Log Anomaly Detection and Security Alerting via Slack - n8n Workflow

IT Teams and SysAdmins: Ideal for monitoring server or application logs for unauthorized access attempts.
Security Specialists: Use this simple n8n template as an early-warning tool against common attacks like brute-force attempts.
DevOps Teams: To track unusual activity in staging or production environments.
Small to Medium Enterprises (SMEs): Businesses needing effective security enhancement without investing in expensive SIEM tools. This n8n node structure provides basic SIEM functionality.

Manually sifting through endless security logs to detect a brute-force attack or suspicious login patterns is tedious and prone to human error. This comprehensive n8n workflow solves that critical problem by providing basic Security Information and Event Management (SIEM) functionality. The workflow runs continuously, triggered by a schedule, to pull recent logs. It utilizes a custom Code n8n node to analyze the data, identifying the count of failed logins and unique source IP addresses. If the failure count exceeds a predefined threshold (in this n8n template, it is set to 5), the system immediately generates a detailed alert. The final Slack n8n node ensures that security personnel are instantly notified of the anomaly, drastically reducing response time to potential threats. This particular n8n workflow is a perfect example of how automation can enhance operational security.

This automation operates as a continuous security monitor, starting with an essential n8n trigger and flowing through data processing and conditional alerting.

1. Scheduled Trigger: The process begins with the Schedule Trigger n8n node, configured to run the entire n8n workflow every minute. This ensures continuous monitoring of the security logs.


2. Fetch Logs: The Fetch Logs n8n node (an HTTP Request) connects to your external log API endpoint (e.g., https://api.yourlogserver.com/logs/recent) to retrieve the most recent batch of security logs.


3. Core Analysis (Code Node): The powerful Count Failed Logins Code n8n node executes custom JavaScript. It filters the incoming logs specifically for the event login_failure, calculates the total number of failures, and extracts a list of unique source IPs. This cleaned data is passed on, ready for evaluation.


4. Threshold Check (If Node): The Failed Logins > Threshold? If n8n node acts as the decision point. It checks if the loginFailureCount derived from the previous step is greater than 5. If this condition is met, a potential anomaly is confirmed, and the n8n workflow proceeds to the alert step.


5. Send Alert (Slack Node): If the threshold is breached, the Send Anomaly Alert Slack n8n node executes, sending a highly visible security alert to the designated channel or user, including the summary of failed attempts and associated IP addresses, ensuring rapid response to the detected threat.

To deploy this n8n workflow template, follow these steps:

1. Import: Copy the provided JSON data and paste it directly into your n8n instance to import the n8n workflow.


2. Schedule Trigger: Verify the Schedule Trigger is set to your preferred monitoring frequency.


3. HTTP Request Setup: Update the Fetch Logs n8n node to point to your actual log server API endpoint. Ensure any necessary authentication headers (if required by your API) are configured in the node parameters.


4. Slack Credential Setup:

1. Threshold Review: Adjust the rightValue in the Failed Logins > Threshold? If n8n node if you need a higher or lower tolerance for failed attempts.


2. Activate: Save and activate the n8n workflow to begin automatic monitoring.

This n8n workflow utilizes several key nodes to achieve its goal:

Schedule Trigger: This is the primary n8n trigger, initiating the cycle. It is configured to run at a fixed interval (in this case, every 1 minute) to ensure timely log review.
HTTP Request (Fetch Logs): Function: Retrieves the raw JSON log data from the specified external API endpoint (https://api.yourlogserver.com/logs/recent?limit=100). Key Configuration: Requires updating the URL and any necessary authentication.
Code (Count Failed Logins): Function: Contains the core processing logic. It uses JavaScript to filter the raw log data, count login_failure events, and extract unique IPs. Key Configuration: Creates new output data fields: loginFailureCount and summary.
If (Failed Logins > Threshold?): Function: Performs conditional routing. It checks if the loginFailureCount output by the Code n8n node is numerically greater than 5 (gt: 5).

• Slack (Send Anomaly Alert): Function: Sends a high-priority security alert. Key Configuration: Uses an expression to dynamically format the alert message, incorporating the summary, firstFailedAttemptTime, and lastFailedAttemptTime data from the previous n8n nodes.