n8n Workflow: 1993 Suspicious Login Detection

This n8n workflow is designed to detect and respond to suspicious login attempts by querying a PostgreSQL database for login events, analyzing them for unusual patterns, and then taking appropriate action, such as sending alerts via Slack or email, or updating a database.

What it does

This workflow automates the following steps:

1. Triggers on Webhook: The workflow starts when a webhook is received, initiating the suspicious login detection process.
2. Queries Login Events: It connects to a PostgreSQL database to fetch recent login events.
3. Processes Login Data: The retrieved data is then processed to extract relevant information for analysis.
4. Checks for Suspicious Activity: The workflow includes logic (likely within the If or Switch nodes, or custom code) to identify patterns indicative of suspicious logins (e.g., multiple failed attempts, logins from unusual locations, rapid logins from different IPs).
5. Notifies via Slack (if suspicious): If a login is flagged as suspicious, an alert is sent to a designated Slack channel.
6. Notifies via Email (if suspicious): Additionally, an email notification is sent to relevant personnel for suspicious activities.
7. Updates Database (if suspicious): The workflow can also update the PostgreSQL database, potentially marking the suspicious login or logging the alert.
8. Merges Paths: Regardless of whether the login was suspicious or not, the workflow paths merge to ensure a unified conclusion.
9. Performs Additional HTTP Request: An HTTP request is made, possibly to an external system for logging, further analysis, or to trigger another process.

Prerequisites/Requirements

To use this workflow, you will need:

• n8n Instance: A running n8n instance.
• PostgreSQL Database: Access to a PostgreSQL database containing login event data. You will need the database credentials (host, port, database name, user, password).
• Slack Account: A Slack workspace and a Slack API token configured in n8n credentials to send messages.
• Gmail Account: A Gmail account configured in n8n credentials to send email alerts.
• Webhook Trigger: An external system or process capable of sending HTTP POST requests to the n8n webhook URL to initiate the workflow.

Setup/Usage

1. Import the workflow: Import the provided JSON into your n8n instance.
2. Configure Credentials:
   • Postgres: Set up a new PostgreSQL credential with your database connection details.
   • Slack: Set up a new Slack API credential.
   • Gmail: Set up a new Gmail API credential.
3. Configure Webhook: The "Webhook" node will provide a unique URL. This URL should be used by the external system that triggers this workflow (e.g., a security monitoring tool, an application's event logger).
4. Customize Logic (Optional):
   • Review the "If" and "Switch" nodes (IDs 20 and 112) to understand the current logic for identifying suspicious logins. Adjust the conditions as needed to match your specific criteria for suspicious activity.
   • Examine the "Code" node (ID 834) if present, as it might contain custom JavaScript logic for data manipulation or advanced detection.
   • The "Edit Fields (Set)" node (ID 38) can be used to transform or prepare data before sending alerts or updating the database.
   • The "HTML" node (ID 842) might be used for formatting email content or extracting specific details from webhooks.
5. Activate the Workflow: Once configured, activate the workflow in n8n.

This workflow provides a robust foundation for proactive security monitoring and incident response for login activities.