Score DNS threats with VirusTotal, Abuse.ch, HashiCorp Vault and Gemini
UnknownWhat this workflow does
This AI workflow has 34 nodes and runs on a schedule (every 3 minutes). Along the way it connects MySQL, Google Gemini Chat Model, MongoDB and Hashi Vault (community). It also calls threatfox-api.abuse.ch and urlhaus-api.abuse.ch over HTTP.
How it runs
Trigger: On a schedule (every 3 minutes).
- MySQL Pass (Hashi Corp Vault): uses Hashi Corp Vault
- Mongo DB Pass (Hashi Corp Vault): uses Hashi Corp Vault
- Select rows from a table (MySQL): select
- Virus total API TOKEN (Hashi Corp Vault): uses Hashi Corp Vault
- Abuse API TOKEN (Hashi Corp Vault): uses Hashi Corp Vault
- VirusTotal IP Scan (HTTP Request): calls an HTTP API (GET)
- Abuse.CH_ThreatFox request (HTTP Request): calls threatfox-api.abuse.ch (POST)
- Abuse.CH_URLHaus (HTTP Request): calls urlhaus-api.abuse.ch (POST)
- If: checks a condition and branches into true / false
- If: checks a condition and branches into true / false
…plus 22 more steps. See the full node list below.
Services it uses
HTTP calls to: threatfox-api.abuse.ch, urlhaus-api.abuse.ch
Before you upgrade to n8n 3.0
We can't fully verify this one: it relies on 1 community package, and n8n 3.0 turns unverified community packages off by default (N8N_UNVERIFIED_PACKAGES_ENABLED=false).
- Check that n8n-nodes-hashi-vault is verified or supports 3.0 (used in Virus total API TOKEN, Gemini AI Studio, MySQL Pass).
Nodes used (11)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - MySQL
n8n-nodes-base.mySql - HTTP Request
n8n-nodes-base.httpRequest - If
n8n-nodes-base.if - Hashi Corp Vault
n8n-nodes-hashi-vault.hashiCorpVault - AI Agent
@n8n/n8n-nodes-langchain.agent - Google Gemini Chat Model
@n8n/n8n-nodes-langchain.lmChatGoogleGemini - Code
n8n-nodes-base.code - Send Email
n8n-nodes-base.emailSend - MongoDB
n8n-nodes-base.mongoDb - Merge
n8n-nodes-base.merge
From the author
Quick overview Turns DNS traffic into threat verdicts. Each new domain/IP pair is checked with VirusTotal, ThreatFox and URLhaus, scored by deterministic rules in PostgreSQL, reviewed by a Gemini AI agent with pgvector memory, then stored, emailed and…