Detect and route cybersecurity threats with SIEM, Slack, email and PagerDuty

Node by node

1. 1
   Schedule Trigger - Every 15 MinutesTrigger· n8n

   Starts the workflow — on a schedule, a webhook, or manually while you test.

2. 2
   Fetch Network LogsSource· n8n

   Provides or transforms the contact data flowing through the workflow.

3. 3
   Fetch Vulnerability Scan ResultsSource· n8n

   Provides or transforms the contact data flowing through the workflow.

4. 4
   Fetch Threat Intelligence FeedSource· n8n

   Provides or transforms the contact data flowing through the workflow.

5. 5
   Merge All Threat DataSource· n8n

   Provides or transforms the contact data flowing through the workflow.

6. 6
   Analyze & Detect ThreatsSource· n8n

   Provides or transforms the contact data flowing through the workflow.

7. 7
   Check Threat SeverityLogic· n8n

   Branches on the verification result: only deliverable addresses continue to the send; the rest are skipped and flagged.

8. 8
   Send Slack Alert - CriticalSource· n8n

   Provides or transforms the contact data flowing through the workflow.

9. 9
   Verify Email (BillionVerify)Verify· billionverify

   The BillionVerify node verifies the address — status (valid / invalid / risky / catch-all / role / disposable), is_deliverable, and a confidence score — before anything is sent.

10. 10
    Log Medium/Low ThreatsSource· n8n

    Provides or transforms the contact data flowing through the workflow.

11. 11
    Create PagerDuty IncidentSource· n8n

    Provides or transforms the contact data flowing through the workflow.

12. 12
    IF deliverableLogic· n8n

    Branches on the verification result: only deliverable addresses continue to the send; the rest are skipped and flagged.

13. 13
    Store in DatabaseSource· n8n

    Provides or transforms the contact data flowing through the workflow.

14. 14
    Merge All PathsSource· n8n

    Provides or transforms the contact data flowing through the workflow.

15. 15
    Send Email Alert - DetailedSend· n8n

    Sends only to verified, deliverable addresses. Swap in your own provider node if you send elsewhere.

16. 16
    Generate Summary ReportSource· n8n

    Provides or transforms the contact data flowing through the workflow.

17. 17
    Create Security TicketSource· n8n

    Provides or transforms the contact data flowing through the workflow.

18. 18
    Send Summary to Monitoring ChannelSource· n8n

    Provides or transforms the contact data flowing through the workflow.

Three ways to connect