The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"name": "Automated File Integrity Monitoring (FIM) & Audit Engine",
"nodes": [
{
"parameters": {
"rule": {
"interval": [
{
"field": "minutes",
"minutesInterval": 15
}
]
}
},
"type": "n8n-nodes-base.scheduleTrigger",
"typeVersion": 1.2,
"position": [
-620,
0
],
"id": "scheduled-integrity-scan",
"name": "Scheduled Integrity Scan"
},
{
"parameters": {
"authentication": "genericCredentialType",
"genericAuthType": "httpHeaderAuth",
"url": "http://host.docker.internal:8000/get_all_reports",
"options": {}
},
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
-400,
0
],
"id": "fetch-reports-batch",
"name": "Fetch Reports Batch",
"credentials": {
"httpHeaderAuth": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"batchSize": 1,
"options": {}
},
"type": "n8n-nodes-base.splitInBatches",
"typeVersion": 3,
"position": [
-180,
0
],
"id": "split-reports",
"name": "Split Reports"
},
{
"parameters": {
"authentication": "genericCredentialType",
"genericAuthType": "httpHeaderAuth",
"url": "=http://host.docker.internal:8000/get_report_by_id/{{ $json.report_id }}",
"options": {}
},
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
40,
0
],
"id": "fetch-report-metadata",
"name": "Fetch Report Metadata",
"credentials": {
"httpHeaderAuth": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"conditions": {
"options": {
"caseSensitive": true,
"typeValidation": "loose",
"version": 2
},
"conditions": [
{
"id": "has-sealed-hash",
"leftValue": "={{ $json.file_hash }}",
"rightValue": "",
"operator": {
"type": "string",
"operation": "notEmpty",
"singleValue": true
}
}
],
"combinator": "and"
},
"options": {}
},
"type": "n8n-nodes-base.filter",
"typeVersion": 2.2,
"position": [
260,
0
],
"id": "only-sealed-reports",
"name": "Only Sealed Reports"
},
{
"parameters": {
"authentication": "genericCredentialType",
"genericAuthType": "httpHeaderAuth",
"url": "=http://host.docker.internal:8000/documents/{{ $json.document_id }}/download",
"options": {
"response": {
"response": {
"responseFormat": "file"
}
}
}
},
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
480,
100
],
"id": "download-original-file",
"name": "Download Original File",
"credentials": {
"httpHeaderAuth": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"type": "SHA256",
"binaryData": true,
"dataPropertyName": "current_hash"
},
"type": "n8n-nodes-base.crypto",
"typeVersion": 1,
"position": [
700,
100
],
"id": "generate-sha256-hash",
"name": "Generate SHA256 Hash"
},
{
"parameters": {
"mode": "combine",
"combineBy": "combineByPosition",
"options": {}
},
"type": "n8n-nodes-base.merge",
"typeVersion": 3,
"position": [
920,
0
],
"id": "merge-sealed-and-observed",
"name": "Merge Sealed and Observed"
},
{
"parameters": {
"conditions": {
"options": {
"caseSensitive": false,
"typeValidation": "loose",
"version": 2
},
"conditions": [
{
"id": "hashes-match",
"leftValue": "={{ $json.current_hash }}",
"rightValue": "={{ $json.file_hash }}",
"operator": {
"type": "string",
"operation": "equals"
}
}
],
"combinator": "and"
},
"options": {}
},
"type": "n8n-nodes-base.if",
"typeVersion": 2.2,
"position": [
1140,
0
],
"id": "integrity-comparison-check",
"name": "Integrity Comparison Check"
},
{
"parameters": {
"authentication": "genericCredentialType",
"genericAuthType": "httpHeaderAuth",
"url": "=http://host.docker.internal:8000/api/report/integrity/{{ $json.report_id }}",
"method": "PATCH",
"sendBody": true,
"specifyBody": "json",
"jsonBody": "={{ JSON.stringify({ integrity_state: \"SEALED\" }) }}",
"options": {}
},
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
1380,
-140
],
"id": "update-integrity-state---sealed",
"name": "Update Integrity State - SEALED",
"credentials": {
"httpHeaderAuth": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"authentication": "predefinedCredentialType",
"url": "=https://www.virustotal.com/api/v3/files/{{ $json.current_hash }}",
"method": "GET",
"nodeCredentialType": "virusTotalApi",
"options": {
"response": {
"response": {
"neverError": true,
"responseFormat": "json",
"fullResponse": false
}
}
}
},
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
1380,
140
],
"id": "virustotal-lookup",
"name": "VirusTotal Lookup",
"credentials": {
"virusTotalApi": {
"name": "<your credential>"
}
},
"onError": "continueRegularOutput"
},
{
"parameters": {
"assignments": {
"assignments": [
{
"id": "ti-report",
"name": "report_id",
"value": "={{ $('Merge Sealed and Observed').item.json.report_id }}",
"type": "string"
},
{
"id": "ti-report-name",
"name": "report_name",
"value": "={{ $('Merge Sealed and Observed').item.json.report_name }}",
"type": "string"
},
{
"id": "ti-sealed",
"name": "sealed_hash",
"value": "={{ $('Merge Sealed and Observed').item.json.file_hash }}",
"type": "string"
},
{
"id": "ti-observed",
"name": "observed_hash",
"value": "={{ $('Merge Sealed and Observed').item.json.current_hash }}",
"type": "string"
},
{
"id": "ti-malicious",
"name": "malicious_count",
"value": "={{ $json.data?.attributes?.last_analysis_stats?.malicious ?? 0 }}",
"type": "number"
},
{
"id": "ti-suspicious",
"name": "suspicious_count",
"value": "={{ $json.data?.attributes?.last_analysis_stats?.suspicious ?? 0 }}",
"type": "number"
}
]
},
"options": {}
},
"type": "n8n-nodes-base.set",
"typeVersion": 3.4,
"position": [
1600,
140
],
"id": "extract-vt-score",
"name": "Extract VT Score"
},
{
"parameters": {
"authentication": "genericCredentialType",
"genericAuthType": "httpHeaderAuth",
"url": "=http://host.docker.internal:8000/api/report/integrity/{{ $json.report_id }}",
"method": "PATCH",
"sendBody": true,
"specifyBody": "json",
"jsonBody": "={{ JSON.stringify({ integrity_state: \"TAMPERED\", observed_hash: $json.observed_hash }) }}",
"options": {}
},
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
1820,
140
],
"id": "update-integrity-state---tampered",
"name": "Update Integrity State - TAMPERED",
"credentials": {
"httpHeaderAuth": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"authentication": "genericCredentialType",
"genericAuthType": "httpHeaderAuth",
"url": "http://host.docker.internal:8000/api/security/alert",
"method": "POST",
"sendBody": true,
"specifyBody": "json",
"jsonBody": "={{ JSON.stringify({\n severity: 'critical',\n source: 'FIM & Audit Engine',\n report_id: $('Extract VT Score').item.json.report_id,\n message: 'File integrity mismatch on the source log for '\n + $('Extract VT Score').item.json.report_name\n + '. Sealed ' + $('Extract VT Score').item.json.sealed_hash\n + ', observed ' + $('Extract VT Score').item.json.observed_hash\n + '. VirusTotal: ' + $('Extract VT Score').item.json.malicious_count\n + ' engines flagged the artifact as malicious.'\n}) }}",
"options": {}
},
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
2040,
140
],
"id": "send-security-alert",
"name": "Send Security Alert",
"credentials": {
"httpHeaderAuth": {
"name": "<your credential>"
}
}
}
],
"connections": {
"Scheduled Integrity Scan": {
"main": [
[
{
"node": "Fetch Reports Batch",
"type": "main",
"index": 0
}
]
]
},
"Fetch Reports Batch": {
"main": [
[
{
"node": "Split Reports",
"type": "main",
"index": 0
}
]
]
},
"Split Reports": {
"main": [
[],
[
{
"node": "Fetch Report Metadata",
"type": "main",
"index": 0
}
]
]
},
"Fetch Report Metadata": {
"main": [
[
{
"node": "Only Sealed Reports",
"type": "main",
"index": 0
}
]
]
},
"Only Sealed Reports": {
"main": [
[
{
"node": "Merge Sealed and Observed",
"type": "main",
"index": 0
},
{
"node": "Download Original File",
"type": "main",
"index": 0
}
]
]
},
"Download Original File": {
"main": [
[
{
"node": "Generate SHA256 Hash",
"type": "main",
"index": 0
}
]
]
},
"Generate SHA256 Hash": {
"main": [
[
{
"node": "Merge Sealed and Observed",
"type": "main",
"index": 1
}
]
]
},
"Merge Sealed and Observed": {
"main": [
[
{
"node": "Integrity Comparison Check",
"type": "main",
"index": 0
}
]
]
},
"Integrity Comparison Check": {
"main": [
[
{
"node": "Update Integrity State - SEALED",
"type": "main",
"index": 0
}
],
[
{
"node": "VirusTotal Lookup",
"type": "main",
"index": 0
}
]
]
},
"Update Integrity State - SEALED": {
"main": [
[
{
"node": "Split Reports",
"type": "main",
"index": 0
}
]
]
},
"VirusTotal Lookup": {
"main": [
[
{
"node": "Extract VT Score",
"type": "main",
"index": 0
}
]
]
},
"Extract VT Score": {
"main": [
[
{
"node": "Update Integrity State - TAMPERED",
"type": "main",
"index": 0
}
]
]
},
"Update Integrity State - TAMPERED": {
"main": [
[
{
"node": "Send Security Alert",
"type": "main",
"index": 0
}
]
]
},
"Send Security Alert": {
"main": [
[
{
"node": "Split Reports",
"type": "main",
"index": 0
}
]
]
}
},
"settings": {
"executionOrder": "v1"
}
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
httpHeaderAuthvirusTotalApi
Pro
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
Automated File Integrity Monitoring (FIM) & Audit Engine. Uses httpRequest, crypto. Scheduled trigger; 14 nodes.
Source: https://github.com/Zaidzyy/AIPCC/blob/main/n8n/fim-and-audit-engine.json — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
Proactively alert to service endpoint changes and pod/container issues (Pending, Not Ready, Restart spikes) using Prometheus metrics, formatted and sent to Slack.
HTTP Request
Tired of being let down by the Google Drive Trigger? Rather not exhaust system resources by polling every minute? Then this workflow is for you!
HTTP Request, Execute Workflow Trigger
Triggers at a regular interval or via a webhook request. Solves AWS WAF challenge then makes a request to fetch the product page. Extracts product data from the retrieved HTML page. Compares the curre
N8N Nodes Capsolver, HTTP Request
🔄 Monitor Container Images from Docker Hub or GHCR.
HTTP Request
Automatically monitor billable Kimai projects every weekday morning and receive a formatted HTML email when a project deadline is approaching or its hour budget is running low. If nothing requires att
Email Send, HTTP Request