SecureFlow — n8n Security Incident Response Automation

Automated security incident response platform built on n8n — processes alerts from LogMind, CloudSentry, and external sources, enriches them with threat intelligence, and executes response playbooks in under 5 seconds.

graph TB
    subgraph "Alert Sources"
        LM[LogMind<br/>Log Analysis]
        CS[CloudSentry<br/>Cloud Security]
        EXT[External<br/>Alerts]
    end

    subgraph "SecureFlow n8n Platform"
        WH[Webhook Receivers]
        EN[Threat Enrichment]
        RP[Response Playbooks]
        AL[Approval Logic]
    end

    subgraph "Threat Intelligence"
        VT[VirusTotal API]
        AI[AbuseIPDB]
        VG[VectorGuard API]
        SH[Shodan API]
        WHO[WHOIS API]
    end

    subgraph "Response Actions"
        SL[Slack Alerts]
        JR[Jira Tickets]
        OCI[OCI API<br/>Isolation]
        EM[Email Notifications]
    end

    subgraph "Data Layer"
        PG[(PostgreSQL<br/>Audit Logs)]
        RD[(Redis<br/>Queue)]
        METRICS[Prometheus<br/>Metrics]
    end

    LM --> WH
    CS --> WH
    EXT --> WH

    WH --> EN
    EN --> VT
    EN --> AI
    EN --> VG
    EN --> SH
    EN --> WHO

    EN --> RP
    RP --> AL
    AL --> SL
    AL --> JR
    AL --> OCI
    AL --> EM

    WH --> PG
    RP --> RD
    SL --> METRICS

• Webhook Receivers — HTTP endpoints for LogMind, CloudSentry, external alerts
• Threat Enrichment Nodes — Parallel API calls across VirusTotal, AbuseIPDB, Shodan, WHOIS
• Response Playbooks — Automated incident workflows per threat category
• Approval Logic — Human-in-the-loop gate for destructive actions

• Threat Intel APIs — VirusTotal, AbuseIPDB, Shodan, WHOIS
• Internal APIs — VectorGuard threat query, OCI cloud operations
• Communication — Slack notifications, Jira ticket creation

• PostgreSQL — Audit trails, incident history, SLA metrics
• Redis — Message queuing, workflow state
• Prometheus — Performance metrics, success rates, response times

• Docker & Docker Compose
• Git

git clone https://github.com/sinCodes11/secureflow SecureFlow
cd SecureFlow

cp .env.example .env
# Edit .env with your settings

docker-compose up -d

# Access n8n at http://localhost:5678
# Import workflows from /workflows/

• n8n user auth + API key validation on all webhook endpoints
• Webhook input sanitization and rate limiting
• Secrets via environment variables (Vault-ready)
• Complete audit trail for every automated action

SecureFlow/
├── docker-compose.yml
├── .env.example
├── workflows/
│   ├── malware-response.json
│   ├── brute-force-mitigation.json
│   ├── data-exfiltration.json
│   ├── cloud-remediation.json
│   ├── phishing-analysis.json
│   └── suspicious-login.json
├── mock-apis/
│   ├── app.py
│   ├── requirements.txt
│   └── Dockerfile
├── database/
│   ├── init.sql
│   └── audit-schema.sql
├── docs/
│   ├── playbook-guide.md
│   └── api-integration.md
└── scripts/
    ├── setup.sh
    └── generate-test-data.py

MIT