N8n

★ 5.6 · n8n · medium · 10 nodes

N8n is an n8n automation template for security incident response orchestration (SOAR) within a SOC team. Reach for it when alerts are piling up in an event queue and analysts have to coordinate manually, when you need to notify on-call staff in Telegram the moment an incident is detected, or when every incident must be logged to a database automatically without human copy-paste. Trigger: webhook — the workflow starts on an incoming HTTP request, for example from a SIEM or monitoring system. Integrations: Kafka (consuming the security event stream), Postgres (storing incidents and their statuses), Telegram (pushing notifications to duty analysts). The direction is incident response and orchestration, not detection or correlation — upstream tooling that produces alerts is required separately. Suitable for teams running a self-hosted n8n instance with access to an existing Kafka broker and Postgres database; not a fit for fully managed cloud stacks where self-hosting n8n is not an option.