Monitor Entra ID high-risk users with Microsoft Graph, TheHive and Slack

by Muhammad Bin Zohaib ✓ · 21 views · created 2026-09-28 · SecOps

What this workflow does

This workflow has 14 nodes and runs on a schedule (every 30 minutes). Along the way it connects TheHive 5 and Slack. It also calls graph.microsoft.com over HTTP.

How it runs

Trigger: On a schedule (every 30 minutes).

1. Query Risk Detections (HTTP Request): calls graph.microsoft.com
2. Group & Aggregate Per User (Code): runs custom JavaScript code
3. Enrich Risky User (HTTP Request): calls an HTTP API
4. Enrich Recent Sign-Ins (HTTP Request): calls graph.microsoft.com
5. Assess, Correlate & Build Incident (Code): runs custom JavaScript code
6. Query Open TheHive Alerts (TheHive 5): work with query
7. Deduplication Decision (Code): runs custom JavaScript code
8. Alert Already Open? (If): checks a condition and branches into true / false
9. Update TheHive Alert (TheHive 5): update
10. Create TheHive Alert (TheHive 5): uses TheHive 5

…plus 3 more steps. See the full node list below.

Services it uses

TheHive 5Slack

HTTP calls to: graph.microsoft.com

Before you upgrade to n8n 3.0

Nodes used (7)

• HTTP Requestn8n-nodes-base.httpRequest
• Coden8n-nodes-base.code
• TheHive 5n8n-nodes-base.theHiveProject
• Ifn8n-nodes-base.if
• Mergen8n-nodes-base.merge
• Slackn8n-nodes-base.slack
• Schedule Triggern8n-nodes-base.scheduleTrigger

From the author

Quick Overview This workflow polls Microsoft Entra ID Protection for new high-risk risk detections, aggregates them per user, enriches them with risky-user and recent sign-in context from Microsoft Graph, then creates or updates matching alerts in TheHive and…

View the original on n8n.io → Check your own copy