{
  "name": "Enrich IP addresses with country attribution using IPinfo and Slack alerts",
  "nodes": [
    {
      "id": "a97ceefb-9648-4ee2-8c9f-aa4022a1859e",
      "name": "Weebhook - Receive IP Input",
      "type": "n8n-nodes-base.webhook",
      "position": [
        0,
        0
      ]
    },
    {
      "id": "0962527d-8e6e-41a0-998b-06bcbbd62515",
      "name": "Validate IP Address",
      "type": "n8n-nodes-base.code",
      "position": [
        208,
        0
      ]
    },
    {
      "id": "a48725a9-175b-406f-8e20-efca11497663",
      "name": "If IP is Valid",
      "type": "n8n-nodes-base.if",
      "position": [
        416,
        0
      ]
    },
    {
      "id": "1e36451c-047a-4b47-81c9-989f8c9293e8",
      "name": "Respond Invalid IP Address",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        416,
        224
      ]
    },
    {
      "id": "5d15bff6-ef56-4f2c-9ad4-7a5f338c1618",
      "name": "Check Private / Internal IP",
      "type": "n8n-nodes-base.code",
      "position": [
        656,
        0
      ]
    },
    {
      "id": "c2be76fe-e393-421c-86a7-30ab13971161",
      "name": "If IP is Private",
      "type": "n8n-nodes-base.if",
      "position": [
        816,
        112
      ]
    },
    {
      "id": "337b4eb0-d906-4afb-9de0-8864070d3b86",
      "name": "Respond Private IP Ignored",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        960,
        0
      ]
    },
    {
      "id": "cae185f7-875f-450e-a92e-43a1cf68e060",
      "name": "Enrich IP (Geo & ASN Lookup)",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1200,
        128
      ]
    },
    {
      "id": "44c3efcd-5d76-4314-b818-ef7a086a4524",
      "name": "Normalize Enrichment",
      "type": "n8n-nodes-base.code",
      "position": [
        1440,
        128
      ]
    },
    {
      "id": "49f8d9f9-9f57-4fa5-956d-e03eb6fe1ae6",
      "name": "Slack Alert: IP Enrichment Result",
      "type": "n8n-nodes-base.slack",
      "position": [
        1664,
        128
      ]
    },
    {
      "id": "4528ebd2-bdf9-4d7d-b670-b7c0f4b078a7",
      "name": "Respond IP Enrichment Result",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        1904,
        128
      ]
    },
    {
      "id": "458cea81-a568-4066-b0ff-4ce305d40704",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -64,
        -80
      ],
      "parameters": {
        "width": 656,
        "height": 480,
        "content": "## 1. Input & Validation"
      }
    },
    {
      "id": "43b94590-d6ce-4c97-a616-b260a75b5145",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        608,
        -80
      ],
      "parameters": {
        "width": 496,
        "height": 480,
        "content": "## 2. Private IP Handling"
      }
    },
    {
      "id": "387ea9c6-156e-42c7-948d-e3e9d231999f",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1120,
        -80
      ],
      "parameters": {
        "width": null,
        "height": 480,
        "content": "## IP Enrichment"
      }
    },
    {
      "id": "5cd807b5-9d24-4a68-9bf5-5d7d2a977644",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1376,
        -80
      ],
      "parameters": {
        "width": 224,
        "height": 480,
        "content": "## Normalization & Severity"
      }
    },
    {
      "id": "c93ba500-996d-4ca7-b812-a1b75863af09",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1616,
        -80
      ],
      "parameters": {
        "width": 432,
        "height": 480,
        "content": "## Output & Notification"
      }
    },
    {
      "id": "be5342d4-8614-438a-a556-9f4c3d2ff977",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -576,
        -272
      ],
      "parameters": {
        "width": 416,
        "height": 768,
        "content": "## I'm a note \nIP Enrichment & Attribution is a lightweight cybersecurity automation designed to enrich IP addresses with geographic and network intelligence. It helps security teams, SOC analysts, an"
      }
    }
  ],
  "connections": {
    "If IP is Valid": {
      "main": [
        [
          {
            "node": "Check Private / Internal IP",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond Invalid IP Address",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "If IP is Private": {
      "main": [
        [
          {
            "node": "Respond Private IP Ignored",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Enrich IP (Geo & ASN Lookup)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Validate IP Address": {
      "main": [
        [
          {
            "node": "If IP is Valid",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Normalize Enrichment": {
      "main": [
        [
          {
            "node": "Slack Alert: IP Enrichment Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Private / Internal IP": {
      "main": [
        [
          {
            "node": "If IP is Private",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Weebhook - Receive IP Input": {
      "main": [
        [
          {
            "node": "Validate IP Address",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Enrich IP (Geo & ASN Lookup)": {
      "main": [
        [
          {
            "node": "Normalize Enrichment",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Respond IP Enrichment Result": {
      "main": [
        []
      ]
    },
    "Slack Alert: IP Enrichment Result": {
      "main": [
        [
          {
            "node": "Respond IP Enrichment Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}