N8n CyberSecurity Workflows

Security automation with n8n ideas: 100+ Red/Blue/AppSec workflows, integrations, and ready-to-run playbooks.

Generate Convert Improve

Install / Use

npx skills add JoasASantos/n8n-CyberSecurity-Workflows

Installs into whichever agent you are using.

About this skill

Quality Score

0/100

README

🚀 100 n8n Cybersecurity Workflow Ideas

Automation blueprints for Red Team & Pentest, Blue Team (SOC/DFIR/TI), Application Security (AppSec/DevSecOps), and Platform/General Security — all using n8n.

Each idea lists Purpose, Integrations, and a Flow Outline you can translate into n8n nodes (HTTP Request, Execute Command, IF/Switch, Function, Code, Split In Batches, Merge, Set, Move Binary Data, Wait, Cron, Webhook, Email/Slack/Teams, PostgreSQL/MongoDB/Redis, AWS, GCP, Azure, RabbitMQ, Kafka, etc.).

A. Red Team & Pentest (30)

Automated Subdomain Recon Hub
Purpose: Consolidate subdomain intel continuously.
Integrations: Subfinder/Amass (Exec), DNSDB/PassiveTotal (HTTP), Shodan/Censys, Slack, PostgreSQL.
Flow: Cron → Exec(Subfinder/Amass) → HTTP(DNS/Passive) → HTTP(Shodan/Censys) → Merge/Unique → DB upsert → Slack summary.
Attack Surface Change Detector
Purpose: Detect new hosts/ports/services vs last run.
Integrations: Nmap/Naabu/Masscan (Exec), Diff (Function), Jira/Slack.
Flow: Cron → Exec(scan) → Compare with last snapshot (DB) → Create Jira issues per delta → Slack alert.
Cloud Bucket Finder (S3/GCS/Azure)
Purpose: Enumerate public buckets & misconfigs.
Integrations: AWS/GCP/Azure APIs, HTTP HEAD/GET, Slack, CSV export.
Flow: Cron → List buckets → Check ACL/public URLs → IF public → notify Slack + write CSV to S3.
Credential Spraying Orchestrator (Lab/Test Only)
Purpose: Controlled spray against lab IdP for detection tuning.
Integrations: Custom IdP/API, Delay/Rate-limit, Secret store.
Flow: Webhook list → Split → Wait between attempts → HTTP(Auth) → Collect results → Red/Blue joint report.
GoPhish Campaign Launcher
Purpose: Spin phishing tests end-to-end.
Integrations: GoPhish API, Google Sheets (targets), Slack/Email, S3 for evidence.
Flow: Trigger → Fetch targets → GoPhish API(create campaign) → Poll stats → Export CSV/PDF → Send digest.
Malicious Macro Build Conveyor (PoC)
Purpose: Generate PoC docs for awareness labs.
Integrations: Dockerized builder, Git repo, Hashing node, VT private sandbox (optional).
Flow: Webhook payload → Build (Docker) → Hash → Store to S3 → Share link + Slack.
Payload Inventory & Hash Tracker
Purpose: Track artifacts, hashes, and usage.
Integrations: S3, PostgreSQL, Slack.
Flow: Upload webhook → Compute SHA256 → DB upsert (who/when/use) → Notify Slack.
C2 Beacon Event Forwarder
Purpose: Stream C2 events to collab channels.
Integrations: CS/Havoc/Sliver webhooks, Slack/Discord, TimescaleDB.
Flow: Webhook(C2) → Transform → Insert DB → Slack threaded updates per host.
Initial Access Monitor (Decoy Links)
Purpose: Observe clicks, IPs, User-Agents.
Integrations: n8n Webhook, GeoIP, AbuseIPDB.
Flow: Webhook click → Enrich(GeoIP/ASN) → IF(bad reputation) → tag IOC → Push to TI DB.
Exfiltration Simulation to Cloud
Purpose: Test DLP detection.
Integrations: S3/GDrive/Dropbox, Slack, Timer.
Flow: Cron → Upload decoy file → Verify receipt → Notify SOC channel.
AV/EDR Evasion Test Matrix Runner (Lab)
Purpose: Run known OPSEC variations against lab EDR.
Integrations: Exec, Git repo of samples, Jira.
Flow: Schedule → Execute cases → Collect detections → Auto-create Jira tasks for misses.
TLS/Cert Recon Harvester
Purpose: Track cert issuance & SANs.
Integrations: crt.sh, Censys, DB, Email.
Flow: Cron → Query certs → Diff vs history → Email changes.
Shadow IT Finder (App Enumeration)
Purpose: Identify unmanaged domains/apps.
Integrations: SecurityTrails, Shodan, HTTP banner grabs.
Flow: Fetch domains → HTTP checks → Tag suspicious → Report.
Vuln Exploit Window Notifier
Purpose: Alert when a new PoC drops for in-scope CVE.
Integrations: GitHub RSS, NVD, Exploit-DB, Slack.
Flow: Poll feeds → Filter by CVEs seen in scans → Slack “exploit available” ping.
Password Dump Honeytoken Telemetry
Purpose: Detect credential reuse events.
Integrations: Canarytokens, Webhook, TI DB.
Flow: Honeytoken fire → Enrich IP → Store IOC → Notify.
Adversary Path Builder (ATT&CK)
Purpose: Compose ordered technique runs.
Integrations: JSON (technique sets), Exec scripts, Confluence export.
Flow: Select profile → Iterate techniques → Log output → Publish runbook.
Browser Exploit Canary (XSS)
Purpose: Receive callbacks for injected beacons.
Integrations: Webhook, Slack, urlscan.io.
Flow: Host payload → When fired → Slack + store evidence.
SSRF Canary Endpoint
Purpose: Detect SSRF attempts during tests.
Integrations: Webhook, GeoIP, Headers parser.
Flow: Receive hits → Parse metadata → Map source app → Report.
Perimeter Tech Stack Mapper
Purpose: WhatWeb/Wappalyzer at scale.
Integrations: Exec(whatweb) or HTTP(Wappalyzer), DB.
Flow: Enumerate targets → Fingerprint → Store/Trend.
Default Creds Sweep (Lab)
Purpose: Validate controls block weak creds.
Integrations: HTTP basic/digest, SSH, SNMP, Slack.
Flow: Parametrized list → Parallel attempts → Results table → Slack.
API Fuzzing Loop (Dev/Test)
Purpose: Fuzz endpoints nightly.
Integrations: ZAP/Ffuf/Katana, CI callbacks.
Flow: Cron → Discover → Fuzz → Deduplicate → File Jira bugs.
Email Security Bypass Lab Orchestrator
Purpose: Test mail controls (EOP/GWS).
Integrations: SMTP, IMAP/Gmail API, VirusTotal.
Flow: Send test set → Pull verdicts → Score bypass rate → Report.
Windows Lateral Movement Lab Runner
Purpose: Practice PSRemoting/WMI/SMB.
Integrations: WinRM node/SSH to jump host, Logging DB.
Flow: Task list → Execute → Capture outputs → Heatmap.
Phishing Landing Page Telemetry
Purpose: High-fidelity user behavior.
Integrations: Webhook (form), Device fingerprint, GeoIP.
Flow: Capture → Normalize → Risk scoring → Export CSV.
Recon to Report (One-Click)
Purpose: Draft recon PDF from data.
Integrations: DB → Markdown → PDF, Confluence.
Flow: Query latest intel → Render Markdown → Convert PDF → Publish.
Bluetooth/IoT Discovery (Lab)
Purpose: Detect BLE beacons, rogue IoT.
Integrations: Custom sensor API, DB, Slack.
Flow: Poll sensors → New MACs? → Alert + tag.
WIFI Evil Twin Drill Tracker
Purpose: Simulate & log detections.
Integrations: Exec(hostapd/airmon-ng), Slack, Timeline.
Flow: Start/stop runs → Record detections → Timeline report.
Red Team Debrief Packager
Purpose: Bundle artifacts + timelines.
Integrations: S3, Zip, Confluence/Jira.
Flow: Select engagement → Pull logs → Zip → Upload & link.
OpSec Sanity Checker
Purpose: Check infra hygiene before ops.
Integrations: DNS/WHOIS, CDN, IP rep, Cloud SG.
Flow: Validate → IF leaks/misconfigs → Blocker alert.
C2 Infra Expiry & Burn Plan
Purpose: Auto-retire infra on schedule.
Integrations: Cloud APIs, DNS API, Slack.
Flow: Daily check → If TTL reached → Destroy resources → Log.

B. Blue Team / SOC / DFIR (35)

Threat Intel Ingest & Normalize
Purpose: Aggregate OTX/MISP/VT/AbuseIPDB.
Integrations: HTTP, CSV/JSON, PostgreSQL/Elastic.
Flow: Cron → Fetch feeds → Map fields (STIX-ish) → Upsert → De-dup metrics.
IOC Enrichment Micro-SOAR
Purpose: On-demand IP/URL/hash enrichment.
Integrations: VirusTotal, urlscan.io, WHOIS, Shodan.
Flow: Webhook IOC → Parallel enrich → Confidence score → Respond with JSON.
Impossible Travel Detector
Purpose: Geo-anomalies in IdP logins.
Integrations: Okta/Azure AD, GeoIP, Slack/Jira.
Flow: Pull events → Sort by user → Velocity calc → Alert.
OAuth App Risk Auditor
Purpose: Risky third-party OAuth grants.
Integrations: Google/M365 Graph, Sheets, Slack.
Flow: Pull grants → Score scopes → Notify owners.
SIEM → Slack Alert Router
Purpose: Targeted, deduped alerting.
Integrations: Splunk/Elastic API, Slack threads.
Flow: Poll alerts → IF severity+not seen → Post thread per incident.
EDR Noise Tamer
Purpose: Suppress known benigns, highlight real.
Integrations: CrowdStrike/Defender API, Redis cache.
Flow: Ingest → Check allowlist cache → IF new → escalate.
Phishing Auto-Triage
Purpose: Classify, detonate, verdict.
Integrations: Gmail/Graph, VT/AnyRun, Jira.
Flow: Fetch reported → Extract URLs/attachments → Sandbox → Verdict → Ticket.
Ransomware Canary Tripwire
Purpose: Early encryption detection.
Integrations: SMB share watch, Slack, IR runbook link.
Flow: Monitor canary changes → IF entropy spike → Page on-call.
DNS Tunneling Heuristics
Purpose: Spot long, frequent queries.
Integrations: DNS logs (Elastic), Function scoring.
Flow: Daily job → Flag FQDNs → TI cross-check → Alert.
Beaconing Periodicity Detector
Purpose: C2-like intervals.
Integrations: Proxy/NetFlow, FFT periodicity (Function/Code).
Flow: Pull flows → Compute periodogram → Alert candidates.
**URL Detonation P