Suspicious Login Detection

n8n template #1993

Summary

This n8n workflow is designed for security monitoring and incident response when suspicious login events are detected. It can be initiated either manually from within the n8n UI for testing or automatically triggered by a webhook when a new login event occurs. The workflow first extracts relevant data from the incoming webhook payload, including the IP address, user agent, timestamp, URL, and user ID. It then splits into three parallel processing paths. In the first path, it queries GreyNoise's Community API to retrieve information about the investigated IP address. Depending on the classification and trust level received from GreyNoise, the alert is given a High, Medium, or Low priority. Th

How to set it up

Open template #1993 on n8n.io and click Use for free, or copy the template JSON and paste it onto an empty canvas in n8n.
Create 3 credentials under Credentials → Add credential: Postgres, Slack, Gmail. Then open each of those nodes and pick the credential.
Click Execute workflow and step through each node's output to confirm the data looks right.
Toggle the workflow to Active so its trigger runs on its own.

Hand off to your agent

Prompt

Help me set up the n8n workflow "Suspicious Login Detection" (https://n8n.io/workflows/1993). It uses: HTTP Request, Postgres, Slack, Gmail, Code, HTML. Import the template JSON into my n8n instance, list every credential I need to create, and walk me through testing it.

Paste into Claude Code and it will do the rest.

Apps and nodes

HTTP Request Postgres Slack Gmail Code HTML

Questions

Yes. n8n Team published it free on n8n.io as a verified creator, and it has 6,442 views. It runs on n8n Cloud or a self-hosted n8n instance.

Postgres, Slack, Gmail. The other 3 nodes are built into n8n.

Similar workflows

NameViews