Format port service data as a Markdown table

After identifying the open ports, the next step is to organize this information neatly. This node converts the data gathered from the previous steps into a Markdown table format.

It's crucial for readability and makes it easier to parse through the port and service information. This formatted data can then be seamlessly integrated into documentation or reports, ensuring that the information is accessible and understandable for further analysis or sharing with team members.

Query Shodan for unexpected open ports

This stage of the workflow leverages Shodan, a search engine for internet-connected devices, to identify running services on each IP port.

Once the services and ports are returned, the split out services node extracts all the services to be filtered at once.

If an unexpected port is found, it allows the service to pass the service through the filter node.

Workflow Overview

The n8n workflow initiates with a node that fetches a list of IP addresses and their specified ports from a security system, which is essential for ongoing surveillance of network integrity.

The data is expected to be in JSON format, detailing each IP with an array of associated ports to be monitored. While the example provided showcases a basic API call, in practice, this should be replaced with a call to the organization's own security system.

It's important to note that error handling is not included in this example and should be implemented according to the specific data formatting and error response protocols of the user's system. The expectation for successful execution is that the incoming data conforms to the predefined JSON structure.

Get list of IPs from your IPS or database

This section retrieves a current list of IP addresses and their associated ports that require monitoring from your Intrusion Prevention System (IPS). It is essential to maintain an updated list to monitor for any unauthorized changes or traffic. The expected format for each entry is a JSON object containing the IP address and an array of ports.

Our sample api call below can be replaced with api access to your IPS. To ensure it works, this workflow expects data to be in the following format:

[
  {
    "ip": "116.202.106.35",
    "ports": [
      5678,
      80
    ]
  },
  {
    "ip": "188.114.96.9",
    "ports": [
      8080,
      80
    ]
  }
]

Post to TheHive

The final step in the process involves posting the findings to TheHive - a scalable, open-source and free Security Incident Response Platform.

If the workflow has identified an unexpected open port, it creates an alert in TheHive. This integration ensures that any potential security issues are escalated appropriately, and the relevant teams can begin the incident response process immediately, leveraging TheHive's powerful case management capabilities.

Iterate Through IP addresses

The "Split In Batches" node is configured with a batch size of one, ensuring that the array of IP addresses received is processed one at a time.

This approach allows for a focused analysis of each detection, ensuring no detail is overlooked.

Following this, the "Split out services" node further along dissects each service to extract and separately handle the array of behaviors associated with them.

By processing these elements one by one, we effectively manage the workflow's load, maintaining optimal performance and adherence to external APIs' rate limits, crucial for the seamless operation of our security protocols.

Weekly_Shodan_Query___Report_Accidents__no_function_node_

Purpose and structure

This folder contains the Weekly_Shodan_Query___Report_Accidents__no_function_node_ workflow. Its executable nodes use filter, html, httpRequest, itemLists, markdown, scheduleTrigger, set, splitInBatches, theHive. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

Every Monday

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Filter/1751_Filter_Schedule_Automation_Scheduled.json MIT; preserve source notices.