{
  "name": "Automated File Integrity Monitoring (FIM) & Audit Engine",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 15
            }
          ]
        }
      },
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        -620,
        0
      ],
      "id": "scheduled-integrity-scan",
      "name": "Scheduled Integrity Scan"
    },
    {
      "parameters": {
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "url": "http://host.docker.internal:8000/get_all_reports",
        "options": {}
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        -400,
        0
      ],
      "id": "fetch-reports-batch",
      "name": "Fetch Reports Batch",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "batchSize": 1,
        "options": {}
      },
      "type": "n8n-nodes-base.splitInBatches",
      "typeVersion": 3,
      "position": [
        -180,
        0
      ],
      "id": "split-reports",
      "name": "Split Reports"
    },
    {
      "parameters": {
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "url": "=http://host.docker.internal:8000/get_report_by_id/{{ $json.report_id }}",
        "options": {}
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        40,
        0
      ],
      "id": "fetch-report-metadata",
      "name": "Fetch Report Metadata",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "typeValidation": "loose",
            "version": 2
          },
          "conditions": [
            {
              "id": "has-sealed-hash",
              "leftValue": "={{ $json.file_hash }}",
              "rightValue": "",
              "operator": {
                "type": "string",
                "operation": "notEmpty",
                "singleValue": true
              }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "type": "n8n-nodes-base.filter",
      "typeVersion": 2.2,
      "position": [
        260,
        0
      ],
      "id": "only-sealed-reports",
      "name": "Only Sealed Reports"
    },
    {
      "parameters": {
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "url": "=http://host.docker.internal:8000/documents/{{ $json.document_id }}/download",
        "options": {
          "response": {
            "response": {
              "responseFormat": "file"
            }
          }
        }
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        480,
        100
      ],
      "id": "download-original-file",
      "name": "Download Original File",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "type": "SHA256",
        "binaryData": true,
        "dataPropertyName": "current_hash"
      },
      "type": "n8n-nodes-base.crypto",
      "typeVersion": 1,
      "position": [
        700,
        100
      ],
      "id": "generate-sha256-hash",
      "name": "Generate SHA256 Hash"
    },
    {
      "parameters": {
        "mode": "combine",
        "combineBy": "combineByPosition",
        "options": {}
      },
      "type": "n8n-nodes-base.merge",
      "typeVersion": 3,
      "position": [
        920,
        0
      ],
      "id": "merge-sealed-and-observed",
      "name": "Merge Sealed and Observed"
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": false,
            "typeValidation": "loose",
            "version": 2
          },
          "conditions": [
            {
              "id": "hashes-match",
              "leftValue": "={{ $json.current_hash }}",
              "rightValue": "={{ $json.file_hash }}",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.2,
      "position": [
        1140,
        0
      ],
      "id": "integrity-comparison-check",
      "name": "Integrity Comparison Check"
    },
    {
      "parameters": {
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "url": "=http://host.docker.internal:8000/api/report/integrity/{{ $json.report_id }}",
        "method": "PATCH",
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({ integrity_state: \"SEALED\" }) }}",
        "options": {}
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        1380,
        -140
      ],
      "id": "update-integrity-state---sealed",
      "name": "Update Integrity State - SEALED",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "authentication": "predefinedCredentialType",
        "url": "=https://www.virustotal.com/api/v3/files/{{ $json.current_hash }}",
        "method": "GET",
        "nodeCredentialType": "virusTotalApi",
        "options": {
          "response": {
            "response": {
              "neverError": true,
              "responseFormat": "json",
              "fullResponse": false
            }
          }
        }
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        1380,
        140
      ],
      "id": "virustotal-lookup",
      "name": "VirusTotal Lookup",
      "credentials": {
        "virusTotalApi": {
          "name": "<your credential>"
        }
      },
      "onError": "continueRegularOutput"
    },
    {
      "parameters": {
        "assignments": {
          "assignments": [
            {
              "id": "ti-report",
              "name": "report_id",
              "value": "={{ $('Merge Sealed and Observed').item.json.report_id }}",
              "type": "string"
            },
            {
              "id": "ti-report-name",
              "name": "report_name",
              "value": "={{ $('Merge Sealed and Observed').item.json.report_name }}",
              "type": "string"
            },
            {
              "id": "ti-sealed",
              "name": "sealed_hash",
              "value": "={{ $('Merge Sealed and Observed').item.json.file_hash }}",
              "type": "string"
            },
            {
              "id": "ti-observed",
              "name": "observed_hash",
              "value": "={{ $('Merge Sealed and Observed').item.json.current_hash }}",
              "type": "string"
            },
            {
              "id": "ti-malicious",
              "name": "malicious_count",
              "value": "={{ $json.data?.attributes?.last_analysis_stats?.malicious ?? 0 }}",
              "type": "number"
            },
            {
              "id": "ti-suspicious",
              "name": "suspicious_count",
              "value": "={{ $json.data?.attributes?.last_analysis_stats?.suspicious ?? 0 }}",
              "type": "number"
            }
          ]
        },
        "options": {}
      },
      "type": "n8n-nodes-base.set",
      "typeVersion": 3.4,
      "position": [
        1600,
        140
      ],
      "id": "extract-vt-score",
      "name": "Extract VT Score"
    },
    {
      "parameters": {
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "url": "=http://host.docker.internal:8000/api/report/integrity/{{ $json.report_id }}",
        "method": "PATCH",
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({ integrity_state: \"TAMPERED\", observed_hash: $json.observed_hash }) }}",
        "options": {}
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        1820,
        140
      ],
      "id": "update-integrity-state---tampered",
      "name": "Update Integrity State - TAMPERED",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "url": "http://host.docker.internal:8000/api/security/alert",
        "method": "POST",
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({\n  severity: 'critical',\n  source: 'FIM & Audit Engine',\n  report_id: $('Extract VT Score').item.json.report_id,\n  message: 'File integrity mismatch on the source log for '\n    + $('Extract VT Score').item.json.report_name\n    + '. Sealed ' + $('Extract VT Score').item.json.sealed_hash\n    + ', observed ' + $('Extract VT Score').item.json.observed_hash\n    + '. VirusTotal: ' + $('Extract VT Score').item.json.malicious_count\n    + ' engines flagged the artifact as malicious.'\n}) }}",
        "options": {}
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        2040,
        140
      ],
      "id": "send-security-alert",
      "name": "Send Security Alert",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    }
  ],
  "connections": {
    "Scheduled Integrity Scan": {
      "main": [
        [
          {
            "node": "Fetch Reports Batch",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Reports Batch": {
      "main": [
        [
          {
            "node": "Split Reports",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Split Reports": {
      "main": [
        [],
        [
          {
            "node": "Fetch Report Metadata",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Report Metadata": {
      "main": [
        [
          {
            "node": "Only Sealed Reports",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Only Sealed Reports": {
      "main": [
        [
          {
            "node": "Merge Sealed and Observed",
            "type": "main",
            "index": 0
          },
          {
            "node": "Download Original File",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Download Original File": {
      "main": [
        [
          {
            "node": "Generate SHA256 Hash",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Generate SHA256 Hash": {
      "main": [
        [
          {
            "node": "Merge Sealed and Observed",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge Sealed and Observed": {
      "main": [
        [
          {
            "node": "Integrity Comparison Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Integrity Comparison Check": {
      "main": [
        [
          {
            "node": "Update Integrity State - SEALED",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "VirusTotal Lookup",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Update Integrity State - SEALED": {
      "main": [
        [
          {
            "node": "Split Reports",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "VirusTotal Lookup": {
      "main": [
        [
          {
            "node": "Extract VT Score",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract VT Score": {
      "main": [
        [
          {
            "node": "Update Integrity State - TAMPERED",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Update Integrity State - TAMPERED": {
      "main": [
        [
          {
            "node": "Send Security Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Send Security Alert": {
      "main": [
        [
          {
            "node": "Split Reports",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {
    "executionOrder": "v1"
  }
}