{
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours"
            }
          ]
        }
      },
      "id": "3adf47a6-856c-4c38-b609-c59d0243b046",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        -1632,
        416
      ]
    },
    {
      "parameters": {
        "assignments": {
          "assignments": [
            {
              "id": "id-1",
              "name": "logApiUrl",
              "value": "<__PLACEHOLDER_VALUE__Log API endpoint URL__>",
              "type": "string"
            },
            {
              "id": "id-2",
              "name": "baselineApiUrl",
              "value": "<__PLACEHOLDER_VALUE__Baseline API endpoint URL__>",
              "type": "string"
            },
            {
              "id": "id-3",
              "name": "resourceApiUrl",
              "value": "<__PLACEHOLDER_VALUE__Resource API endpoint URL__>",
              "type": "string"
            },
            {
              "id": "id-4",
              "name": "changesApiUrl",
              "value": "<__PLACEHOLDER_VALUE__Changes API endpoint URL__>",
              "type": "string"
            },
            {
              "id": "id-5",
              "name": "healthApiUrl",
              "value": "<__PLACEHOLDER_VALUE__Health check API endpoint URL__>",
              "type": "string"
            },
            {
              "id": "id-6",
              "name": "anomalyThreshold",
              "value": 0.75,
              "type": "number"
            }
          ]
        },
        "includeOtherFields": true,
        "options": {}
      },
      "id": "3030bc92-9edb-4763-ba08-0f607face09e",
      "name": "Workflow Configuration",
      "type": "n8n-nodes-base.set",
      "typeVersion": 3.4,
      "position": [
        -1408,
        416
      ]
    },
    {
      "parameters": {
        "url": "={{ $('Workflow Configuration').first().json.logApiUrl }}",
        "sendQuery": true,
        "queryParameters": {
          "parameters": [
            {
              "name": "timeRange",
              "value": "last_hour"
            }
          ]
        },
        "options": {}
      },
      "id": "448a48f0-3031-498a-84e6-a945b8f62d0c",
      "name": "Fetch Recent Logs",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        -1184,
        416
      ]
    },
    {
      "parameters": {
        "promptType": "define",
        "text": "Analyze the incoming log entries and filter out only those that are relevant for security monitoring. Focus on authentication events, access patterns, errors, and unusual activities. Return the filtered logs in JSON format with fields: timestamp, source, event_type, severity, message, user_id, ip_address.",
        "options": {}
      },
      "id": "d072cdc5-19f3-4a4e-8cd0-fed6517a3307",
      "name": "Filter Relevant Logs with AI",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "typeVersion": 2.2,
      "position": [
        -960,
        416
      ]
    },
    {
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-mini"
        },
        "options": {}
      },
      "id": "c7a3733c-f778-4fda-8254-f95d783e825d",
      "name": "OpenAI Model - Filter",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "typeVersion": 1.2,
      "position": [
        -896,
        640
      ],
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "aggregate": "aggregateAllItemData",
        "options": {}
      },
      "id": "540992cc-4f49-499b-92bd-ac3f0c2b04d0",
      "name": "Aggregate Log Patterns",
      "type": "n8n-nodes-base.aggregate",
      "typeVersion": 1,
      "position": [
        -608,
        416
      ]
    },
    {
      "parameters": {
        "promptType": "define",
        "text": "Analyze the aggregated log patterns to detect: 1) Error patterns (repeated failures, system errors, authentication failures), 2) Unusual access patterns (access from unexpected locations, unusual times, privilege escalations), 3) Suspicious user behavior. Return findings as JSON with: pattern_type, severity (low/medium/high/critical), description, affected_resources, count.",
        "options": {}
      },
      "id": "6a62248c-bec1-4654-878b-3059c8d318b0",
      "name": "Detect Errors and Unusual Access",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "typeVersion": 2.2,
      "position": [
        -384,
        416
      ]
    },
    {
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-mini"
        },
        "options": {}
      },
      "id": "d56e6ba8-dd6b-4bbd-8923-7d4757ad4585",
      "name": "OpenAI Model - Detection",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "typeVersion": 1.2,
      "position": [
        -320,
        640
      ],
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "promptType": "define",
        "text": "Perform semantic analysis on the detected patterns. Look for: 1) Anomalies that deviate from normal behavior, 2) Correlation between different events, 3) Potential security threats or system issues. Return analysis as JSON with: anomaly_score (0-1), anomaly_type, confidence_level, related_events, potential_impact, recommended_action.",
        "options": {}
      },
      "id": "1cde2cd4-9faf-4707-b4b1-7185193c2b56",
      "name": "Semantic Anomaly Analysis",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "typeVersion": 2.2,
      "position": [
        -32,
        416
      ]
    },
    {
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-mini"
        },
        "options": {}
      },
      "id": "5b1c0f6e-21a1-4385-847d-68ce94adbeb7",
      "name": "OpenAI Model - Semantic",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "typeVersion": 1.2,
      "position": [
        48,
        640
      ],
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "url": "={{ $('Workflow Configuration').first().json.baselineApiUrl }}",
        "sendQuery": true,
        "queryParameters": {
          "parameters": [
            {
              "name": "period",
              "value": "last_7_days"
            }
          ]
        },
        "options": {}
      },
      "id": "bd6248c6-5254-4868-a0f0-efae146f5d3b",
      "name": "Fetch Historical Baseline",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        320,
        416
      ]
    },
    {
      "parameters": {
        "jsCode": "// Extract anomaly score from current analysis (Semantic Anomaly Analysis node)\nconst currentAnalysis = $input.first().json;\nconst anomalyScore = currentAnalysis.anomaly_score || 0;\n\n// Get historical baseline data from Fetch Historical Baseline node\nconst historicalData = $('Fetch Historical Baseline').all();\nlet baselineScores = [];\n\nif (historicalData && historicalData.length > 0) {\n  baselineScores = historicalData.map(item => item.json.anomaly_score || 0).filter(score => score > 0);\n}\n\n// Calculate baseline average\nconst baselineAverage = baselineScores.length > 0 \n  ? baselineScores.reduce((sum, score) => sum + score, 0) / baselineScores.length \n  : 0;\n\n// Get threshold from Workflow Configuration\nconst config = $('Workflow Configuration').first().json;\nconst threshold = config.anomaly_threshold || 0.7;\n\n// Calculate deviation percentage\nconst deviationPercentage = baselineAverage > 0 \n  ? ((anomalyScore - baselineAverage) / baselineAverage) * 100 \n  : 0;\n\n// Determine if this is an anomaly\nconst isAnomaly = anomalyScore > threshold;\n\n// Return result\nreturn [\n  {\n    json: {\n      is_anomaly: isAnomaly,\n      current_score: anomalyScore,\n      baseline_score: baselineAverage,\n      deviation_percentage: Math.round(deviationPercentage * 100) / 100,\n      threshold_used: threshold,\n      timestamp: new Date().toISOString(),\n      baseline_sample_size: baselineScores.length\n    }\n  }\n];"
      },
      "id": "1203e92f-5fd7-4f81-9c73-493cd9871a85",
      "name": "Compare to Baseline",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        544,
        416
      ]
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": false,
            "leftValue": "",
            "typeValidation": "loose"
          },
          "conditions": [
            {
              "id": "id-1",
              "leftValue": "={{ $json.is_anomaly }}",
              "operator": {
                "type": "boolean",
                "operation": "true"
              }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "id": "9ba0ebc4-c2f9-46fc-b57a-16b8c330fa3f",
      "name": "Anomaly Detected?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.2,
      "position": [
        768,
        416
      ]
    },
    {
      "parameters": {
        "url": "={{ $('Workflow Configuration').first().json.resourceApiUrl }}",
        "sendQuery": true,
        "queryParameters": {
          "parameters": [
            {
              "name": "resource_id",
              "value": "={{ $json.affected_resources }}"
            }
          ]
        },
        "options": {}
      },
      "id": "064cf76c-3778-4707-9ab3-fa53be44d394",
      "name": "Get Resource Context",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        992,
        224
      ]
    },
    {
      "parameters": {
        "url": "={{ $('Workflow Configuration').first().json.changesApiUrl }}",
        "sendQuery": true,
        "queryParameters": {
          "parameters": [
            {
              "name": "timeRange",
              "value": "last_24_hours"
            }
          ]
        },
        "options": {}
      },
      "id": "eaa9b971-8200-4c46-b9ae-1b84f528ea54",
      "name": "Get Recent Changes",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        992,
        416
      ]
    },
    {
      "parameters": {
        "url": "={{ $('Workflow Configuration').first().json.healthApiUrl }}",
        "options": {}
      },
      "id": "732baa4a-9c65-41a8-83a3-782f85d5d614",
      "name": "Check Service Health",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        992,
        608
      ]
    },
    {
      "parameters": {
        "aggregate": "aggregateAllItemData",
        "options": {}
      },
      "id": "712c7e37-ca01-48f8-8801-6c168efe614c",
      "name": "Combine Investigation Data",
      "type": "n8n-nodes-base.aggregate",
      "typeVersion": 1,
      "position": [
        1216,
        416
      ]
    },
    {
      "parameters": {
        "promptType": "define",
        "text": "Generate a comprehensive investigation report based on the anomaly detection and gathered context. Include: 1) Executive Summary, 2) Anomaly Details (type, severity, score), 3) Affected Resources, 4) Recent Changes that may be related, 5) Service Health Status, 6) Root Cause Analysis, 7) Recommended Actions, 8) Timeline of Events. Format as a structured report.",
        "options": {}
      },
      "id": "742d1eb5-1e39-4e2d-9235-c93398d82e21",
      "name": "Generate Investigation Report",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "typeVersion": 2.2,
      "position": [
        1440,
        416
      ]
    },
    {
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-mini"
        },
        "options": {}
      },
      "id": "1b23adf4-5c86-4b2f-8b7a-84158cce22a6",
      "name": "OpenAI Model - Report",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "typeVersion": 1.2,
      "position": [
        1520,
        640
      ],
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      }
    }
  ],
  "connections": {
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "Workflow Configuration",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Workflow Configuration": {
      "main": [
        [
          {
            "node": "Fetch Recent Logs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Recent Logs": {
      "main": [
        [
          {
            "node": "Filter Relevant Logs with AI",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Filter Relevant Logs with AI": {
      "main": [
        [
          {
            "node": "Aggregate Log Patterns",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Model - Filter": {
      "ai_languageModel": [
        [
          {
            "node": "Filter Relevant Logs with AI",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Aggregate Log Patterns": {
      "main": [
        [
          {
            "node": "Detect Errors and Unusual Access",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Detect Errors and Unusual Access": {
      "main": [
        [
          {
            "node": "Semantic Anomaly Analysis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Model - Detection": {
      "ai_languageModel": [
        [
          {
            "node": "Detect Errors and Unusual Access",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Semantic Anomaly Analysis": {
      "main": [
        [
          {
            "node": "Fetch Historical Baseline",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Model - Semantic": {
      "ai_languageModel": [
        [
          {
            "node": "Semantic Anomaly Analysis",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Historical Baseline": {
      "main": [
        [
          {
            "node": "Compare to Baseline",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Compare to Baseline": {
      "main": [
        [
          {
            "node": "Anomaly Detected?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Anomaly Detected?": {
      "main": [
        [
          {
            "node": "Get Resource Context",
            "type": "main",
            "index": 0
          },
          {
            "node": "Get Recent Changes",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check Service Health",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Resource Context": {
      "main": [
        [
          {
            "node": "Combine Investigation Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Recent Changes": {
      "main": [
        [
          {
            "node": "Combine Investigation Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Service Health": {
      "main": [
        [
          {
            "node": "Combine Investigation Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Combine Investigation Data": {
      "main": [
        [
          {
            "node": "Generate Investigation Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Model - Report": {
      "ai_languageModel": [
        [
          {
            "node": "Generate Investigation Report",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    }
  }
}