基于Slack的自动化域名/IP黑名单监控

• •Slack Bot Token 或 Webhook URL
• •可能需要目标 API 的认证凭证

{
  "id": "DlmtdnHx6mOhXjok",
  "meta": {
    "instanceId": "a287613f1596da776459594685fbf4e2b4a12124f80ab8c8772f5e37bff103ae",
    "templateCredsSetupCompleted": true
  },
  "name": "基于 Slack 的自动化域名/IP 黑名单监控",
  "tags": [],
  "nodes": [
    {
      "id": "d27bbd40-6b95-422c-8312-4e3a4b861497",
      "name": "定时检查",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {}
          ]
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "b4c57e0b-be8a-4e60-a5ef-99ef2fff399e",
      "name": "定义域名/IP",
      "type": "n8n-nodes-base.code",
      "position": [
        224,
        0
      ],
      "parameters": {
        "jsCode": "const assetsToCheck = [\n    \"your-company.com\",\n    \"mail.your-company.com\",\n    \"123.45.67.89\" // Example public IP\n];\n\nreturn assetsToCheck.map(asset => ({\n    json: { asset: asset }\n}));"
      },
      "typeVersion": 2
    },
    {
      "id": "67a1c4d1-4a3f-48a9-a923-9bfa00a86014",
      "name": "查询黑名单 API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        448,
        0
      ],
      "parameters": {
        "url": "=https://api.abuseipdb.com/api/v2/check?ipAddress={{ $json.asset }} ",
        "options": {}
      },
      "typeVersion": 4.2
    },
    {
      "id": "7a5ba1a0-efdf-4398-a489-a9fdfdfbc8ff",
      "name": "是否在黑名单中？",
      "type": "n8n-nodes-base.if",
      "position": [
        672,
        0
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "30182fcb-5f61-460c-a444-c1e1feecc245",
              "operator": {
                "type": "number",
                "operation": "gt"
              },
              "leftValue": "={{ $json.abuseConfidenceScore }}",
              "rightValue": 50
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "b111cb69-17d7-42b7-8d45-6744e77209e9",
      "name": "发送高优先级警报",
      "type": "n8n-nodes-base.slack",
      "position": [
        896,
        0
      ],
      "webhookId": "4e2635aa-1700-41dd-8ed1-41d47638b638",
      "parameters": {
        "text": "=🚨 *URGENT: Blacklist Alert!* 🚨\\nAsset *{{ $json.asset }}* has a confidence score of *{{ $json.abuseConfidenceScore }}*. Immediate action is required!",
        "user": {
          "__rl": true,
          "mode": "id",
          "value": "123qa"
        },
        "select": "user",
        "otherOptions": {}
      },
      "credentials": {
        "slackApi": {
          "id": "AFKF0YsguyhsagR0",
          "name": "temp"
        }
      },
      "typeVersion": 2.3
    },
    {
      "id": "5c802353-4127-461d-88f3-bd58d55bb118",
      "name": "便签",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -48,
        -80
      ],
      "parameters": {
        "width": 1152,
        "height": 272,
        "content": "## 流程"
      },
      "typeVersion": 1
    },
    {
      "id": "306508a4-bdbc-449f-83c5-c61173df78c7",
      "name": "便签1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -48,
        224
      ],
      "parameters": {
        "color": 3,
        "width": 1152,
        "height": 1680,
        "content": "# 自动化域名/IP 黑名单监控"
      },
      "typeVersion": 1
    }
  ],
  "active": false,
  "pinData": {
    "Define Domains/IPs": [
      {
        "json": {
          "asset": "your-company.com"
        }
      },
      {
        "json": {
          "asset": "mail.your-company.com"
        }
      },
      {
        "json": {
          "asset": "123.45.67.89"
        }
      }
    ]
  },
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "973431a8-144d-44ca-b031-eea4794565a3",
  "connections": {
    "Scheduled Check": {
      "main": [
        [
          {
            "node": "Define Domains/IPs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Is on Blacklist?": {
      "main": [
        [
          {
            "node": "Send High-Priority Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Define Domains/IPs": {
      "main": [
        [
          {
            "node": "Query Blacklist API",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Blacklist API": {
      "main": [
        [
          {
            "node": "Is on Blacklist?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}