Automatische Analyse von URL-Phishing und Bedrohungen

• •Slack Bot Token oder Webhook URL
• •HTTP Webhook-Endpunkt (wird von n8n automatisch generiert)

{
  "meta": {
    "instanceId": "558d88703fb65b2d0e44613bc35916258b0f0bf983c5d4730c00c424b77ca36a",
    "templateCredsSetupCompleted": true
  },
  "nodes": [
    {
      "id": "6f7ace63-a7d6-498e-9805-3de8f00b4275",
      "name": "NixGuard- & Wazuh-Workflow ausführen",
      "type": "n8n-nodes-base.executeWorkflow",
      "position": [
        -420,
        -1220
      ],
      "parameters": {
        "options": {},
        "workflowId": {
          "__rl": true,
          "mode": "list",
          "value": "I0nUORqYTwDFZa51",
          "cachedResultName": "Get Real-Time Security Insights with NixGuard RAG and Wazuh Integration"
        },
        "workflowInputs": {
          "value": {},
          "schema": [],
          "mappingMode": "passThrough",
          "matchingColumns": [],
          "attemptToConvertTypes": false,
          "convertFieldsToString": true
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "da86d2fb-89ab-4431-a6a9-6ccbd0f66121",
      "name": "NixGuard AI-Zusammenfassung & Wazuh-Erkenntnisse formatieren",
      "type": "n8n-nodes-base.set",
      "position": [
        -200,
        -1220
      ],
      "parameters": {
        "values": {
          "string": [
            {
              "name": "ai_summary",
              "value": "={{ $json.output }}"
            }
          ]
        },
        "options": {}
      },
      "typeVersion": 2
    },
    {
      "id": "c0ac70b6-0545-4681-af88-e3baae9d658e",
      "name": "(Optional) Slack-Warnung für Hochrisiko-Ereignisse senden",
      "type": "n8n-nodes-base.slack",
      "disabled": true,
      "position": [
        40,
        -1220
      ],
      "webhookId": "292c465e-1f1e-4c22-9947-ccffafbf45e2",
      "parameters": {
        "text": "=🚨 *NixGuard IP Analysis* 🚨\n\n*AI Summary:*\n{{ $json.ai_summary }}",
        "otherOptions": {},
        "authentication": "oAuth2"
      },
      "typeVersion": 2
    },
    {
      "id": "64dfc08c-5b6c-4982-b779-ab368cfabc73",
      "name": "Webhook-Trigger",
      "type": "n8n-nodes-base.webhook",
      "active": false,
      "position": [
        -640,
        -980
      ],
      "webhookId": "e74aeb1a-0659-4a89-8ede-17bb9fdbe317",
      "parameters": {
        "path": "e74aeb1a-0659-4a89-8ede-17bb9fdbe317",
        "options": {}
      },
      "typeVersion": 1
    },
    {
      "id": "2b8da30e-22d6-4900-bc3d-37c5a4cfb3c4",
      "name": "(REAL-WORLD USE)1",
      "type": "n8n-nodes-base.set",
      "position": [
        -640,
        -1220
      ],
      "parameters": {
        "values": {
          "string": [
            {
              "name": "apiKey",
              "value": "PASTE_YOUR_NIXGUARD_API_KEY_HERE"
            },
            {
              "name": "chatInput",
              "value": "Scan this url for me: https://thenex.world"
            }
          ]
        },
        "options": {}
      },
      "typeVersion": 2
    },
    {
      "id": "c22b6b46-ee9a-4ed5-82ef-d693f7e1b7b3",
      "name": "__PROTECTED_80__-Schlüssel & Initial Prompt setzen",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -200,
        -1000
      ],
      "parameters": {
        "color": 7,
        "width": 520,
        "height": 380,
        "content": "### ⚡️ Next Steps: Automate Your SOC/IR Process\n\nThis workflow delivers actionable intelligence. The `Set` node formats the powerful insights from NixGuard and Wazuh, ready to fuel your SOAR playbooks.\n\nFrom here, you can automate your entire security response:\n- 🚨 **Enable the Slack Node**: Add your credentials to immediately start receiving alerts.\n- 🎟️ **Create Jira Tickets**: Add a Jira node to automatically create an incident ticket for high-risk events.\n- 📊 **Log Results**: Connect a Google Sheets or database node to log every analysis for auditing and reporting.\n- 🛡️ **Trigger Remediation**: Connect another `Execute Workflow` node to a workflow that blocks the malicious IP on your firewall."
      },
      "typeVersion": 1
    },
    {
      "id": "5794f296-fa9a-4b6e-a6fa-eef14f78b225",
      "name": "Nächste Schritte: Automatisierte Reaktion2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1280,
        -1220
      ],
      "parameters": {
        "color": 7,
        "width": 540,
        "height": 440,
        "content": "### 🎯 Workflow Overview: The Dispatcher\n\nThis workflow acts as a **Dispatcher**. Its only job is to provide an input (like an IP address) and an API key to trigger your main, more complex analysis workflow.\n\nThis powerful pattern allows you to build your core NixGuard & Wazuh analysis logic once and then trigger it from many different sources (webhooks, other workflows, schedules, etc.).\n\n**Why use this pattern?**\n- **Reusable Logic**: Build your complex analysis once and call it from anywhere.\n- **Simplicity & Focus**: This workflow handles the *when* and *how* of starting the job, while the main workflow handles the *what*.\n\n---\n**Learn more about NixGuard:** https://thenex.world\n\n**Tags:** `IP Analysis`, `Threat Intelligence`, `Wazuh`, `SOAR`, `SOC`, `NixGuard`, `Free`, `AI`, `Incident Response`, `Cybersecurity`, `Automation`, `SIEM`"
      },
      "typeVersion": 1
    },
    {
      "id": "a8687553-569a-41cf-8ab3-175a031ad6db",
      "name": "Workflow-Überblick2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -640,
        -1740
      ],
      "parameters": {
        "color": 7,
        "width": 560,
        "height": 440,
        "content": "### ⚙️ Critical Setup: Go Live in 2 Steps\n\nThis template is a 'dispatcher' and requires two actions to function correctly.\n\n1️⃣ **Add Your API Key:**\n   - Click the blue **`Set API Key & Initial Prompt`** node.\n   - In the `apiKey` field, replace the placeholder with your actual NixGuard API key.\n\n2️⃣ **Connect the Main Workflow:**\n   - Click the **`Execute NixGuard & Wazuh Workflow`** node.\n   - In the `Workflow` field, select your main `Get Real-Time Security Insights...` workflow from the list.\n\n---\n*Don't have the main workflow yet? You'll need to create or import it first. Don't have a key? Get one for free at [thenex.world/security/subscribe](https://thenex.world/security/subscribe)*\n\n   - **Don't have the main workflow yet?** Get it here:\n   https://n8n.io/workflows/4693-get-real-time-security-insights-with-nixguard-rag-and-wazuh-integration/"
      },
      "typeVersion": 1
    }
  ],
  "pinData": {},
  "connections": {
    "2b8da30e-22d6-4900-bc3d-37c5a4cfb3c4": {
      "main": [
        [
          {
            "node": "6f7ace63-a7d6-498e-9805-3de8f00b4275",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "6f7ace63-a7d6-498e-9805-3de8f00b4275": {
      "main": [
        [
          {
            "node": "da86d2fb-89ab-4431-a6a9-6ccbd0f66121",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "da86d2fb-89ab-4431-a6a9-6ccbd0f66121": {
      "main": [
        [
          {
            "node": "c0ac70b6-0545-4681-af88-e3baae9d658e",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}