n8n Cybersecurity Workflows

What it is

A README-style catalog of ~27 automation blueprints for n8n, grouped into Red Team/Pentest, Blue Team (SOC/DFIR/TI), AppSec/DevSecOps, and Platform/General Security. Each entry is an idea, not a ready-to-import workflow: it lists a Purpose, an Integrations list, and a one-line Flow Outline you translate into n8n nodes yourself (HTTP Request, Execute Command, IF/Switch, Function/Code, Split In Batches, Cron, Webhook, Slack/Teams, PostgreSQL/Redis, AWS/GCP/Azure, Kafka, etc.).

What it actually covers

The existing summary frames this as OSINT recon, threat-intel gathering, and monitoring automation. That undersells the offensive half. The catalog is heavily red-team and includes active-attack blueprints: Credential Spraying Orchestrator, GoPhish Campaign Launcher, Malicious Macro Build Conveyor (PoC), C2 Beacon Event Forwarder (Cobalt Strike/Havoc/Sliver webhooks), AV/EDR Evasion Test Matrix Runner, Exfiltration Simulation to Cloud, Default Creds Sweep, Windows Lateral Movement Lab Runner, and API Fuzzing Loop. Defensive/recon entries also exist (Subdomain Recon Hub, Attack Surface Change Detector, TLS/Cert Recon, Vuln Exploit Window Notifier, honeytoken/canary telemetry, Recon-to-Report PDF).

Preconditions / what you're signing up for

• Nothing is importable. There is no n8n workflow JSON — every item is a flow sketch. You do the node wiring, credential setup, and error handling. Effort is closer to "design brief" than "download and run."
• Most flows assume external accounts/tooling: Shodan/Censys, SecurityTrails, GoPhish, VirusTotal, AbuseIPDB, crt.sh, Canarytokens, plus a datastore (PostgreSQL/TimescaleDB/Redis) and a notifier (Slack/Teams).
• Several offensive blueprints are explicitly marked "Lab/Test Only" or "PoC" (Credential Spraying, AV/EDR Evasion, Default Creds Sweep, Windows Lateral Movement, Email Bypass, Bluetooth/IoT). The macro builder and spraying orchestrator are the kind of thing that needs written authorization before touching anything non-lab.

What to do

• Treat this as an idea backlog, not a deliverable. If you want a defensive quick win, the low-risk recon/monitoring entries (Subdomain Recon Hub, Attack Surface Change Detector, TLS/Cert Recon, Vuln Exploit Window Notifier) map cleanly onto Cron → HTTP/Exec → DB diff → Slack and are safe to build.
• Route the offensive/lab entries through your rules-of-engagement process; don't stand them up outside an isolated lab.

Caveats

The page gives no configs, no code, and no n8n export — only integration names and one-line flows. Anything past that (auth, rate limits, secret handling for the Execute Command nodes) is left to you, and running Exec nodes against scanners/C2 tooling carries the usual command-injection and credential-exposure risk n8n does not solve for you.