Score DNS threats with VirusTotal, Abuse.ch, HashiCorp Vault and Gemini

Lby lukaszfd· via n8n.io

Schedule Trigger

Select rows from a table

mysql

VirusTotal IP Scan

If 'malicious' or 'suspicious'

Virus total API TOKEN

hashicorpvault

Gemini AI Studio

hashicorpvault

AI Agent

openai

MySQL Pass

hashicorpvault

Google Gemini Chat Model

google

Parse AI Agent output

Insert AI verdict

mysql

Send an Email

smtp

Abuse.CH_ThreatFox request

threatfox-api.abuse.ch

Abuse API TOKEN

hashicorpvault

Get Email Pass

hashicorpvault

Abuse.CH_URLHaus

urlhaus-api.abuse.ch

Insert doc URLHaus

mongodb

Edit Json for Mongo - URLHaus

Insert a clear scan - URLHaus

mysql

Edit Json for Mongo - ThreatFox

Insert a clear scan - ThreatFox

mysql

Insert doc ThreatFox

mongodb

Insert a clear scan - VirusTotal

mysql

Edit Json for Mongo - VirusTotal

Mongo DB Pass

hashicorpvault

Insert doc VirusTotal

mongodb

Data reduction and aggregation - Urlhaus

Data reduction and aggregation - ThreatFox

Data reduction and aggregation - VirusTotal

Merge

Code for Merge

If query_status = ok - UrlHause

If query_status = ok - ThretFox

Select threat scale for AI agent

mysql