Monitor Security Logs for Failed Login Attempts with Slack Alerts

This n8n workflow automates the process of monitoring security logs for failed login attempts and sending immediate alerts to a Slack channel when a predefined threshold is met. This helps security teams or administrators quickly identify and respond to potential brute-force attacks or unauthorized access attempts.

What it does

This workflow performs the following actions:

1. Schedules Execution: Runs at a regular, configurable interval (e.g., every 5 minutes).
2. Fetches Security Logs: Makes an HTTP request to an external API endpoint to retrieve recent security logs.
3. Processes Logs: Uses a Code node to parse the fetched logs, identify failed login attempts, and count them.
4. Checks Threshold: Evaluates if the number of failed login attempts exceeds a specified threshold.
5. Sends Slack Alert: If the threshold is met, a formatted alert message is sent to a designated Slack channel, notifying the team of the suspicious activity.

Prerequisites/Requirements

To use this workflow, you will need:

• An API Endpoint for Security Logs: A URL that, when queried, returns your system's security logs, preferably in a machine-readable format (e.g., JSON).
• Slack Account: A Slack workspace and a channel where you want to receive the alerts.
• n8n Slack Credential: An n8n credential configured for your Slack workspace with appropriate permissions to post messages.

Setup/Usage

1. Import the Workflow:

   • Download the provided JSON file.
   • In your n8n instance, click "Workflows" in the left sidebar.
   • Click "New" and then "Import from JSON".
   • Paste the JSON content or upload the file.

2. Configure the Schedule Trigger (Node 839 - "Schedule Trigger"):

   • Double-click the "Schedule Trigger" node.
   • Set the desired interval for the workflow to run (e.g., "Every 5 minutes").

3. Configure the HTTP Request Node (Node 19 - "HTTP Request"):

   • Double-click the "HTTP Request" node.
   • In the "URL" field, enter the API endpoint for your security logs.
   • Configure any necessary authentication (e.g., API Key, Basic Auth) under the "Authentication" section, if your API requires it.

4. Configure the Code Node (Node 834 - "Code"):

   • Double-click the "Code" node.
   • Review the JavaScript code. You might need to adjust it based on the exact structure of your security logs to correctly identify and count failed login attempts.
   • The failedLoginThreshold variable within the code defines how many failed attempts trigger an alert. Adjust this value as needed.

5. Configure the If Node (Node 20 - "If"):

   • This node checks if the failedLoginAttempts count (output from the Code node) is greater than or equal to the failedLoginThreshold.
   • No direct configuration is typically needed here unless you want to change the comparison logic.

6. Configure the Slack Node (Node 40 - "Slack"):

   • Double-click the "Slack" node.
   • Select your Slack credential. If you don't have one, click "Create New" and follow the instructions to set up a Slack API token.
   • In the "Channel" field, enter the name of the Slack channel where you want to receive alerts (e.g., #security-alerts).
   • Review the "Text" field to customize the alert message if desired. It currently uses expressions to include the number of failed attempts.

7. Activate the Workflow:

   • Once all nodes are configured, click the "Active" toggle in the top right corner of the workflow editor to enable the workflow.

The workflow will now run on its schedule, monitoring your security logs and alerting your team via Slack when suspicious activity is detected.