This workflow follows the Agent → HTTP Request recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"nodes": [
{
"parameters": {
"rule": {
"interval": [
{
"field": "hours"
}
]
}
},
"id": "3adf47a6-856c-4c38-b609-c59d0243b046",
"name": "Schedule Trigger",
"type": "n8n-nodes-base.scheduleTrigger",
"typeVersion": 1.2,
"position": [
-1632,
416
]
},
{
"parameters": {
"assignments": {
"assignments": [
{
"id": "id-1",
"name": "logApiUrl",
"value": "<__PLACEHOLDER_VALUE__Log API endpoint URL__>",
"type": "string"
},
{
"id": "id-2",
"name": "baselineApiUrl",
"value": "<__PLACEHOLDER_VALUE__Baseline API endpoint URL__>",
"type": "string"
},
{
"id": "id-3",
"name": "resourceApiUrl",
"value": "<__PLACEHOLDER_VALUE__Resource API endpoint URL__>",
"type": "string"
},
{
"id": "id-4",
"name": "changesApiUrl",
"value": "<__PLACEHOLDER_VALUE__Changes API endpoint URL__>",
"type": "string"
},
{
"id": "id-5",
"name": "healthApiUrl",
"value": "<__PLACEHOLDER_VALUE__Health check API endpoint URL__>",
"type": "string"
},
{
"id": "id-6",
"name": "anomalyThreshold",
"value": 0.75,
"type": "number"
}
]
},
"includeOtherFields": true,
"options": {}
},
"id": "3030bc92-9edb-4763-ba08-0f607face09e",
"name": "Workflow Configuration",
"type": "n8n-nodes-base.set",
"typeVersion": 3.4,
"position": [
-1408,
416
]
},
{
"parameters": {
"url": "={{ $('Workflow Configuration').first().json.logApiUrl }}",
"sendQuery": true,
"queryParameters": {
"parameters": [
{
"name": "timeRange",
"value": "last_hour"
}
]
},
"options": {}
},
"id": "448a48f0-3031-498a-84e6-a945b8f62d0c",
"name": "Fetch Recent Logs",
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
-1184,
416
]
},
{
"parameters": {
"promptType": "define",
"text": "Analyze the incoming log entries and filter out only those that are relevant for security monitoring. Focus on authentication events, access patterns, errors, and unusual activities. Return the filtered logs in JSON format with fields: timestamp, source, event_type, severity, message, user_id, ip_address.",
"options": {}
},
"id": "d072cdc5-19f3-4a4e-8cd0-fed6517a3307",
"name": "Filter Relevant Logs with AI",
"type": "@n8n/n8n-nodes-langchain.agent",
"typeVersion": 2.2,
"position": [
-960,
416
]
},
{
"parameters": {
"model": {
"__rl": true,
"mode": "list",
"value": "gpt-4.1-mini"
},
"options": {}
},
"id": "c7a3733c-f778-4fda-8254-f95d783e825d",
"name": "OpenAI Model - Filter",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"typeVersion": 1.2,
"position": [
-896,
640
],
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"aggregate": "aggregateAllItemData",
"options": {}
},
"id": "540992cc-4f49-499b-92bd-ac3f0c2b04d0",
"name": "Aggregate Log Patterns",
"type": "n8n-nodes-base.aggregate",
"typeVersion": 1,
"position": [
-608,
416
]
},
{
"parameters": {
"promptType": "define",
"text": "Analyze the aggregated log patterns to detect: 1) Error patterns (repeated failures, system errors, authentication failures), 2) Unusual access patterns (access from unexpected locations, unusual times, privilege escalations), 3) Suspicious user behavior. Return findings as JSON with: pattern_type, severity (low/medium/high/critical), description, affected_resources, count.",
"options": {}
},
"id": "6a62248c-bec1-4654-878b-3059c8d318b0",
"name": "Detect Errors and Unusual Access",
"type": "@n8n/n8n-nodes-langchain.agent",
"typeVersion": 2.2,
"position": [
-384,
416
]
},
{
"parameters": {
"model": {
"__rl": true,
"mode": "list",
"value": "gpt-4.1-mini"
},
"options": {}
},
"id": "d56e6ba8-dd6b-4bbd-8923-7d4757ad4585",
"name": "OpenAI Model - Detection",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"typeVersion": 1.2,
"position": [
-320,
640
],
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"promptType": "define",
"text": "Perform semantic analysis on the detected patterns. Look for: 1) Anomalies that deviate from normal behavior, 2) Correlation between different events, 3) Potential security threats or system issues. Return analysis as JSON with: anomaly_score (0-1), anomaly_type, confidence_level, related_events, potential_impact, recommended_action.",
"options": {}
},
"id": "1cde2cd4-9faf-4707-b4b1-7185193c2b56",
"name": "Semantic Anomaly Analysis",
"type": "@n8n/n8n-nodes-langchain.agent",
"typeVersion": 2.2,
"position": [
-32,
416
]
},
{
"parameters": {
"model": {
"__rl": true,
"mode": "list",
"value": "gpt-4.1-mini"
},
"options": {}
},
"id": "5b1c0f6e-21a1-4385-847d-68ce94adbeb7",
"name": "OpenAI Model - Semantic",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"typeVersion": 1.2,
"position": [
48,
640
],
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"url": "={{ $('Workflow Configuration').first().json.baselineApiUrl }}",
"sendQuery": true,
"queryParameters": {
"parameters": [
{
"name": "period",
"value": "last_7_days"
}
]
},
"options": {}
},
"id": "bd6248c6-5254-4868-a0f0-efae146f5d3b",
"name": "Fetch Historical Baseline",
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
320,
416
]
},
{
"parameters": {
"jsCode": "// Extract anomaly score from current analysis (Semantic Anomaly Analysis node)\nconst currentAnalysis = $input.first().json;\nconst anomalyScore = currentAnalysis.anomaly_score || 0;\n\n// Get historical baseline data from Fetch Historical Baseline node\nconst historicalData = $('Fetch Historical Baseline').all();\nlet baselineScores = [];\n\nif (historicalData && historicalData.length > 0) {\n baselineScores = historicalData.map(item => item.json.anomaly_score || 0).filter(score => score > 0);\n}\n\n// Calculate baseline average\nconst baselineAverage = baselineScores.length > 0 \n ? baselineScores.reduce((sum, score) => sum + score, 0) / baselineScores.length \n : 0;\n\n// Get threshold from Workflow Configuration\nconst config = $('Workflow Configuration').first().json;\nconst threshold = config.anomaly_threshold || 0.7;\n\n// Calculate deviation percentage\nconst deviationPercentage = baselineAverage > 0 \n ? ((anomalyScore - baselineAverage) / baselineAverage) * 100 \n : 0;\n\n// Determine if this is an anomaly\nconst isAnomaly = anomalyScore > threshold;\n\n// Return result\nreturn [\n {\n json: {\n is_anomaly: isAnomaly,\n current_score: anomalyScore,\n baseline_score: baselineAverage,\n deviation_percentage: Math.round(deviationPercentage * 100) / 100,\n threshold_used: threshold,\n timestamp: new Date().toISOString(),\n baseline_sample_size: baselineScores.length\n }\n }\n];"
},
"id": "1203e92f-5fd7-4f81-9c73-493cd9871a85",
"name": "Compare to Baseline",
"type": "n8n-nodes-base.code",
"typeVersion": 2,
"position": [
544,
416
]
},
{
"parameters": {
"conditions": {
"options": {
"caseSensitive": false,
"leftValue": "",
"typeValidation": "loose"
},
"conditions": [
{
"id": "id-1",
"leftValue": "={{ $json.is_anomaly }}",
"operator": {
"type": "boolean",
"operation": "true"
}
}
],
"combinator": "and"
},
"options": {}
},
"id": "9ba0ebc4-c2f9-46fc-b57a-16b8c330fa3f",
"name": "Anomaly Detected?",
"type": "n8n-nodes-base.if",
"typeVersion": 2.2,
"position": [
768,
416
]
},
{
"parameters": {
"url": "={{ $('Workflow Configuration').first().json.resourceApiUrl }}",
"sendQuery": true,
"queryParameters": {
"parameters": [
{
"name": "resource_id",
"value": "={{ $json.affected_resources }}"
}
]
},
"options": {}
},
"id": "064cf76c-3778-4707-9ab3-fa53be44d394",
"name": "Get Resource Context",
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
992,
224
]
},
{
"parameters": {
"url": "={{ $('Workflow Configuration').first().json.changesApiUrl }}",
"sendQuery": true,
"queryParameters": {
"parameters": [
{
"name": "timeRange",
"value": "last_24_hours"
}
]
},
"options": {}
},
"id": "eaa9b971-8200-4c46-b9ae-1b84f528ea54",
"name": "Get Recent Changes",
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
992,
416
]
},
{
"parameters": {
"url": "={{ $('Workflow Configuration').first().json.healthApiUrl }}",
"options": {}
},
"id": "732baa4a-9c65-41a8-83a3-782f85d5d614",
"name": "Check Service Health",
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4.2,
"position": [
992,
608
]
},
{
"parameters": {
"aggregate": "aggregateAllItemData",
"options": {}
},
"id": "712c7e37-ca01-48f8-8801-6c168efe614c",
"name": "Combine Investigation Data",
"type": "n8n-nodes-base.aggregate",
"typeVersion": 1,
"position": [
1216,
416
]
},
{
"parameters": {
"promptType": "define",
"text": "Generate a comprehensive investigation report based on the anomaly detection and gathered context. Include: 1) Executive Summary, 2) Anomaly Details (type, severity, score), 3) Affected Resources, 4) Recent Changes that may be related, 5) Service Health Status, 6) Root Cause Analysis, 7) Recommended Actions, 8) Timeline of Events. Format as a structured report.",
"options": {}
},
"id": "742d1eb5-1e39-4e2d-9235-c93398d82e21",
"name": "Generate Investigation Report",
"type": "@n8n/n8n-nodes-langchain.agent",
"typeVersion": 2.2,
"position": [
1440,
416
]
},
{
"parameters": {
"model": {
"__rl": true,
"mode": "list",
"value": "gpt-4.1-mini"
},
"options": {}
},
"id": "1b23adf4-5c86-4b2f-8b7a-84158cce22a6",
"name": "OpenAI Model - Report",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"typeVersion": 1.2,
"position": [
1520,
640
],
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
}
}
],
"connections": {
"Schedule Trigger": {
"main": [
[
{
"node": "Workflow Configuration",
"type": "main",
"index": 0
}
]
]
},
"Workflow Configuration": {
"main": [
[
{
"node": "Fetch Recent Logs",
"type": "main",
"index": 0
}
]
]
},
"Fetch Recent Logs": {
"main": [
[
{
"node": "Filter Relevant Logs with AI",
"type": "main",
"index": 0
}
]
]
},
"Filter Relevant Logs with AI": {
"main": [
[
{
"node": "Aggregate Log Patterns",
"type": "main",
"index": 0
}
]
]
},
"OpenAI Model - Filter": {
"ai_languageModel": [
[
{
"node": "Filter Relevant Logs with AI",
"type": "ai_languageModel",
"index": 0
}
]
]
},
"Aggregate Log Patterns": {
"main": [
[
{
"node": "Detect Errors and Unusual Access",
"type": "main",
"index": 0
}
]
]
},
"Detect Errors and Unusual Access": {
"main": [
[
{
"node": "Semantic Anomaly Analysis",
"type": "main",
"index": 0
}
]
]
},
"OpenAI Model - Detection": {
"ai_languageModel": [
[
{
"node": "Detect Errors and Unusual Access",
"type": "ai_languageModel",
"index": 0
}
]
]
},
"Semantic Anomaly Analysis": {
"main": [
[
{
"node": "Fetch Historical Baseline",
"type": "main",
"index": 0
}
]
]
},
"OpenAI Model - Semantic": {
"ai_languageModel": [
[
{
"node": "Semantic Anomaly Analysis",
"type": "ai_languageModel",
"index": 0
}
]
]
},
"Fetch Historical Baseline": {
"main": [
[
{
"node": "Compare to Baseline",
"type": "main",
"index": 0
}
]
]
},
"Compare to Baseline": {
"main": [
[
{
"node": "Anomaly Detected?",
"type": "main",
"index": 0
}
]
]
},
"Anomaly Detected?": {
"main": [
[
{
"node": "Get Resource Context",
"type": "main",
"index": 0
},
{
"node": "Get Recent Changes",
"type": "main",
"index": 0
},
{
"node": "Check Service Health",
"type": "main",
"index": 0
}
]
]
},
"Get Resource Context": {
"main": [
[
{
"node": "Combine Investigation Data",
"type": "main",
"index": 0
}
]
]
},
"Get Recent Changes": {
"main": [
[
{
"node": "Combine Investigation Data",
"type": "main",
"index": 0
}
]
]
},
"Check Service Health": {
"main": [
[
{
"node": "Combine Investigation Data",
"type": "main",
"index": 0
}
]
]
},
"Combine Investigation Data": {
"main": [
[
{
"node": "Generate Investigation Report",
"type": "main",
"index": 0
}
]
]
},
"OpenAI Model - Report": {
"ai_languageModel": [
[
{
"node": "Generate Investigation Report",
"type": "ai_languageModel",
"index": 0
}
]
]
}
}
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
openAiApi
Pro
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
Gist:Idirouhab. Uses httpRequest, agent, lmChatOpenAi. Scheduled trigger; 19 nodes.
Source: https://gist.github.com/idirouhab/45c450fb5f7ee864b8c7d294b05b7cb4 — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
Complete PostgreSQL-backed system: Keyword scoring → AI research → Multi-part content generation → fal.ai Nano Banana image generation → WordPress publishing
WordPress, OpenAI, Perplexity +8
auto_post_wordpress_. Uses rssFeedRead, lmChatOpenAi, textClassifier, agent. Scheduled trigger; 90 nodes.
RSS Feed Read, OpenAI Chat, Text Classifier +7
blog writing automation. Uses rssFeedRead, lmChatOpenAi, textClassifier, agent. Scheduled trigger; 90 nodes.
RSS Feed Read, OpenAI Chat, Text Classifier +8
We’ve released Version 4 of our AI Powered Blog Automation workflow. We heard your complains and made a complete redesign built for serious content creators.
RSS Feed Read, OpenAI Chat, Text Classifier +6
This n8n automation workflow automates the creation, scripting, production, and posting of YouTube videos. It leverages AI (OpenAI), image generation (PIAPI), video rendering (Shotstack), and platform
Agent, OpenAI Chat, Airtable Tool +7