Score Cloudflare firewall bot threats and suggest manual block actions

by Cyberneticsplus · 9 views · created 2026-07-29 · SecOps

What this workflow does

This workflow has 15 nodes and runs on a schedule (every 15 minutes) (plus 1 other trigger). It uses only n8n's built-in nodes. It also calls api.cloudflare.com over HTTP.

How it runs

Trigger: On a schedule (every 15 minutes) (plus 1 other trigger).

1. Configuration (Code): runs custom JavaScript code
2. Discover zones (HTTP Request): calls api.cloudflare.com (GET)
3. Resolve zone list (Code): runs custom JavaScript code
4. Build events query (Code): runs custom JavaScript code
5. Fetch firewall events (HTTP Request): calls api.cloudflare.com (POST)
6. Aggregate by IP (Code): runs custom JavaScript code
7. Score offenders (Code): runs custom JavaScript code
8. Route by recommendation (Switch): routes items into 2 branches
9. Build block recommendations (Code): runs custom JavaScript code
10. Format review queue (Code): runs custom JavaScript code

HTTP calls to: api.cloudflare.com

Before you upgrade to n8n 3.0

Nodes used (6)

• Schedule Triggern8n-nodes-base.scheduleTrigger
• Manual Triggern8n-nodes-base.manualTrigger
• Coden8n-nodes-base.code
• HTTP Requestn8n-nodes-base.httpRequest
• Switchn8n-nodes-base.switch
• No Operation, do nothingn8n-nodes-base.noOp

From the author

Quick overview This workflow runs on a schedule (or manually) to read Cloudflare firewall events via the Cloudflare GraphQL API, aggregate activity by client IP, and compute deterministic bot-risk scores with evidence-based signals, then routes results into…

View the original on n8n.io → Check your own copy