Description
This workflow is designed to automate the security reputation check of domains and IP addresses using multiple APIs such as VirusTotal, AbuseIPDB, and Google DNS. It assesses potential threats including malicious and suspicious scores, as well as email security configurations (SPF, DKIM, DMARC). The analysis results are processed by AI to produce a concise assessment, then automatically updated into Google Sheets for documentation and follow-up.
How It Works
-
Automatic Trigger – The workflow runs periodically via a Schedule Trigger.
-
Data Retrieval – Fetches a list of domains from Google Sheets with status "To do".
-
Domain Analysis – Uses VirusTotal API to get the domain report, perform a rescan, and check IP resolutions.
-
IP Analysis – Checks IP reputation using AbuseIPDB.
-
Email Security Validation – Verifies SPF, DKIM, and DMARC configurations via Google DNS.
-
AI Assessment – Analysis data is processed by AI to produce a short summary in Indonesian.
-
Data Update – The results are automatically updated to Google Sheets, changing the status to "Done" or adding notes if potential threats are found.
How to Setup
- Prepare API Keys
- Sign up and obtain API keys from VirusTotal and AbuseIPDB.
- Set up access to Google Sheets API.
- Configure Credentials in n8n
- Add VirusTotal API, AbuseIPDB API, and Google Sheets OAuth credentials in n8n.
- Prepare Google Sheets
- Create a sheet with columns No, Domain, Customer, Keterangan, Status.
- Ensure initial data has the status "To do".
- Import Workflow
- Upload the workflow JSON file into n8n.
- Set Schedule Trigger
- Define the checking interval as needed (e.g., every 1 hour).
- Test Run
- Run the workflow manually to ensure all API connections and Google Sheets output work properly.