n8n-nodes-threatstream

This is an n8n community node that lets you query threat intelligence from Anomali ThreatStream in your n8n workflows.

n8n is a fair-code licensed workflow automation platform.

Installation
Operations
Credentials
Compatibility
Usage
Resources

Installation

Follow the installation guide in the n8n community nodes documentation.

Operations

Intelligence (Observables/Indicators)

• Search: Query indicators with filters (type, confidence, status, tags)
• Get: Retrieve a specific indicator by ID
• Get By Value: Look up an indicator by its value (IP, domain, hash, etc.)

Credentials

To use this node, you need:

1. A ThreatStream account (Cloud, OnPrem, or AirGap)
2. Your ThreatStream username (email)
3. Your API key (found in ThreatStream Settings > My Profile)

For ThreatStream OnPrem deployments, you'll also need to specify your instance URL.

Compatibility

• Tested against n8n version 1.0.0+
• Works with ThreatStream Cloud and OnPrem (v7.0+)

Usage

Quick Start

1. Add ThreatStream node to your workflow
2. Create credentials:
   • Click "Create New Credential"
   • Enter your ThreatStream username (email), API key, and base URL
   • Click "Test" to verify connection
3. Configure operation:
   • Choose resource (Intelligence)
   • Choose operation (Search, Get, Get By Value)
   • Set filters as needed
4. Execute to retrieve threat intelligence data

Example 1: Search for High-Confidence IP Indicators

Configuration:

• Resource: Intelligence
• Operation: Search
• Limit: 10
• Additional Fields:
  • Indicator Type: IP
  • Status: Active
  • Minimum Confidence: 80

Result: Returns up to 10 active IP indicators with confidence >= 80

Example 2: Look Up Specific IP

Configuration:

• Resource: Intelligence
• Operation: Get By Value
• Indicator Value: 8.8.8.8
• Indicator Type: IP

Result: Returns threat intelligence data for that specific IP (if it exists)

Example 3: Enrich Firewall Logs

Workflow:

1. HTTP Request → Fetch logs
2. Function → Extract IPs
3. ThreatStream → Look up each IP
4. IF → Filter high-confidence threats
5. Email → Send alert for threats

See the /examples directory for complete workflow JSON files you can import.

Resources

• n8n community nodes documentation
• ThreatStream API Documentation
• Anomali ThreatStream

Development

# Install dependencies
npm install

# Build the node
npm run build

# Run in development mode
npm run dev

# Lint code
npm run lint

# Format code
npm run format

License

MIT