Suspicious Login Detection and Threat Alert Workflow

This n8n workflow automates security monitoring for suspicious login attempts. Triggered manually or by webhook, it extracts key data like IP, user agent, timestamp, URL, and user ID from the payload. It then branches into three parallel paths: querying GreyNoise Community API for IP reputation and assigning alert priority (High/Medium/Low) based on noise/riot classification before notifying via Slack; fetching geolocation via IP-API and merging with UserParser data for user agent insights; and directly parsing IP/user agent via UserParser API.

Data from all paths merges, and the workflow checks GreyNoise fields for unknown threats. If detected, it queries the last 10 login records for the user from a Postgres database. Discrepancies in location, device, or browser trigger an email notification to the user, enabling rapid incident response.

Benefits include real-time threat prioritization, enriched IP intelligence, and automated alerts, reducing manual investigation time. Ideal for universities or IT teams securing login systems against brute-force, anomalous access, or scanner activity. Use cases: campus authentication monitoring, research lab access protection, or integrating with SIEM tools for scalable security ops.