Splunk to n8n: Automated Log Ingestion
A guide to integrating Splunk with n8n for alert enrichment.
Overview
This project outlines the process of setting up an automated alert system using Splunk and n8n. It focuses on detecting brute-force attacks by identifying repeated failed SSH login attempts. The workflow involves creating a specific search query in Splunk to find these incidents, then saving this search as an alert. When the alert is triggered, it sends a JSON payload containing the alert data to a specified n8n webhook URL.
This integration allows for further automated processing and enrichment of the security alert within n8n.
This guide is for educational purposes and should not be used in a production environment without proper security considerations.
What You'll Learn
-
Log Identification
Learn how to pinpoint relevant logs for security incidents like failed SSH attempts.
-
Search Creation
Discover how to create a search query to detect repeated authentication failures.
-
Alert Configuration
Understand how to save a Splunk search as an alert to trigger actions.
-
Webhook Integration
Learn to configure a webhook action to send alert data to an external service like n8n.
-
Automated Enrichment
Grasp the concept of using n8n to enrich alerts with additional context automatically.
Prerequisites
-
Prerequisite
Splunk -
Prerequisite
n8n -
Prerequisite
Access to security logs in Splunk
About Trainer
Aman Gupta
Aman Gupta is an emerging voice in automation-driven cybersecurity, combining strong engineering skills with a passion for knowledge sharing. He has worked on advanced projects spanning security monitoring, intelligent alerting, process automation, and AI-powered decision systems. With experience bridging software engineering and modern DevSecOps practices, Aman focuses on simplifying complex technologies into practical, real-world applications.
Related Projects
Apache Server Log Analysis using Splunk
Detecting Brute Force, SQL Injection, XSS, and Suspicious Web Activity from Apache Access Logs with Splunk SIEM
Wazuh + n8n + Anyrun: Automated Malware Analysis
Automate malware analysis by sending Wazuh-detected suspicious files into ANY.RUN, retrieving detailed reports and IOCs, and integrating results back into your SOC workflow.
Apache Web Server Log Monitoring using Wazuh
Real-time detection of HTTP errors, brute-force and suspicious requests from Apache logs