NordStellar for n8n

n8n (opens in a new tab) is a workflow automation platform that connects applications and services into automated pipelines. The NordStellar community node brings your threat exposure data into those pipelines, so you can route findings to the tools your team already uses and act on them automatically.

Where a SIEM integration pushes findings from NordStellar into a single destination, the n8n node works the other way around: your workflow pulls data from the Platform Integrations API whenever you need it, then decides what to do with it. That makes it a good fit for automation and enrichment logic that sits between NordStellar and the rest of your stack.

What You Can Do

The node exposes the Platform Integrations API as workflow building blocks:

• List projects — retrieve the projects available to your organization.
• List events — pull security events for a project, filtered by date range, with automatic pagination.
• Get event details — retrieve the full record for a single event by its type and ID.
• Resolve events — mark an event as resolved, or reopen it, from within a workflow.

Because n8n handles scheduling, branching, and delivery, you can combine these operations with hundreds of other integrations. Typical uses include:

1. Alert routing — poll for new findings on a schedule and post them to Slack, Microsoft Teams, or email, with your own formatting and severity rules.
2. Ticket creation — open a Jira, ServiceNow, or Linear issue for each new finding, and resolve the NordStellar event when the ticket closes.
3. Enrichment and correlation — cross-reference NordStellar findings against your CMDB, identity provider, or internal asset inventory before deciding whether to escalate.
4. Custom SIEM forwarding — forward findings to a SIEM that does not have a native NordStellar connector, without writing or hosting your own script.
5. AI-assisted triage — attach the node to an n8n AI Agent so an assistant can query NordStellar data as a tool while investigating.

How It Works

The node is published to npm as n8n-nodes-nordstellar and installs through n8n's community nodes mechanism. Once installed, a NordStellar node appears in the node panel alongside your other integrations.

At a high level:

1. Install the n8n-nodes-nordstellar community node in your n8n instance.
2. Generate a Platform Integrations API access token in NordStellar.
3. Create a NordStellar Integration API credential in n8n using that token.
4. Add NordStellar nodes to your workflows and choose a resource and operation.

Every request is sent over HTTPS to your Platform Integrations API base URL with the access token as a bearer token. The credential rejects any request to a host outside nordstellar.com and its subdomains, so a misconfigured or tampered workflow cannot leak your token to a third-party endpoint.

Requirements

• An n8n instance that permits community node installation. Self-hosted n8n supports this out of the box; on n8n Cloud, community nodes must be available through the in-app catalog.
• A Platform Integrations API access token. See Platform Integrations API for how to generate one.
• Permission in NordStellar to create API keys, and access to the projects whose events you want to work with.

Next Steps