Website Security Audit using AI and Threat Intelligence - n8n Workflow

Ideal Users for this Automation

Cybersecurity Analysts: Needing a quick, automated threat intelligence lookup tool.
DevOps Engineers: Who require rapid security configuration checks on new deployments.
Technical Content Writers: Looking for powerful n8n templates that showcase complex integrations.
n8n Automation Specialists: Seeking advanced examples of using Langchain Agents and Code nodes together.

• IT Administrators: Who need to check URLs against known indicators of compromise (IOCs).

Maintaining web security requires proactive checks, often involving manual analysis of HTTP headers, status codes, and external threat intelligence feeds. This advanced n8n workflow transforms this cumbersome process into an efficient, automated system.

The automation starts with a user-friendly form submission (the initial n8n trigger). It simultaneously performs a direct HTTP request to analyze the server's response headers and queries AlienVault OTX (Open Threat Exchange) for known malicious indicators associated with the domain.

The core strength of this n8n template lies in its data consolidation and expert AI analysis. A custom n8n node (Code) prepares all the disparate data points—status codes, security headers, and AlienVault findings—and feeds them to a specialized OpenAI Agent. This Langchain Agent, acting as a cybersecurity expert, analyzes the configuration details, identifies vulnerabilities, suggests mitigation steps, and generates a professional report. This sophisticated n8n workflow saves significant time and provides actionable insights.

The entire process is initiated by the On form submission n8n trigger node, where a user inputs the target URL.

1. Dual Data Collection: The submitted URL immediately branches into two simultaneous paths: a standard HTTP Request to fetch the site's headers and status, and an AlienVault HTTP Request which extracts the domain and checks it against AlienVault's massive threat intelligence database.


2. Data Preparation (Code Node): The Prepare Data for AI n8n node receives data from both paths. It consolidates the raw HTTP headers, status code, and AlienVault results (e.g., sections, pulse count, WHOIS info). It also performs preliminary checks, flagging things like missing security headers or known threats identified by OTX.


3. Expert AI Analysis (Langchain Agent): The consolidated data is passed to the Security Configuration Audit Agent. This specialized n8n node, powered by a sophisticated prompt defining it as a 'cybersecurity expert,' uses the connected OpenAI Chat Model to critically review the data, diagnose vulnerabilities, and propose technical solutions and potential exploits.


4. Report Formatting: The AI-generated plain text report is processed by the Format Report for Email Code n8n node, which converts the output into structured HTML.


5. Delivery: Finally, the Send Security Report Gmail n8n node delivers the professional, detailed HTML report to the administrator or requester.

To deploy this comprehensive n8n workflow, follow these steps:

1. Import the n8n Workflow: Copy the provided JSON data and paste it directly into your n8n instance using the 'New' -> 'Import from JSON' function.


2. Set Up Credentials: This n8n template requires three external service connections:

1. Configure the Trigger: The On form submission n8n trigger node will automatically generate a public URL. Share this link for users to input the URLs they want audited.


2. Activate: Save the n8n workflow and activate it to start processing incoming submissions.

This n8n workflow leverages several powerful nodes:

On form submission (n8n trigger): The starting point for the automation. Collects the URL (Landing Page) from the user.
HTTP Request (n8n node): Performs a GET request to the target URL. Key configuration includes requesting the full response text to capture detailed headers and status codes.
AlienVault HTTP Request (n8n node): Queries the OTX API. This node dynamically builds the URL using the input hostname after stripping 'http(s)://' prefixes. Requires specialized alienVaultApi credentials.
Prepare Data for AI (Code n8n node): Essential for data orchestration. It merges output from the two previous nodes, checking for initial red flags (like missing headers or OTX hits), and formats the data for optimal AI consumption.
Security Configuration Audit (Langchain Agent n8n node): The core intelligence engine. It is configured with a 'cybersecurity expert' system prompt to analyze complex security configuration data and provide actionable recommendations.
OpenAI Chat Model (n8n node): Provides the large language model backend (chatgpt-4o-latest) used by the Agent to perform the analysis.
Format Report for Email (Code n8n node): Transforms the plain text AI output into readable HTML, suitable for professional email delivery.
Send Security Report (Gmail n8n node): Handles the final notification, using the dynamic subject line based on the audited URL.