AI Security Report Orchestrator

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

{
  "name": "AI Security Report Orchestrator",
  "nodes": [
    {
      "parameters": {
        "assignments": {
          "assignments": [
            {
              "id": "carry-document-id",
              "name": "document_id",
              "value": "={{ $json.document_id }}",
              "type": "string"
            },
            {
              "id": "carry-document-name",
              "name": "document_name",
              "value": "={{ $json.document_name }}",
              "type": "string"
            },
            {
              "id": "3dace635-b4a9-453c-ae1a-fab3a6e6b830",
              "name": "title",
              "value": "=Auto Generated Security Incident",
              "type": "string"
            },
            {
              "id": "a6e61290-4ab0-4686-a521-d101da544c1e",
              "name": "visibility",
              "value": "={{ $node[\"Report Generation Webhook\"].json.body.classification }}",
              "type": "string"
            },
            {
              "id": "ae4f2dcc-2ac6-4319-83e8-3a77b4d17e5f",
              "name": "logs_text",
              "value": "={{ ($json.content || '').slice(0, 4000) }}",
              "type": "string"
            },
            {
              "id": "900c7e86-25ff-4fe7-8cd1-12b01b0e4a18",
              "name": "created_by",
              "value": "=SOC-AI",
              "type": "string"
            },
            {
              "id": "ea5b9d70-e071-4523-ae54-42ddf7866349",
              "name": "created_at",
              "value": "=={{ new Date().toISOString() }}",
              "type": "string"
            }
          ]
        },
        "options": {}
      },
      "type": "n8n-nodes-base.set",
      "typeVersion": 3.4,
      "position": [
        2016,
        656
      ],
      "id": "cd046447-9593-4553-8277-6e3a20597482",
      "name": "Normalize Input Data"
    },
    {
      "parameters": {
        "promptType": "define",
        "text": "=You are a cybersecurity reporting engine acting as a senior SOC analyst.\n\nGenerate a professional, SOC-ready security incident report aligned with enterprise SOC documentation standards, using ONLY the inputs provided below.\nEnsure analysis depth matches the severity level.\n\nInputs:\n\nTitle: {{ $json.title }}\nVisibility: {{ $json.visibility }}\nReport Type: {{ $json.report_type }}\nAttack Type: {{ $json.attack_type }}\nAffected Asset: {{ $json.affected_asset }}\nSeverity: {{ $json.severity }}\nRequested Analysis Options: {{ $json.ai_options }}\n\nRaw Security Logs:\n{{ $json.logs_text }}\n\nThreat Intelligence Enrichment:\n\nAbuse Confidence Score: {{ $json.ip_reputation_score }}\n\nRisk Level: {{ $json.ti_risk_level }}\n\nCountry: {{ $json.ip_country }}\n\nUsage Type: {{ $json.ip_usage_type }}\n\nDetected IPs: {{ $json.extracted_indicators.ip_addresses }}\n\nThreat Intelligence Escalation Logic:\n\nIf Abuse Confidence Score >= 80:\n\nExplicitly classify infrastructure as confirmed malicious\n\nIf Abuse Confidence Score >= 80 AND provided severity is LOW or MEDIUM, set severity to HIGH\n\nIf provided severity is HIGH or CRITICAL, keep it unchanged\n\nReflect this in risk_explanation section\n\nSTRICT RULES:\n\nYou MUST respond in valid JSON only\n\nDo NOT include markdown\n\nDo NOT include explanations outside JSON\n\nDo NOT add or remove fields\n\nDo NOT rename fields\n\nDo NOT change structure\n\nFill all fields meaningfully\n\nThe JSON must strictly follow the schema\n\nNo duplicate keys are allowed\n\n\"sections\" object must contain exactly 5 keys\n\n\"attacks\" must ALWAYS be present\n\n\"vulnerability\" must ALWAYS be present\n\n\"detected_anomalies\" must ALWAYS be present\n\n\"timeline\" must ALWAYS be present\n\n\"general_risk_assessment\" must ALWAYS be present\n\nIf no attack details are available, return \"attacks\": []\n\nIf no vulnerabilities are observed, return \"vulnerability\": []\n\nIf no anomalies are detected, return \"detected_anomalies\": []\n\nIf no timeline reconstruction possible, return \"timeline\": []\n\nIf no enterprise risk modeling required, return \"general_risk_assessment\": []\n\nconfidence_score must be a number between 0 and 1\n\nTimeline must be chronologically ordered if timestamps exist\n\nDo not fabricate CVE IDs unless exploitation is clearly evidenced\n\nIf any input field is undefined, null, or empty, return it exactly as received (do not invent values)\n\nDo not override provided values except for severity escalation rule above\n\nYou may infer MITRE ATT&CK techniques only if supported by log evidence\n\nIf unsure about MITRE mapping, leave technique fields empty\n\nDo not fabricate or assume missing inputs\n\nOutput Structure (Return EXACTLY This):\n\n{\n\"title\": \"\",\n\"visibility\": \"\",\n\"report_type\": \"\",\n\"attack_type\": \"\",\n\"affected_asset\": \"\",\n\"severity\": \"\",\n\n\"attacks\": [\n{\n\"attack_name\": \"\",\n\"attack_mitre_technique_id\": \"\",\n\"attack_mitre_technique_name\": \"\",\n\"attack_description\": \"\",\n\"risk_name\": \"\",\n\"risk_level\": \"\",\n\"confidence_score\": 0.0\n}\n],\n\n\"vulnerability\": [\n{\n\"vulnerability_name\": \"\",\n\"description\": \"\",\n\"CVE_ID\": \"\",\n\"CVE_Description\": \"\",\n\"CWE_ID\": \"\",\n\"CWE_Description\": \"\",\n\"severity\": \"\"\n}\n],\n\n\"detected_anomalies\": [\n{\n\"anomaly_id\": \"\",\n\"description\": \"\",\n\"user_name\": \"\",\n\"source_ip\": \"\",\n\"destination_ip\": \"\",\n\"protocol\": \"\",\n\"counted\": 0,\n\"first_occurrence\": \"\",\n\"last_occurrence\": \"\"\n}\n],\n\n\"timeline\": [\n{\n\"event_name\": \"\",\n\"timestamp\": \"\",\n\"entity\": \"\",\n\"duration\": \"\"\n}\n],\n\n\"general_risk_assessment\": [\n{\n\"risk_name\": \"\",\n\"risk_description\": \"\",\n\"risk_level\": \"\",\n\"impact\": \"\",\n\"likelihood\": \"\",\n\"mitigation\": \"\"\n}\n],\n\n\"sections\": {\n\"executive_summary\": \"\",\n\"risk_explanation\": \"\",\n\"anomaly_analysis\": \"\",\n\"mitigation_recommendations\": \"\",\n\"execution_summary\": \"\"\n},\n\n\"created_by\": \"SOC-AI\",\n\"created_at\": \"\"\n}\n\nOUTPUT SIZE LIMITS (these are hard limits, not suggestions):\nReturn AT MOST 3 items in \"attacks\"\nReturn AT MOST 3 items in \"vulnerability\"\nReturn AT MOST 5 items in \"detected_anomalies\" \u2014 group similar rows into a single anomaly and use \"counted\" for how many times it occurred. Do NOT emit one entry per log line.\nReturn AT MOST 5 items in \"timeline\" \u2014 the most significant events only\nReturn AT MOST 3 items in \"general_risk_assessment\"\nDo NOT include comments of any kind in the JSON. No // and no /* */. A comment makes the response invalid and it will be discarded.\n",
        "hasOutputParser": true,
        "options": {}
      },
      "type": "@n8n/n8n-nodes-langchain.agent",
      "typeVersion": 3.1,
      "position": [
        2768,
        656
      ],
      "id": "8c4cbc15-5f5f-40eb-9b88-a5cb4770ea1a",
      "name": "AI Report Analysis Engine"
    },
    {
      "parameters": {
        "model": "llama-3.1-8b-instant",
        "options": {
          "maxTokensToSample": 3000
        }
      },
      "type": "@n8n/n8n-nodes-langchain.lmChatGroq",
      "typeVersion": 1,
      "position": [
        2832,
        976
      ],
      "id": "73dbc99a-17e2-45ef-8323-ee94b2a54d74",
      "name": "LLM \u2013 Groq Inference",
      "credentials": {
        "groqApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "method": "POST",
        "url": "http://host.docker.internal:8000/store_generated_report",
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "sendBody": true,
        "options": {},
        "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({\n  document_id: $('Normalize Input Data').item.json.document_id,\n  report_name: 'Orchestrator \u2014 ' + $('Normalize Input Data').item.json.document_name,\n  classification: $('Normalize Input Data').item.json.visibility || 'Internal',\n  sections: {\n    attack_types: $json.parsed_report?.attack_types ?? $json.parsed_report?.attacks ?? [],\n    general_risk_assessment: $json.parsed_report?.general_risk_assessment ?? [],\n    vulnerabilities: $json.parsed_report?.vulnerabilities ?? $json.parsed_report?.vulnerability ?? [],\n    anomalies: $json.parsed_report?.anomalies ?? $json.parsed_report?.detected_anomalies ?? [],\n    timeline: $json.parsed_report?.timeline ?? []\n  },\n  threat_intel: ($('Risk Scoring Engine').item.json.classified_iocs ?? []).map(ioc => {\n    const looked_up = ioc.value === $('Risk Scoring Engine').item.json.data?.ipAddress;\n    return {\n      indicator: ioc.value,\n      indicator_type: ioc.type === 'IP Address' ? 'ip'\n        : ioc.type === 'File Hash' ? 'hash' : 'domain',\n      category: ioc.category,\n      source: looked_up ? 'abuseipdb' : 'n8n',\n      reputation_score: looked_up\n        ? $('Risk Scoring Engine').item.json.ip_reputation_score : null,\n      risk_level: looked_up\n        ? $('Risk Scoring Engine').item.json.ti_risk_level : null,\n      country: looked_up ? $('Risk Scoring Engine').item.json.ip_country : null,\n      usage_type: looked_up ? $('Risk Scoring Engine').item.json.ip_usage_type : null\n    };\n  })\n}) }}"
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.3,
      "position": [
        3520,
        672
      ],
      "id": "78ea5d98-3f11-445a-9393-cff803cbf3cd",
      "name": "Save AI Analysis",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "jsCode": "const text = $json.logs_text || \"\";\n\n// Extract IPv4 addresses\nconst ipRegex = /\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/g;\nconst ips = text.match(ipRegex) || [];\n\n// Extract SHA256 hashes\nconst sha256Regex = /\\b[a-fA-F0-9]{64}\\b/g;\nconst hashes = text.match(sha256Regex) || [];\n\nreturn [{\n  ...$json,\n  extracted_indicators: {\n    ip_addresses: ips,\n    sha256_hashes: hashes\n  }\n}];\n"
      },
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        2032,
        976
      ],
      "id": "02c948b5-a056-4d59-ad78-62d70fbc80c6",
      "name": "Extract Indicators"
    },
    {
      "parameters": {
        "url": "https://api.abuseipdb.com/api/v2/check",
        "sendQuery": true,
        "queryParameters": {
          "parameters": [
            {
              "name": "=ipAddress",
              "value": "={{ $json.extracted_indicators?.ip_addresses?.[0] || \"\" }}"
            },
            {
              "name": "maxAgeInDays",
              "value": "90"
            }
          ]
        },
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [
            {
              "name": "Accept",
              "value": "application/json"
            }
          ]
        },
        "options": {},
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth"
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.3,
      "position": [
        2416,
        624
      ],
      "id": "828812e0-5c50-41c3-a872-e87fa4d481fb",
      "name": "IP Reputation Lookup",
      "onError": "continueRegularOutput",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "assignments": {
          "assignments": [
            {
              "id": "25e6c035-8230-435f-b0bd-3c90677b2e45",
              "name": "ip_reputation_score",
              "value": "={{ $json.data?.abuseConfidenceScore || 0 }}",
              "type": "string"
            },
            {
              "id": "fb6e1e16-29c7-452f-a397-1b7610d1cfae",
              "name": "ip_country",
              "value": "={{ $json.data?.countryCode ?? \"Unknown\" }}",
              "type": "string"
            },
            {
              "id": "191d8eb7-070f-49ae-a004-180c603a2e1b",
              "name": "ip_usage_type",
              "value": "={{ $json.data?.usageType ?? \"Unknown\" }}",
              "type": "string"
            },
            {
              "id": "e7a57d31-c774-49f4-a74d-cf0321985e3c",
              "name": "ti_risk_level",
              "value": "={{\n  ($json.data?.abuseConfidenceScore ?? 0) > 80\n    ? \"CRITICAL\"\n    : ($json.data?.abuseConfidenceScore ?? 0) > 50\n      ? \"HIGH\"\n      : ($json.data?.abuseConfidenceScore ?? 0) > 20\n        ? \"MEDIUM\"\n        : \"LOW\"\n}}",
              "type": "string"
            }
          ]
        },
        "includeOtherFields": true,
        "options": {}
      },
      "type": "n8n-nodes-base.set",
      "typeVersion": 3.4,
      "position": [
        2416,
        1008
      ],
      "id": "64b9c1a5-c531-4d7e-a488-dab63183ce2d",
      "name": "Normalize TI Context"
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": "",
            "typeValidation": "strict",
            "version": 3
          },
          "conditions": [
            {
              "id": "7001b61b-4eb8-4cdc-90d7-7de3e7c8ea0b",
              "leftValue": "={{ $json.extracted_indicators.ip_addresses.length }}",
              "rightValue": 0,
              "operator": {
                "type": "number",
                "operation": "gt"
              }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.3,
      "position": [
        2192,
        864
      ],
      "id": "37857fae-dbcc-4ccf-a761-e2a0ce8a63bf",
      "name": "If"
    },
    {
      "parameters": {
        "jsCode": "const data = $input.first().json;\n\n// Initialize score\nlet score = 0;\n\n// 1. AbuseIPDB score contribution (0\u201340)\nconst abuseScore = data.ip_reputation_score || 0;\nscore += Math.min(abuseScore * 0.4, 40);\n\n// 2. Indicator count contribution (0\u201325)\nconst ipCount = data.extracted_indicators?.ip_addresses?.length || 0;\nconst hashCount = data.extracted_indicators?.sha256_hashes?.length || 0;\n\nconst indicatorScore = (ipCount * 5) + (hashCount * 8);\nscore += Math.min(indicatorScore, 25);\n\n// 3. Severity contribution (0\u201320)\nconst severity = (data.severity || \"\").toLowerCase();\n\nif (severity === \"critical\") score += 20;\nelse if (severity === \"high\") score += 15;\nelse if (severity === \"medium\") score += 10;\nelse if (severity === \"low\") score += 5;\n\n// 4. Threat intelligence risk level (0\u201315)\nconst tiRisk = (data.ti_risk_level || \"\").toLowerCase();\n\nif (tiRisk === \"critical\") score += 15;\nelse if (tiRisk === \"high\") score += 15;\nelse if (tiRisk === \"medium\") score += 10;\nelse if (tiRisk === \"low\") score += 5;\n\n// Clamp score\nscore = Math.min(Math.round(score), 100);\n\n// Determine risk level\nlet riskLevel = \"LOW\";\n\nif (score >= 75) riskLevel = \"CRITICAL\";\nelse if (score >= 50) riskLevel = \"HIGH\";\nelse if (score >= 25) riskLevel = \"MEDIUM\";\n\n// \u2705 Preserve ALL previous fields properly\nreturn [\n  {\n    json: {\n      ...data,\n      risk_score: score,\n      risk_level: riskLevel,\n    }\n  }\n];"
      },
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        2624,
        1024
      ],
      "id": "072729e7-21b8-481a-9cc3-9ab69749f422",
      "name": "Risk Scoring Engine"
    },
    {
      "parameters": {
        "jsCode": "const data = $input.first().json;\n\nconst classified_iocs = [];\n\n/*\nCLASSIFY IP ADDRESSES\n*/\nconst ip_sources = [\n    ...(data.extracted_indicators?.ip_addresses || []),\n    ...(data.data?.ipAddress ? [data.data.ipAddress] : [])\n];\n\nfor (const ip of ip_sources) {\n\n    let category = \"External Infrastructure\";\n    let weight = 30;\n\n    if (\n        ip.startsWith(\"10.\") ||\n        ip.startsWith(\"172.\") ||\n        ip.startsWith(\"192.\")\n    ) {\n        category = \"Internal Infrastructure\";\n        weight = 5;\n    }\n\n    classified_iocs.push({\n        value: ip,\n        type: \"IP Address\",\n        category,\n        risk_weight: weight\n    });\n}\n\n\n/*\nCLASSIFY FILE HASHES\n*/\nfor (const hash of (data.extracted_indicators?.sha256_hashes || [])) {\n\n    classified_iocs.push({\n        value: hash,\n        type: \"File Hash\",\n        category: \"Malware Artifact\",\n        risk_weight: 40\n    });\n}\n\n\n/*\nCLASSIFY DOMAINS\n*/\nconst domain_sources = [\n    ...(data.data?.domain ? [data.data.domain] : []),\n    ...(data.data?.hostnames || [])\n];\n\nfor (const domain of domain_sources) {\n\n    classified_iocs.push({\n        value: domain,\n        type: \"Domain\",\n        category: \"Network Indicator\",\n        risk_weight: 25\n    });\n}\n\n\n/*\nRETURN RESULT\n*/\nreturn [\n{\n    json: {\n        ...data,\n        classified_iocs\n    }\n}\n];\n"
      },
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        2560,
        848
      ],
      "id": "aef1d6e9-d6a4-4de6-99ce-3aa94f8d4c72",
      "name": "IOC Classification Engine"
    },
    {
      "parameters": {
        "assignments": {
          "assignments": [
            {
              "id": "4c4d0ff6-7741-4e7c-a4d7-1d6082d37042",
              "name": "parsed_report",
              "value": "={{ (() => {\n  let t = ($json.output || '')\n    .replace(/<think>[\\s\\S]*?<\\/think>/gi, '')\n    .replace(/```json/gi, '')\n    .replace(/```/g, '');\n  const s = t.indexOf('{'), e = t.lastIndexOf('}');\n  if (s === -1 || e <= s) return null;\n  t = t.slice(s, e + 1)\n    .replace(/\\/\\*[\\s\\S]*?\\*\\//g, '')\n    .replace(/(^|[^:])\\/\\/[^\\n\\r]*/g, '$1')\n    .replace(/,(\\s*[}\\]])/g, '$1');\n  try { return JSON.parse(t); } catch (err) { return null; }\n})() }}",
              "type": "object"
            }
          ]
        },
        "options": {}
      },
      "type": "n8n-nodes-base.set",
      "typeVersion": 3.4,
      "position": [
        3040,
        912
      ],
      "id": "31b21d06-62c5-410b-afc1-3099baa2ea2b",
      "name": "Edit Fields"
    },
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "analyze-report",
        "responseMode": "lastNode",
        "options": {}
      },
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2.1,
      "position": [
        1664,
        624
      ],
      "id": "8dc090fc-b4b1-4590-b6b0-f1fd31d7ec14",
      "name": "Report Generation Webhook"
    },
    {
      "parameters": {
        "url": "http://host.docker.internal:8000/get_latest_document_content",
        "options": {},
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth"
      },
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.3,
      "position": [
        1712,
        896
      ],
      "id": "18554314-efbf-4c28-bb4c-d7c5fc8e8d57",
      "name": "GET logs",
      "credentials": {
        "httpHeaderAuth": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "mode": "combine",
        "combineBy": "combineByPosition",
        "options": {}
      },
      "type": "n8n-nodes-base.merge",
      "typeVersion": 3.2,
      "position": [
        2880,
        1168
      ],
      "id": "876dc4ac-2f31-4e73-848f-b20b1456a5ae",
      "name": "Merge"
    }
  ],
  "connections": {
    "Normalize Input Data": {
      "main": [
        [
          {
            "node": "Extract Indicators",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "AI Report Analysis Engine": {
      "main": [
        [
          {
            "node": "Edit Fields",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "LLM \u2013 Groq Inference": {
      "ai_languageModel": [
        [
          {
            "node": "AI Report Analysis Engine",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Extract Indicators": {
      "main": [
        [
          {
            "node": "If",
            "type": "main",
            "index": 0
          },
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IP Reputation Lookup": {
      "main": [
        [
          {
            "node": "Normalize TI Context",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Normalize TI Context": {
      "main": [
        [
          {
            "node": "IOC Classification Engine",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "If": {
      "main": [
        [
          {
            "node": "IP Reputation Lookup",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Normalize TI Context",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Risk Scoring Engine": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "IOC Classification Engine": {
      "main": [
        [
          {
            "node": "Risk Scoring Engine",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Edit Fields": {
      "main": [
        [
          {
            "node": "Save AI Analysis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Report Generation Webhook": {
      "main": [
        [
          {
            "node": "GET logs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "GET logs": {
      "main": [
        [
          {
            "node": "Normalize Input Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge": {
      "main": [
        [
          {
            "node": "AI Report Analysis Engine",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "active": true,
  "settings": {
    "executionOrder": "v1",
    "availableInMCP": false
  },
  "versionId": "32e5dc4e-eccc-4502-9815-a297e4096acc",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "id": "45ZgjL9W9aFldK-BcZqLa",
  "tags": []
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

• groqApi
• httpHeaderAuth

About this workflow

AI Security Report Orchestrator. Uses agent, lmChatGroq, httpRequest. Webhook trigger; 14 nodes.

Source: https://github.com/Zaidzyy/AIPCC/blob/main/n8n/ai-security-report-orchestrator.json — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.