URL 피싱 및 위협 자동 분석

• •Slack Bot Token 또는 Webhook URL
• •HTTP Webhook 엔드포인트(n8n이 자동으로 생성)

{
  "meta": {
    "instanceId": "558d88703fb65b2d0e44613bc35916258b0f0bf983c5d4730c00c424b77ca36a",
    "templateCredsSetupCompleted": true
  },
  "nodes": [
    {
      "id": "6f7ace63-a7d6-498e-9805-3de8f00b4275",
      "name": "NixGuard & Wazuh 워크플로 실행",
      "type": "n8n-nodes-base.executeWorkflow",
      "position": [
        -420,
        -1220
      ],
      "parameters": {
        "options": {},
        "workflowId": {
          "__rl": true,
          "mode": "list",
          "value": "I0nUORqYTwDFZa51",
          "cachedResultName": "Get Real-Time Security Insights with NixGuard RAG and Wazuh Integration"
        },
        "workflowInputs": {
          "value": {},
          "schema": [],
          "mappingMode": "passThrough",
          "matchingColumns": [],
          "attemptToConvertTypes": false,
          "convertFieldsToString": true
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "da86d2fb-89ab-4431-a6a9-6ccbd0f66121",
      "name": "NixGuard AI 요약 & Wazuh 인사이트 형식화",
      "type": "n8n-nodes-base.set",
      "position": [
        -200,
        -1220
      ],
      "parameters": {
        "values": {
          "string": [
            {
              "name": "ai_summary",
              "value": "={{ $json.output }}"
            }
          ]
        },
        "options": {}
      },
      "typeVersion": 2
    },
    {
      "id": "c0ac70b6-0545-4681-af88-e3baae9d658e",
      "name": "(선택사항) 고위험 이벤트에 대해 Slack 경고 전송",
      "type": "n8n-nodes-base.slack",
      "disabled": true,
      "position": [
        40,
        -1220
      ],
      "webhookId": "292c465e-1f1e-4c22-9947-ccffafbf45e2",
      "parameters": {
        "text": "=🚨 *NixGuard IP Analysis* 🚨\n\n*AI Summary:*\n{{ $json.ai_summary }}",
        "otherOptions": {},
        "authentication": "oAuth2"
      },
      "typeVersion": 2
    },
    {
      "id": "64dfc08c-5b6c-4982-b779-ab368cfabc73",
      "name": "Webhook 트리거",
      "type": "n8n-nodes-base.webhook",
      "active": false,
      "position": [
        -640,
        -980
      ],
      "webhookId": "e74aeb1a-0659-4a89-8ede-17bb9fdbe317",
      "parameters": {
        "path": "e74aeb1a-0659-4a89-8ede-17bb9fdbe317",
        "options": {}
      },
      "typeVersion": 1
    },
    {
      "id": "2b8da30e-22d6-4900-bc3d-37c5a4cfb3c4",
      "name": "(실제 사용 사례)1",
      "type": "n8n-nodes-base.set",
      "position": [
        -640,
        -1220
      ],
      "parameters": {
        "values": {
          "string": [
            {
              "name": "apiKey",
              "value": "PASTE_YOUR_NIXGUARD_API_KEY_HERE"
            },
            {
              "name": "chatInput",
              "value": "Scan this url for me: https://thenex.world"
            }
          ]
        },
        "options": {}
      },
      "typeVersion": 2
    },
    {
      "id": "c22b6b46-ee9a-4ed5-82ef-d693f7e1b7b3",
      "name": "__PROTECTED_79__ 키 및 초기 프롬프트 설정",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -200,
        -1000
      ],
      "parameters": {
        "color": 7,
        "width": 520,
        "height": 380,
        "content": "### ⚡️ Next Steps: Automate Your SOC/IR Process\n\nThis workflow delivers actionable intelligence. The `Set` node formats the powerful insights from NixGuard and Wazuh, ready to fuel your SOAR playbooks.\n\nFrom here, you can automate your entire security response:\n- 🚨 **Enable the Slack Node**: Add your credentials to immediately start receiving alerts.\n- 🎟️ **Create Jira Tickets**: Add a Jira node to automatically create an incident ticket for high-risk events.\n- 📊 **Log Results**: Connect a Google Sheets or database node to log every analysis for auditing and reporting.\n- 🛡️ **Trigger Remediation**: Connect another `Execute Workflow` node to a workflow that blocks the malicious IP on your firewall."
      },
      "typeVersion": 1
    },
    {
      "id": "5794f296-fa9a-4b6e-a6fa-eef14f78b225",
      "name": "다음 단계: 자동 대응2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1280,
        -1220
      ],
      "parameters": {
        "color": 7,
        "width": 540,
        "height": 440,
        "content": "### 🎯 Workflow Overview: The Dispatcher\n\nThis workflow acts as a **Dispatcher**. Its only job is to provide an input (like an IP address) and an API key to trigger your main, more complex analysis workflow.\n\nThis powerful pattern allows you to build your core NixGuard & Wazuh analysis logic once and then trigger it from many different sources (webhooks, other workflows, schedules, etc.).\n\n**Why use this pattern?**\n- **Reusable Logic**: Build your complex analysis once and call it from anywhere.\n- **Simplicity & Focus**: This workflow handles the *when* and *how* of starting the job, while the main workflow handles the *what*.\n\n---\n**Learn more about NixGuard:** https://thenex.world\n\n**Tags:** `IP Analysis`, `Threat Intelligence`, `Wazuh`, `SOAR`, `SOC`, `NixGuard`, `Free`, `AI`, `Incident Response`, `Cybersecurity`, `Automation`, `SIEM`"
      },
      "typeVersion": 1
    },
    {
      "id": "a8687553-569a-41cf-8ab3-175a031ad6db",
      "name": "워크플로 개요2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -640,
        -1740
      ],
      "parameters": {
        "color": 7,
        "width": 560,
        "height": 440,
        "content": "### ⚙️ Critical Setup: Go Live in 2 Steps\n\nThis template is a 'dispatcher' and requires two actions to function correctly.\n\n1️⃣ **Add Your API Key:**\n   - Click the blue **`Set API Key & Initial Prompt`** node.\n   - In the `apiKey` field, replace the placeholder with your actual NixGuard API key.\n\n2️⃣ **Connect the Main Workflow:**\n   - Click the **`Execute NixGuard & Wazuh Workflow`** node.\n   - In the `Workflow` field, select your main `Get Real-Time Security Insights...` workflow from the list.\n\n---\n*Don't have the main workflow yet? You'll need to create or import it first. Don't have a key? Get one for free at [thenex.world/security/subscribe](https://thenex.world/security/subscribe)*\n\n   - **Don't have the main workflow yet?** Get it here:\n   https://n8n.io/workflows/4693-get-real-time-security-insights-with-nixguard-rag-and-wazuh-integration/"
      },
      "typeVersion": 1
    }
  ],
  "pinData": {},
  "connections": {
    "2b8da30e-22d6-4900-bc3d-37c5a4cfb3c4": {
      "main": [
        [
          {
            "node": "6f7ace63-a7d6-498e-9805-3de8f00b4275",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "6f7ace63-a7d6-498e-9805-3de8f00b4275": {
      "main": [
        [
          {
            "node": "da86d2fb-89ab-4431-a6a9-6ccbd0f66121",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "da86d2fb-89ab-4431-a6a9-6ccbd0f66121": {
      "main": [
        [
          {
            "node": "c0ac70b6-0545-4681-af88-e3baae9d658e",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}