Security automation with n8n one key, every workflow

n8n security flows die in credential sprawl

The endpoints that solve it

Wiring it into n8n in under five minutes

{
  "nodes": [
    {
      "name": "DFIR Enrich IOCs",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "method": "POST",
        "url": "https://api.dfir-lab.ch/v1/enrichment/lookup",
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "sendBody": true,
        "contentType": "json",
        "jsonBody": "={{ { indicators: $json.indicators } }}"
      },
      "credentials": {
        "httpHeaderAuth": { "id": "dfir-lab-api-key", "name": "DFIR Platform" }
      }
    }
  ]
}

1. 01
   Step 01

   Create the credential

   In n8n → Credentials → New → HTTP Header Auth. Name: `Authorization`. Value: `Bearer <your_api_key>`. Save as `DFIR Platform`.

2. 02
   Step 02

   Add the HTTP Request node

   Drop a HTTP Request node into your workflow. Method: POST. URL: `https://api.dfir-lab.ch/v1/enrichment/lookup` (or `/phishing/analyze`, `/exposure/scan`). Authentication: Generic → HTTP Header Auth → select `DFIR Platform`.

3. 03
   Step 03

   Shape the body

   Send Body: on, JSON. Use an expression to pass indicators from upstream nodes — e.g. `{{ { indicators: $json.extracted_iocs } }}` from an IMAP trigger or a Set node.

4. 04
   Step 04

   Fan out results

   Use Split In Batches to rate-limit where needed, then an IF node on `verdict === "malicious"` to branch into containment actions (Slack alert, ticket creation, firewall block).

5. 05
   Step 05

   Validate before wiring

   Sanity-check the response shape using the public `/ioc-check` tool in the browser first — same enrichment pipeline, no signup needed.

Pricing that tracks your workload

1. 01

   Single flow — IOC enrichment for a small SOC (40 IOCs/day)

   40 × 30 × 3 credits = 3,600 credits/month — overshoots Starter; 15 IOCs/day = 15 × 30 × 3 = 1,350 credits/mo

   15 IOCs/day fits Professional ($99, 2,500 credits). For 5 IOCs/day (5 × 30 × 3 = 450 credits) Starter ($29, 500 credits) is the right fit.
2. 02

   Multi-flow SecOps — phishing + IOCs + weekly exposure scan

   (30 phishing × 1) + (90 IOCs × 3) + (4 weekly scans × 10) = 30 + 270 + 40 = 340 credits/month

   Fits Starter ($29, 500 credits) with room to grow, if volumes stay modest. Most growing MSPs land here first.
3. 03

   MSP pipeline — 5 client tenants, daily enrichment + scans

   (5 × 20 IOCs × 22 workdays × 3) + (5 × 4 weekly × 10) = 6,600 + 200 = 6,800 credits/month

   Beyond Professional (2,500) — take Professional + a 5,000-credit top-up, or move to Enterprise for unlimited-usage pricing.

Three ways to evaluate

Frequently asked

Q / 01

Is there an official n8n community node for DFIR Platform?

Not today. The sanctioned path is n8n's built-in HTTP Request node (n8n-nodes-base.httpRequest) with an HTTP Header Auth credential holding `Authorization: Bearer <api_key>`. That covers every endpoint with zero maintenance overhead on either side — a dedicated community node may land later, but it wouldn't unlock new capabilities.

Q / 02

How do I handle rate limits inside n8n?

The enrichment endpoint accepts batched `indicators[]` arrays, so prefer one call with 10 IOCs over 10 calls with 1 IOC each. For high-volume loops, use n8n's Split In Batches node with a Wait node between iterations. Non-2xx responses include a JSON `error` — wire an IF node on `$json.error` for retry / backoff.

Q / 03

Can I use this for MSP / reseller workflows?

Yes. Unlike several free-tier TI APIs that explicitly forbid commercial use, DFIR Platform's paid tiers (Starter and up) permit MSP and reseller usage. Dedicated sub-accounts per client tenant are an Enterprise feature.

Q / 04

Does the HTTP Request node work with self-hosted n8n and n8n.cloud?

Both. The HTTP Request node is a core n8n node — identical behavior on n8n.cloud, Docker self-host, and desktop. The only difference worth mentioning: egress IP will differ between the two, so if you IP-allowlist outbound traffic from your automation, account for that.

Q / 05

What happens if an indicator is unknown to every source?

The response still returns a normalized verdict with `reputation: "unknown"` and an empty `sources[]` array for that indicator. No partial failures — you always get a predictable shape, which makes downstream n8n logic much easier to write.

Q / 06

Can I self-host DFIR Platform alongside self-hosted n8n?

Self-hosted DFIR Platform is Enterprise-only. If you already run n8n on-prem and need the TI layer air-gapped too, get in touch — otherwise the SaaS API is what every self-serve tier ships against.