email, HTTP Request, Execute Sub-workflow, Schedule Trigger, Filter | 4 |
| Audit SPF DNS lookup limits with Google DNS, Slack, and Gmail | This workflow runs daily (or manually) to audit SPF DNS lookup usage for your domains via Google DNS-over-HTTPS, then sends an alert digest to Slack and Gmail when records are missing, unsafe, or nā¦ | HTTP Request, Slack, Gmail, Schedule Trigger | 4 |
| Monitor landing page defacement with Snapshot Site, Discord and email | This workflow runs every 15 minutes to compare a live landing page against a baseline screenshot using Snapshot Site, and alerts your team via Discord and email when the mismatch indicates possibleā¦ | Send Email, Discord, Schedule Trigger | 4 |
| Enrich and route Splunk security alerts via AbuseIPDB, email, and Telegram | This workflow ingests Splunk security alerts via webhook, normalizes and deduplicates them using an n8n Data Table, enriches public source IPs with AbuseIPDB reputation data, calculates a risk scorā¦ | Send Email, HTTP Request, Webhook, Telegram, Schedule Trigger, Filter | 3 |
| Assess Bitcoin AML risk with Groq and log results to Google Sheets | This workflow fetches recent unconfirmed Bitcoin transactions from Blockchain.com, applies rule-based AML risk scoring, generates a one-line analyst note using Groqās LLM, and logs the results to Gā¦ | Google Sheets, HTTP Request, Filter, Basic LLM Chain, Groq Chat Model | 3 |
| Assess SaaS vendor risk with OpenAI and Probo and notify security in Slack | This workflow collects a SaaS vendor request via n8n Forms or a webhook, discovers and classifies public security/privacy links with OpenAI, analyzes the evidence to produce a structured risk assesā¦ | HTTP Request, Slack, Webhook, Filter, AI Agent, OpenAI Chat Model | 3 |
| Review security architecture risks and route alerts with OpenAI GPT-4.1 | This workflow runs on a weekly schedule or manual trigger, consolidates architecture inputs into a single context, and uses OpenAI GPT-4.1 to produce a structured security architecture review with ā¦ | Schedule Trigger, AI Agent, OpenAI Chat Model | 3 |
| Detect and triage risky OAuth apps with Anthropic Claude and Slack | This workflow runs every 30 minutes to detect new or changed OAuth-authorized apps, enriches them with publisher reputation data, scores risk with Anthropic Claude, and then auto-revokes high-risk ā¦ | HTTP Request, Slack, Schedule Trigger, AI Agent, Anthropic Chat Model | 3 |
| Send formatted security incident reports from Google Forms with Gmail and Google Sheets | This workflow watches a Google Forms responses spreadsheet, formats each new security incident into a clean report, emails it via Gmail to a manager, and appends the incident data to an archive sheā¦ | Google Sheets, Gmail, Google Sheets Trigger | 3 |
| Send domain expiry and WHOIS change alerts by email with Apify | This workflow runs every Monday, checks a list of domains with the Apify Domain Expiry & WHOIS Monitor actor for expiry risk and WHOIS/RDAP changes, and sends a plaintext email via SMTP only when aā¦ | Send Email, HTTP Request, Schedule Trigger | 2 |
| Review IP security risk for orders and signups with IPGeolocation | This workflow receives an order or signup event via webhook, validates the request, checks the IP address against IPGeolocationās Security API, and returns a structured JSON risk assessment (includā¦ | Webhook | 2 |
| Audit n8n instance security with the n8n API, api.n8n.io and GitHub advisories | This workflow runs every morning to audit your n8n instance, compare its version against n8n GitHub security advisories with branch-aware patch detection, and email a scored report and fix plan viaā¦ | Send Email, HTTP Request, Schedule Trigger | 2 |
| Collect and escalate security patrol reports with gpt-6-luna, Google Sheets, and Gmail | Patrol reports that reach the right person before the shift ends. This workflow takes guard reports from an n8n Form, has gpt-6-luna grade the severity and write a summary a supervisor can read in ā¦ | Google Sheets, Gmail, Schedule Trigger, AI Agent, OpenAI Chat Model, n8n Form Trigger | 2 |
| Send daily CISA KEV EPSS risk digests to Slack with OpenAI | This workflow runs daily to monitor the CISA Known Exploited Vulnerabilities (KEV) catalog for CVEs matching your tech stack, enriches them with FIRST EPSS scores, uses OpenAI to generate a Slack-rā¦ | HTTP Request, Slack, Schedule Trigger, Basic LLM Chain, OpenAI Chat Model | 2 |
| Secure and rate-limit webhooks with Slack alerts and HTTP audit logs | This workflow provides a hardened security layer for inbound POST webhooks, adding rate limiting, HMAC signature verification, replay/timestamp protection, payload validation, optional IP allow-lisā¦ | HTTP Request, Slack, Webhook | 2 |
| Detect 1Password vault exports with TheHive and Slack alerts | This workflow polls the 1Password Events API every 15 minutes for recent audit events, detects vault export activity, creates an alert in TheHive, and posts a notification to a Slack channel with tā¦ | HTTP Request, Slack, Schedule Trigger, Filter, TheHive 5 | 2 |
| Send daily CISA KEV exposure briefings to Slack with Gemini and Google Drive | This workflow runs daily to fetch new CISA KEV vulnerabilities, enrich them with NVD CVSS data, optionally match them against your RMM/EDR/network device inventory, and use Google Gemini plus Tavilā¦ | HTTP Request, Slack, Google Drive, Stop and Error, Schedule Trigger, Convert to File | 2 |
| Review and remediate Kubernetes manifests in GitHub PRs with GPT-4.1 | This workflow reviews Kubernetes manifest changes in GitHub pull requests using OpenAI with policy RAG and external scanner APIs, logs results to Postgres, posts findings back to the PR, andāafter ā¦ | GitHub, Github Trigger, Postgres, Slack, AI Agent, OpenAI Chat Model | 2 |
| Review Terraform pull requests with GitHub, GPT-4.1, Postgres and Slack | This workflow reviews Terraform pull requests in GitHub using an OpenAI tool-calling agent that can run plan, security, cost, and standards checks, then logs results to Postgres, comments on the PRā¦ | GitHub, Github Trigger, Postgres, Slack, AI Agent, OpenAI Chat Model | 2 |
| Screen vendor bank change requests with Groq, Google DNS and data tables | This workflow captures vendor bank-detail change requests via an n8n form, checks them against a verified vendor register, validates sender-domain DNS and email tactics with Groq, and outputs a PASā¦ | HTTP Request, AI Agent, Structured Output Parser, n8n Form Trigger, Groq Chat Model, n8n Form | 2 |
| Monitor attack surface changes with OpenAI, Postgres, Slack, and email | This scheduled workflow inventories your external attack surface from three HTTP APIs, diffs it against a Postgres baseline, and uses OpenAI to generate concise risk notes before routing critical/hā¦ | Send Email, HTTP Request, Postgres, Slack, Schedule Trigger, AI Agent | 2 |
| Gate SaaS and AI tool approvals with RelayShield, Notion, Slack, and Gmail | This workflow receives vendor and AI-tool approval requests via webhook, runs RelayShield risk checks (including an MCP registry check for AI tools), then logs outcomes to Notion, alerts a securityā¦ | HTTP Request, Slack, Webhook, Gmail, Notion | 2 |
| Send SSL certificate expiry alerts for your domains to Telegram | This workflow runs daily to check the SSL certificate expiry status of a configured list of domains using the NetworkCalc certificate API, then sends a single consolidated alert message to a Telegrā¦ | HTTP Request, Telegram, Schedule Trigger | 1 |
| Detect security drift in workflows and email new findings via SMTP | Weekly read-only security audit of all workflows on your n8n instance. It checks for hardcoded secrets, unauthenticated webhooks, broken error handling and setting drift, and emails you only the fiā¦ | Send Email, n8n, Schedule Trigger | 1 |
| Enforce DPA-compliant processors using the n8n API and Slack reports | This workflow runs weekly to audit all workflows in your n8n instance via the n8n API, identifies which external processors they send data to, optionally deactivates non-compliant workflows, and poā¦ | Slack, Stop and Error, n8n, Schedule Trigger | 1 |
| Secure inbound webhooks with HMAC, rate limits, audit logs, and Slack alerts | This workflow adds a hardened security layer in front of an inbound n8n webhook, applying rate limiting, HMAC signature verification, replay and timestamp protection, payload validation, optional Iā¦ | HTTP Request, Slack, Webhook | 1 |
| Monitor Polish counterparties for insolvency with Apify, Google Sheets and Gmail | This workflow runs every Monday to check a Google Sheets watchlist of Polish companies against the KRZ National Debtor Register and MSiG court gazette via Apify, then emails (and optionally Slack-pā¦ | Google Sheets, Slack, Gmail, Schedule Trigger, Filter | 1 |
| Send critical NPM CVE alerts from GitHub to Slack via Apify | This workflow runs every Monday at 9am to fetch your repositoryās package.json from GitHub, scan it for vulnerabilities using the Apify NPM CVE Monitor actor, and send an emergency alert to a Slackā¦ | HTTP Request, Slack, Schedule Trigger | 1 |
| Vet supplier payments with Bright Data, GPT-5.6, Slack, and data tables | This workflow collects supplier and invoice details via an n8n form, runs live website, complaint-search, and invoice-domain checks through Bright Data, generates a plain-language risk verdict withā¦ | HTTP Request, Slack, Basic LLM Chain, OpenAI Chat Model, n8n Form Trigger, Data table | 1 |
| Assess information system risks via webhook with Claude and Google Sheets | This workflow receives a webhook request describing an information system scenario, uses Anthropic Claude to generate a five-part risk assessment with a fixed JSON schema, returns the report to theā¦ | Google Sheets, Webhook, Basic LLM Chain, Anthropic Chat Model, Structured Output Parser | 0 |
| Audit AI and search bot access using robots.txt checks and Gmail reports | This workflow runs monthly to audit whether popular AI and search crawlers can access a specific page by comparing robots.txt rules with real HTTP responses, then emails a verdict report via Gmail. | HTTP Request, Gmail, Schedule Trigger | 0 |
| Re-screen a customer sheet against the OFAC sanctions list with Google Sheets and Slack | Every night this workflow re-screens each customer in a Google Sheet against the public OFAC sanctions list and its alias file, writes the result back into the sheet, remembers matches a reviewer aā¦ | Google Sheets, HTTP Request, Slack, Schedule Trigger, Filter | 0 |
| Rank and triage dependency risk with GitHub, OSV, Slack, npm, PyPI and OpenAI | This workflow runs weekly to scan GitHub repositories for JavaScript and Python dependencies, checks their release health via npm/PyPI and known vulnerabilities via OSV, then ranks the highest-riskā¦ | GitHub, HTTP Request, Slack, Schedule Trigger, Filter, Basic LLM Chain | 0 |
š„ How to use: Click any template above, then download the workflow.json file and import it into n8n via Workflow menu ā Import from File. See the importing guide for detailed instructions.