n8n-nodes-ioc-detector

An n8n community node for extracting and classifying Indicators of Compromise (IOCs) from text data.

Features

• IP Address Detection: Extracts IPv4 addresses and classifies them as internal (RFC 1918) or external
• Domain Extraction: Extracts domains from URLs and standalone FQDNs
• Hash Detection: Identifies MD5, SHA1, SHA256, and SHA512 hashes
• Whitelist Support: Exclude specific IOCs from results
• Automatic Deduplication: Removes duplicate IOCs from results
• Error Handling: Returns empty arrays on parsing errors

Installation

Community Node (Recommended)

Install directly in n8n:

1. Go to Settings > Community Nodes
2. Click Install a community node
3. Enter n8n-nodes-ioc-detector
4. Click Install

Manual Installation

npm install n8n-nodes-ioc-detector

For local development:

# Clone the repository
git clone https://github.com/yourusername/n8n-nodes-ioc-detector.git
cd n8n-nodes-ioc-detector

# Install dependencies
npm install

# Build the node
npm run build

# Link to n8n (for local testing)
npm link
cd ~/.n8n/nodes
npm link n8n-nodes-ioc-detector

Usage

Basic Usage

1. Add the IOC Detector node to your workflow
2. Connect it to a node that provides text data
3. The node will automatically extract IOCs from the input data
4. Results are stored in json.iocs with the following structure:

{
  "iocs": {
    "ip_external": ["8.8.8.8", "1.1.1.1"],
    "domain": ["example.com", "malicious-site.net"],
    "hash": ["5d41402abc4b2a76b9719d911017c592", "aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d"],
    "ip_internal": ["192.168.1.100", "10.0.0.5"]
  }
}

With Whitelist

Use the Whitelist parameter to exclude known safe IOCs:

1. Add items to the whitelist (e.g., google.com, 192.168.1.1)
2. These IOCs will be excluded from the results
3. Matching is case-insensitive and exact

Example Input

{
  "message": "Connection from 192.168.1.100 to https://example.com detected. Hash: 5d41402abc4b2a76b9719d911017c592. External IP: 8.8.8.8"
}

Example Output

{
  "message": "Connection from 192.168.1.100 to https://example.com detected. Hash: 5d41402abc4b2a76b9719d911017c592. External IP: 8.8.8.8",
  "iocs": {
    "ip_external": ["8.8.8.8"],
    "domain": ["example.com"],
    "hash": ["5d41402abc4b2a76b9719d911017c592"],
    "ip_internal": ["192.168.1.100"]
  }
}

IOC Types Detected

IP Addresses (IPv4)

• Internal IPs (RFC 1918):
  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16
• External IPs: All other valid IPv4 addresses
• Excluded: Localhost/loopback (127.0.0.0/8)

Domains

• Extracted from URLs (http://, https://, ftp://)
• Standalone FQDNs (e.g., example.com, sub.domain.org)
• Normalized to lowercase

Hashes

• MD5: 32 hexadecimal characters
• SHA1: 40 hexadecimal characters
• SHA256: 64 hexadecimal characters
• SHA512: 128 hexadecimal characters
• Normalized to lowercase

Parameters

| Parameter | Type | Required | Description | |-----------|------|----------|-------------| | Whitelist | String (Multiple) | No | List of IOCs to exclude from results (exact match) |

Development

Build

npm run build

Development Mode (Watch)

npm run dev

Format Code

npm run format

Lint

npm run lint
npm run lintfix  # Auto-fix issues

Requirements

• n8n version: 0.200.0 or higher
• Node.js version: 16.x or higher

License

MIT

Support

For issues, questions, or contributions, please visit the GitHub repository.

Changelog

1.0.0

• Initial release
• IPv4 address detection and classification
• Domain extraction from URLs and FQDNs
• Hash detection (MD5, SHA1, SHA256, SHA512)
• Whitelist support
• Automatic deduplication