n8n (Workflow Automation)
n8n is a self-hosted workflow automation tool — connect any API, trigger on events, transform data, and build integrations visually or with code.
Aithroyz deploys n8n with an admin account pre-created. Demo workflows are seeded on first startup showing integrations with Elastic and TheHive.
Access
URL:
https://n8n.<env-name>.ops.aithroyz.comCredentials: Shown in Environments detail → Credentials panel.
Building a workflow
Workflows are chains of nodes. Each node either triggers on an event or performs an action.
1. Add a trigger node
Click the canvas → search for a trigger (Schedule, Webhook, Wazuh, etc.) and add it.
2. Add action nodes
Click the + handle on the trigger → search for HTTP Request, Elasticsearch, TheHive, or any other action.
3. Connect nodes
Drag the output handle of one node to the input of the next. Conditional branching uses the IF node.
4. Test step by step
Click any node and press Test Step to run it with live data and inspect the output JSON.
5. Activate the workflow
Toggle the Activate switch in the top-right corner to make the workflow run automatically.
Webhook trigger
Use the Webhook node to receive data from external systems on demand.
1. Add Webhook node
Add a Webhook trigger node — it generates a unique path automatically.
2. Copy Test URL
In the node panel, copy the Test URL. This only listens while the editor is open.
3. Listen and fire
Click Listen For Test Event, then POST to the test URL from your tool or terminal.
4. Switch to Production URL
Activate the workflow. The Production URL is always listening even when the editor is closed.
curl -X POST https://n8n.<env-name>.ops.aithroyz.com/webhook-test/your-path \
-H "Content-Type: application/json" \
-d '{"alert": "test", "severity": "high"}'Code node example
The Code node runs JavaScript inside the workflow. Use $input.all() to access all items from the previous node.
// Code node — enrich each alert item
const items = $input.all();
return items.map(item => {
const data = item.json;
return {
json: {
...data,
severity_label: data.severity >= 8 ? "critical" : data.severity >= 5 ? "high" : "low",
processed_at: new Date().toISOString(),
}
};
});✓
Only the
crypto module is available in the Code node sandbox. fetch, https, and url are not available — use an HTTP Request node instead.Common integrations in Aithroyz
HTTP Request → Elasticsearch
Query or index documents by calling https://elastic.<env-name>.ops.aithroyz.com with Basic auth.
TheHive case creation
Use an HTTP Request node to POST to https://thehive.<env-name>.ops.aithroyz.com/api/v1/case with a Bearer token.
Slack / Mattermost notify
Add the Mattermost or Slack node, point it at the incoming webhook URL, and post alert messages to a channel.
Tips
✓
Use sub-workflows (Execute Workflow node) to keep complex logic modular and reusable across multiple parent workflows.
ℹ
Configure an error workflow under Settings → General → Error Workflow. n8n will route any execution failure to that workflow for alerting or retry logic.
✓
Export workflows as JSON (three-dot menu → Download) and commit them to Gitea for version control and disaster recovery.