Skip to content

README.md

Latest commit

 

History

History
73 lines (51 loc) · 2.74 KB

README.md

File metadata and controls

73 lines (51 loc) · 2.74 KB

n8n-nodes-crowdsec-cti

This is an n8n community node. It lets you query the CrowdSec CTI API in your n8n workflows.

The node currently supports IP reputation lookups through CrowdSec's smoke endpoint.

n8n is a fair-code licensed workflow automation platform.

Installation Operations Credentials Compatibility Usage Resources Version history

Installation

Follow the installation guide in the n8n community nodes documentation.

Operations

  • Smoke -> Get
  • Calls GET https://cti.api.crowdsec.net/v2/smoke/{ip}
  • Returns reputation/intelligence data for the provided IP address
  • Smoke -> Get Many
  • Calls GET https://cti.api.crowdsec.net/v2/smoke?ips=ip1,ip2,...
  • Returns reputation/intelligence data for multiple IP addresses
  • Smoke -> Search
  • Calls GET https://cti.api.crowdsec.net/v2/smoke/search
  • Required query params: query (lucene-style), since (duration, for example 1h)
  • Optional query params: page, limit
  • Optional n8n behavior: Return All to auto-paginate across pages

Credentials

This node uses an API key sent as the x-api-key header.

To configure:

  1. Create a CrowdSec CTI API key from your CrowdSec account. You can refer to this documentation
  2. In n8n, create credentials of type Crowdsec CTI API.
  3. Paste the API key into the API Key field.

Compatibility

Built with the official @n8n/node-cli template and n8nNodesApiVersion: 1.

Compatibility depends on the n8n version supporting community nodes with API version 1.

Usage

  1. Add the Crowdsec CTI node to your workflow.
  2. Select resource Smoke.
  3. Choose operation Get, Get Many, or Search.
  4. Enter:
    • IP Address for Get
    • IP Addresses (comma-delimited) for Get Many
    • Query and Since for Search (optionally tune page and limit, and enable Return All)
  5. Execute the node to retrieve the JSON reputation payload.

Important

The Search operation can return a lot of results depending on the query (potentially thousands or tens of thousands). This means that enabling the Return All option can quickly consume your API key quota if the limit parameter is set to low.

Resources

Version history

  • 0.1.0: Initial community node with Smoke -> Get, Smoke -> Get Many, and Smoke -> Search.