Example n8n Workflows

Schedule Trigger

Set the interval to run every hour. The interval you choose here determines the lookback window in the next node.

NordStellar — Event: Get Many

• Resource: Event

• Operation: Get Many

• Project ID: your project GUID

• Return All: on

• Filters → Date Added From:

  {{ $now.minus({ hours: 1 }).toISO() }}

Leave Date Added To empty so the query runs up to the present moment. Because the lookback matches the schedule interval, each event is picked up exactly once.

If — filter by severity

Branch on the event's risk level so routine findings don't page anyone:

{{ $json.risk_level }}

Route only HIGH and CRITICAL values down the alerting branch. You can send the remainder to a digest or drop them.

Slack — Send Message

Compose the message from the event fields:

New NordStellar finding: {{ $json.type }}
Risk: {{ $json.risk_level }}
Detected: {{ $json.date_added }}
Event ID: {{ $json.id }}

NordStellar — Event: Get Many

Configure as in Example 1 to produce a stream of event summaries.

Loop Over Items

Add a Loop Over Items node so each summary is processed individually and one failure doesn't stop the batch.

NordStellar — Event: Get

• Resource: Event

• Operation: Get

• Event Type: set from the summary using an expression:

  {{ $json.type }}

• Event ID:

  {{ $json.id }}

The type value on a summary record already matches the API values the Get operation expects, so it can be passed straight through.

Part one — open a ticket for each finding

• Schedule Trigger — run on your preferred interval.

• NordStellar — Event: Get Many — pull recent events, as in Example 1.

• Jira — Create Issue — build the summary and description from the event fields. Include the NordStellar event ID in the description or a custom field so you can find it again:

  NordStellar event ID: {{ $json.id }}

Part two — resolve the event when the ticket closes

• Jira Trigger — listen for the issue closed event.
• Code or Set — extract the NordStellar event ID from the issue description or custom field.
• NordStellar — Event: Resolve
  • Event ID: the extracted GUID
  • Resolved: on

Schedule Trigger

Run every 15 minutes, or whatever ingestion latency your SOC accepts.

NordStellar — Event: Get Many

• Return All: on

• Filters → Date Added From:

  {{ $now.minus({ minutes: 15 }).toISO() }}

Set — shape the payload

Map the NordStellar fields onto whatever schema your SIEM expects, adding any static fields such as a source name or index.

HTTP Request — send to your SIEM

Point the request at your SIEM's ingestion endpoint — for example a Splunk HTTP Event Collector or an Elastic data stream — using the authentication that platform requires.

Add an AI Agent node

Configure it with the chat model of your choice.

Attach NordStellar nodes as tools

Connect one or more NordStellar nodes to the agent's Tool input. A useful starting set is:

• Project → Get Many — so the agent can discover available projects.
• Event → Get Many — so it can list recent findings.
• Event → Get — so it can pull detail on anything interesting.

Leave the parameters the agent should control — such as Project ID or Event ID — set to be filled by the model.

Consider withholding Resolve

Attaching Event → Resolve lets the agent change state in NordStellar. Leave it out unless you specifically want that, and put a human approval step in front of it if you do.