NKSC NIVS n8n Node

n8n community node for creating, updating, and searching NKSC security incident reports in NIVS (National Incident Management System).

Overview

The node exposes the NKSC report forms directly in the n8n editor and builds the NIVS request body from the selected form and entered values.

Automated (API-based) incident registration in NIVS is not just a convenience — it is a legal requirement. Resolution No. 818 of the Government of the Republic of Lithuania, dated August 13, 2018, "On the Approval of the National Cybersecurity Incident Management Plan," requires cybersecurity subjects to register incidents in NIVS automatically via an API interface within 12 months of their registration in the Cybersecurity Subjects Registry (this deadline may be extended by up to another 12 months for objective reasons). This node exists to satisfy that automated-reporting obligation from within n8n.

It handles:

• report selection
• field visibility and conditional requirements
• payload shaping for the selected NIVS business object
• search by external ticket ID

Supported Operations

Report Forms

How It Works

1. The user selects an operation.
2. The user selects a report form.
3. The node loads the matching form definition.
4. The editor shows the fields and controls for that form.
5. The payload builder applies defaults, visibility rules, and conditional validation.
6. The node sends the request to the correct NIVS endpoint.
7. The response is returned as n8n output items.

Request methods:

• Insert uses POST
• Update uses PATCH
• Search uses GET

Field Behavior

Required fields

Fields marked required in the form definition are required in the editor and validated before the request is sent.

Reporter identity fields are required on every form:

• Organization
• Reporter
• ReporterEmail
• ReporterPhone
• ReporterTitle

The required-by-default fields in the node match the audited NKSC HTML forms. The reporter identity fields are additional required inputs enforced by NIVS.

Value types

• Taip / Ne fields stay as validated string values
• scope and loss options are boolean flags
• expandable scope and loss groups can be shown either as one compact selector or as separate boolean switches

Expression inputs

Most fields can be driven by expressions using the same value shape shown in the editor: strings for text fields, Taip / Ne for yes-no fields, booleans for switches, and date-time values for date fields.

Some selector fields accept extra expression formats to make generated workflows easier to maintain:

• Fields To Update in Selected Fields update mode accepts field names, full numbered labels, one-based numbers, comma-separated numbers, or a numeric array. For example, Summary, 7, 1,2,3, and [1,2,3] are valid expression results.
• Threat and Threat Category accept the NIVS value, the numbered English label, the unnumbered English label, or the option number. For example, 2, 2. Malware, and Malware all resolve to the same threat option.
• Compact Scope Options and Loss Options selectors expect arrays of option field names, such as ["ScopeOption2"]. For expression-heavy workflows, turn on the matching Expand ... Options toggle and drive the separate boolean fields instead.

Conditional fields

Some fields remain visible in the editor even when their values are only required under certain conditions. That keeps them available for expression-driven workflows while preserving backend validation rules.

Update behavior

Update NKSC Report defaults to Selected Fields mode. In this mode, the node only sends the fields selected in Fields To Update; the selector labels are numbered so expressions can pass values like 1,2,3 or [1,2,3].

Full Form mode sends the selected form payload and can optionally validate required fields before patching the NIVS record.

Search behavior

Search uses the selected report form to choose the NIVS business object, then filters by external ticket ID and returns up to the configured limit, defaulting to 10 records.

Credential Setup

Use the NKSC NIVS API credential.

Behavior:

• bare hostnames are normalized to HTTPS
• explicit http://... URLs are preserved
• trailing slashes are trimmed before the request URL is built
• n8n tests the credential with a read-only request against the configured endpoint

Development

npm install
npm run dev
npm run lint
npm test
npm run build