OTX与OpenAI网络安全检查

• •Google 账号和 Gmail API 凭证
• •可能需要目标 API 的认证凭证
• •OpenAI API Key

{
  "meta": {
    "instanceId": "",
    "templateCredsSetupCompleted": true
  },
  "nodes": [
    {
      "id": "",
      "name": "HTTP 请求",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -800,
        240
      ],
      "parameters": {
        "url": "={{ $json['Landing Page'] }}",
        "options": {
          "redirect": {
            "redirect": {}
          },
          "response": {
            "response": {
              "fullResponse": true,
              "responseFormat": "text"
            }
          }
        }
      },
      "typeVersion": 4.2
    },
    {
      "id": "",
      "name": "表单提交时",
      "type": "n8n-nodes-base.formTrigger",
      "position": [
        -1020,
        240
      ],
      "webhookId": "",
      "parameters": {
        "options": {},
        "formTitle": "URL Test",
        "formFields": {
          "values": [
            {
              "fieldLabel": "Landing Page",
              "placeholder": "https://example.com",
              "requiredField": true
            }
          ]
        },
        "formDescription": "Enter URL for testing"
      },
      "typeVersion": 2.2
    },
    {
      "id": "",
      "name": "AlienVault HTTP 请求",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -580,
        240
      ],
      "parameters": {
        "": "",
        "url": "=https://otx.alienvault.com/api/v1/indicators/hostname/{{ $('On form submission').item.json['Landing Page'].replace(\"https://\", \"\").replace(\"http://\", \"\") }}/general",
        "method": "POST",
        "options": {},
        "sendBody": false,
        "sendQuery": false,
        "curlImport": "",
        "infoMessage": "",
        "sendHeaders": false,
        "authentication": "predefinedCredentialType",
        "httpVariantWarning": "",
        "nodeCredentialType": "alienVaultApi",
        "provideSslCertificates": false
      },
      "credentials": {
        "alienVaultApi": {
          "id": "",
          "name": "AlienVault account"
        }
      },
      "typeVersion": 4.2,
      "extendsCredential": "alienVaultApi"
    },
    {
      "id": "",
      "name": "OpenAI 聊天模型",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        -52,
        460
      ],
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "chatgpt-4o-latest",
          "cachedResultName": "chatgpt-4o-latest"
        },
        "options": {
          "maxTokens": 1500,
          "frequencyPenalty": 0.5
        }
      },
      "credentials": {
        "openAiApi": {
          "id": "",
          "name": "OpenAi account"
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "",
      "name": "安全配置审计",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        -140,
        240
      ],
      "parameters": {
        "text": "=[\n  {\n    \"role\": \"system\",\n    \"content\": \"You are a cybersecurity expert. Analyze the provided website data, including HTTP response details and AlienVault threat intelligence, to identify vulnerabilities or misconfigurations. For each issue, explain its nature, potential impact, a possible exploitation method (e.g., payload), and mitigation steps. Generate a concise report. Do not repeat the prompt or instructions.\"\n  },\n  {\n    \"role\": \"user\",\n    \"content\": \"URL: {{ $node['Prepare Data for AI'].json.url }}\\nStatus Code: {{ $node['Prepare Data for AI'].json.statusCode }}\\nSecurity Headers: {{ JSON.stringify($node['Prepare Data for AI'].json.securityHeaders) }}\\nPotential Issues: {{ JSON.stringify($node['Prepare Data for AI'].json.potentialIssues) }}\\nAlienVault Data: {{ JSON.stringify($node['Prepare Data for AI'].json.alienVaultInfo) }}\"\n  }\n]",
        "options": {},
        "promptType": "define"
      },
      "typeVersion": 1.7
    },
    {
      "id": "",
      "name": "发送安全报告",
      "type": "n8n-nodes-base.gmail",
      "position": [
        456,
        240
      ],
      "webhookId": "",
      "parameters": {
        "sendTo": "=",
        "message": "={{ $json.htmlReport }}",
        "options": {},
        "subject": "=Website Security Audit - {{ $('On form submission').item.json['Landing Page'] }}"
      },
      "credentials": {
        "gmailOAuth2": {
          "id": "",
          "name": "Gmail account"
        }
      },
      "typeVersion": 2.1
    },
    {
      "id": "",
      "name": "为 AI 准备数据",
      "type": "n8n-nodes-base.code",
      "position": [
        -360,
        240
      ],
      "parameters": {
        "jsCode": "// Access inputs: HTTP data (first input) and potential AlienVault data (second input)\nconst httpData = $input.first()?.json || {}; // Assuming HTTP Request is the first input\nconst alienVaultInput = $input.all().length > 1 ? $input.all()[1] : null; // Check if a second input exists\nconst alienVaultData = alienVaultInput?.json || {};\n\n// Initialize the consolidated data object. This will be the input for the \"Security Configuration Audit\" node.\nconst consolidatedInputData = {\n  url: httpData.url || alienVaultData.indicator || 'URL not provided',\n  statusCode: httpData.statusCode || null,\n  securityHeaders: httpData.headers || {}, // Keep original headers\n  potentialIssues: [], // This will be augmented by the AI/Security Audit node\n  alienVaultInfo: {\n    domain: alienVaultData.domain || null,\n    sections: alienVaultData.sections || [],\n    whois: alienVaultData.whois || null,\n    pulseCount: alienVaultData.pulse_info?.count || 0\n  },\n  timestamp: new Date().toISOString(), // Add a timestamp for the report generation time\n  // Add raw inputs for debugging/reference (useful if you need to debug data flow)\n  _rawHttpInput: httpData,\n  _rawAlienVaultInput: alienVaultData\n};\n\n// Check for potential issues based on AlienVault data\nif (consolidatedInputData.alienVaultInfo.sections && consolidatedInputData.alienVaultInfo.sections.includes('malware')) {\n  consolidatedInputData.potentialIssues.push('Malware section detected in AlienVault data; further analysis recommended');\n}\nif (consolidatedInputData.alienVaultInfo.pulseCount > 0) {\n  consolidatedInputData.potentialIssues.push('Referenced in AlienVault pulses, indicating potential threats');\n}\n\n// Check for potential issues based on HTTP data\nif (consolidatedInputData.statusCode && consolidatedInputData.statusCode >= 400) {\n  consolidatedInputData.potentialIssues.push(`Server returned error status: ${consolidatedInputData.statusCode}`);\n}\n// Check if securityHeaders is an object and if it's empty\nif (consolidatedInputData.securityHeaders && typeof consolidatedInputData.securityHeaders === 'object' && Object.keys(consolidatedInputData.securityHeaders).length === 0) {\n  consolidatedInputData.potentialIssues.push('No security headers detected');\n}\n\n// Return a single item with the consolidated input data for the next node (Security Configuration Audit)\nreturn [\n  {\n    json: consolidatedInputData\n  }\n];"
      },
      "typeVersion": 2,
      "alwaysOutputData": false
    },
    {
      "id": "",
      "name": "格式化邮件报告",
      "type": "n8n-nodes-base.code",
      "position": [
        236,
        240
      ],
      "parameters": {
        "jsCode": "const aiReport = $input.first()?.json?.output; // Assuming AI output is under 'output' property in the first input item\n\nif (!aiReport) {\n  return [{ json: { htmlReport: \"<p>No AI report generated.</p>\" } }];\n}\n\n// Basic HTML formatting. You can make this much more sophisticated.\n// The AI's output is likely plain text, so we'll wrap it in <pre> or simple <p> tags.\n// If the AI is instructed to output Markdown, you could use a Markdown-to-HTML library here\n// (though n8n's Code node doesn't easily support external libraries).\n// For simplicity, let's assume plain text and wrap it.\n\nlet htmlContent = `\n<html>\n<head>\n  <style>\n    body { font-family: sans-serif; line-height: 1.6; color: #333; }\n    h1, h2 { color: #0056b3; }\n    pre { background-color: #f4f4f4; border: 1px solid #ddd; padding: 10px; border-radius: 4px; overflow-x: auto; }\n    .issue { color: #cc0000; font-weight: bold; }\n    .section-title { font-size: 1.2em; margin-top: 20px; border-bottom: 1px solid #eee; padding-bottom: 5px; }\n  </style>\n</head>\n<body>\n  <h1>Website Security Audit Report</h1>\n  <div class=\"section-title\">AI-Generated Analysis:</div>\n  <pre>${aiReport}</pre>\n  <div class=\"section-title\">Raw Data for Reference:</div>\n  <p>This is placeholder for raw data. You can expand on this section.</p>\n  </body>\n</html>\n`;\n\nreturn [{\n  json: {\n    htmlReport: htmlContent\n  }\n}];"
      },
      "typeVersion": 2
    }
  ],
  "pinData": {},
  "connections": {
    "HTTP Request": {
      "main": [
        [
          {
            "node": "AlienVault HTTP Request",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Chat Model": {
      "ai_languageModel": [
        [
          {
            "node": "Security Configuration Audit",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "On form submission": {
      "main": [
        [
          {
            "node": "HTTP Request",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Data for AI": {
      "main": [
        [
          {
            "node": "Security Configuration Audit",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "AlienVault HTTP Request": {
      "main": [
        [
          {
            "node": "Prepare Data for AI",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Report for Email": {
      "main": [
        [
          {
            "node": "Send Security Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Security Configuration Audit": {
      "main": [
        [
          {
            "node": "Format Report for Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}