Weekly Shodan query - report accidents
Needs changesNeeds changes. This template uses 1 thing(s) that n8n 3.0 removes: Item Lists (legacy). 1 breaking item(s) found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 10 nodes and runs on a schedule (every week at 05:00). Along the way it connects TheHive. It also calls internal.users.n8n.cloud over HTTP.
How it runs
Trigger: On a schedule (every week at 05:00).
- Get watched IPs & Ports (HTTP Request): calls internal.users.n8n.cloud
- For each IP (Loop Over Items (Split in Batches)): loops over the items in batches
- Scan each IP (HTTP Request): calls an HTTP API
- Split out services (Item Lists): reshapes item lists (legacy Item Lists node)
- Unexpected port? (Filter): keeps only the items that match a condition
- Set data to post for each port (Edit Fields (Set)): sets or maps fields
- Convert to table (HTML): parses or builds HTML
- Convert to Markdown (Markdown): converts between Markdown and HTML
- Create TheHive alert (TheHive): uses TheHive
Services it uses
HTTP calls to: internal.users.n8n.cloud
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- Item Lists (legacy) in Split out services: replace with Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used).
| Removed in 3.0 | Replace with |
|---|---|
| Item Lists (legacy) Split out services | Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used) |
Nodes used (9)
- HTTP Request
n8n-nodes-base.httpRequest - Item Lists
n8n-nodes-base.itemLists - Filter
n8n-nodes-base.filter - Edit Fields (Set)
n8n-nodes-base.set - HTML
n8n-nodes-base.html - Markdown
n8n-nodes-base.markdown - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - Schedule Trigger
n8n-nodes-base.scheduleTrigger - TheHive
n8n-nodes-base.theHive
From the author
This n8n workflow, which runs every Monday at 5:00 AM, initiates a comprehensive process to monitor and analyze network security by scrutinizing IP addresses and their associated ports. It begins by fetching a list of watched IP addresses and expected ports…