{
  "name": "Weekly Shodan query - report accidents",
  "nodes": [
    {
      "id": "54b2b2bd-9101-402c-b7cb-3d5e1070fcd2",
      "name": "Scan each IP",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        2123,
        202
      ]
    },
    {
      "id": "f6b194a7-a38d-46b4-899f-a9cb71de247e",
      "name": "Get watched IPs & Ports",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1448.635348143835,
        200
      ]
    },
    {
      "id": "a6754adf-610b-46f0-9019-7ea21ac22690",
      "name": "Split out services",
      "type": "n8n-nodes-base.itemLists",
      "position": [
        2323,
        202
      ]
    },
    {
      "id": "fa9dd77c-32e9-48c5-a1bf-8b95720aad43",
      "name": "Unexpected port?",
      "type": "n8n-nodes-base.filter",
      "position": [
        2543,
        202
      ]
    },
    {
      "id": "addfeaf8-0c5d-4e4a-924e-53b3e28a23de",
      "name": "Set data to post for each port",
      "type": "n8n-nodes-base.set",
      "position": [
        2763,
        202
      ]
    },
    {
      "id": "aaef71c0-927c-4297-9fa1-331e7009bf7e",
      "name": "Convert to table",
      "type": "n8n-nodes-base.html",
      "position": [
        2983,
        202
      ]
    },
    {
      "id": "2f257556-cf1b-4a80-8f40-7989ea077f48",
      "name": "Convert to Markdown",
      "type": "n8n-nodes-base.markdown",
      "position": [
        3203,
        202
      ]
    },
    {
      "id": "9fdd40ba-1ab4-43a2-9e9d-53af5fc32f9f",
      "name": "For each IP",
      "type": "n8n-nodes-base.splitInBatches",
      "position": [
        1740,
        200
      ]
    },
    {
      "id": "01823f1f-9612-4e56-a8f2-62aa2a0d5d5e",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2722,
        -137.71236116790237
      ],
      "parameters": {
        "width": 607.8070576425011,
        "height": 564.6974012965735,
        "content": "![Shodan](https://i.imgur.com/tK0RXSK.png)\n## Format port service data as a Markdown table\nAfter identifying the open ports, the next step is to organize this information neatly. This node converts th"
      }
    },
    {
      "id": "7ef1232b-8386-4b47-8617-a65749357ede",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2083.3970861885364,
        -134.67908072298724
      ],
      "parameters": {
        "width": 606.297701841459,
        "height": 562.5474916374191,
        "content": "![Shodan](https://i.imgur.com/q4G3kQf.png)\n## Query Shodan for unexpected open ports\nThis stage of the workflow leverages `Shodan`, a search engine for internet-connected devices, to identify running "
      }
    },
    {
      "id": "afd6651a-bcf1-4d66-ae1c-0f5616d3f29a",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        928,
        -465
      ],
      "parameters": {
        "width": 650.8045775723033,
        "height": 890.9735108226744,
        "content": "![Scheduled](https://i.imgur.com/PcOuvAL.png)\n# Workflow Overview\n\nThe n8n workflow initiates with a node that fetches a list of IP addresses and their specified ports from a security system, which is"
      }
    },
    {
      "id": "14730a2f-42cc-4d96-b401-8a6a2c41aa27",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        3362,
        -167.68304244703404
      ],
      "parameters": {
        "width": 438.8550109331452,
        "height": 594.7981050471616,
        "content": "![thehive](https://i.imgur.com/y2Yw1ZP.png)\n## Post to TheHive\nThe final step in the process involves posting the findings to TheHive - a scalable, open-source and free Security Incident Response Plat"
      }
    },
    {
      "id": "f8cd7e3f-b55e-400d-ba45-486d4c736a16",
      "name": "Every Monday",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        1228.635348143835,
        200
      ]
    },
    {
      "id": "804ef38c-3ecb-41b2-ab38-ef8c231b7425",
      "name": "Create TheHive alert",
      "type": "n8n-nodes-base.theHive",
      "position": [
        3423,
        202
      ]
    },
    {
      "id": "5f09a27b-c6a4-4f74-a5ff-4c684e5e8917",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1620,
        -261.14340884889145
      ],
      "parameters": {
        "width": 432.3140705656865,
        "height": 690.0398460499007,
        "content": "![n8n](https://i.imgur.com/lKnBNnH.png)\n## Iterate Through IP addresses\nThe \"`Split In Batches`\" node is configured with a batch size of one, ensuring that the array of IP addresses received is proces"
      }
    }
  ],
  "connections": {
    "For each IP": {
      "main": [
        [
          {
            "node": "Scan each IP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Every Monday": {
      "main": [
        [
          {
            "node": "Get watched IPs & Ports",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Scan each IP": {
      "main": [
        [
          {
            "node": "Split out services",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Convert to table": {
      "main": [
        [
          {
            "node": "Convert to Markdown",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Unexpected port?": {
      "main": [
        [
          {
            "node": "Set data to post for each port",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Split out services": {
      "main": [
        [
          {
            "node": "Unexpected port?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Convert to Markdown": {
      "main": [
        [
          {
            "node": "Create TheHive alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Create TheHive alert": {
      "main": [
        [
          {
            "node": "For each IP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get watched IPs & Ports": {
      "main": [
        [
          {
            "node": "For each IP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set data to post for each port": {
      "main": [
        [
          {
            "node": "Convert to table",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}