Automation library · Alerts and monitoring

Detect and route cybersecurity threats with SIEM and Slack

Started by a clock, and works across Email, Postgres and Slack. 16 steps, 1 branch: a working afternoon to understand properly.

Medium

Download free
16 stepsMedium: a working afternoon
1Branch: places the flow splits
0Loops or waits
3Services it connects to

The flow

Starts it 1Logic 5Service 10

The steps in the order they run, from what starts it.

  1. 1Schedule Trigger - Every 15 MinutesSchedule triggerStarts it
  2. 2Fetch Network LogsHttp RequestService
  3. 3Fetch Vulnerability Scan ResultsHttp RequestService
  4. 4Fetch Threat Intelligence FeedHttp RequestService
  5. 5Merge All Threat DataMergeLogic
  6. 6Analyze & Detect ThreatsCodeLogic
  7. 7Check Threat SeverityIfLogic
  8. 8Send Slack Alert - CriticalSlackService
  9. 9Send Email Alert - DetailedEmail SendService
  10. 10Log Medium/Low ThreatsHttp RequestService
  11. 11Create PagerDuty IncidentHttp RequestService
  12. 12Create Security TicketHttp RequestService
  13. 13Store in DatabasePostgresService
  14. 14Merge All PathsMergeLogic
  15. 15Generate Summary ReportCodeLogic
  16. 16Send Summary to Monitoring ChannelSlackService

How it's built

Starts on
A clock
Steps
16, with 1 branch
Size
Medium: a working afternoon
Connects to
Email, Postgres, Slack
Model
None. This is plumbing, not judgement

Questions

What does it need to run?

An n8n account, plus your own Email, Postgres and Slack accounts. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Plan an afternoon. 16 steps is enough that you should read each one before running it.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 16 steps before you point it at anything that matters.