Skip to content

Threat intelligence API / integrations

n8n

A community node for n8n that puts ThreatCluster in your workflows: incident clusters, CVEs with exploitation signals, validated indicators, entity profiles and ransomware leak-site activity, plus a polling trigger that fires on new incidents, new leak-site victims and newly exploited CVEs. Works on n8n Cloud and self-hosted.

Packagenpm: n8n-nodes-threatclusterSource on GitHubMIT

Prerequisites

  1. A ThreatCluster API key. Every plan, including Free, has one: sign in, open Settings → API & Feeds and select Generate API Key. Free keys get 100 credits a day and read the last seven days.
  2. n8n Cloud, or a self-hosted n8n where community nodes are enabled (they are by default; the owner account installs them under Settings → Community Nodes).

Setup

  1. Install the node. In the n8n UI: Settings → Community Nodes → Install, enter n8n-nodes-threatcluster and confirm. Self-hosted without the UI: 
    cd ~/.n8n/nodes
npm install n8n-nodes-threatcluster
    Restart n8n after a manual install.
  2. Add the credential. Credentials → New → ThreatCluster API, paste the key, select Test. The test calls GET /me, which costs zero credits, so testing never spends your budget.
  3. Drop a ThreatCluster node or a ThreatCluster Trigger into a workflow and pick the credential.

The action node

Seven resources, fifteen operations. List responses come back as one item per row, which is what the nodes downstream expect, and every item carries a _meta object with what the call cost and how many credits remain today.

  1. Threat Incident: Get Many, Get, Get IOCs, Get STIX, Search.
  2. Vulnerability: Get Many with KEV, public-exploit and severity filters, Get.
  3. Dark Web: Get Victims, Get Groups.
  4. Entity: Search, Get.
  5. IOC: Get Feed.
  6. Ask AI: Ask the Corpus, Ask About an Incident. Paid plans only.
  7. Account: Get Credits. Free to call.

A first workflow

Three nodes: a manual trigger, a ThreatCluster node set to Vulnerability → Get Many with KEV Only on, and a Filter that keeps rows where has_exploit is true.

An n8n workflow with three nodes after a run: a manual trigger, the ThreatCluster node passing 24 items, and a filter keeping 10
Run on 29 September 2026 in n8n 2.41.3 with version 0.1.2 of the node. 24 CVEs in CISA KEV came back and 10 of them have a public exploit.

Open the node to see its settings beside the rows it returned:

The ThreatCluster node open in n8n, showing the credential, Vulnerability and Get Many selected, KEV Only switched on, and an output table of 24 items starting with a Citrix NetScaler CVE
Each row is one item, so the Filter, Slack or Jira node after it needs no splitting step.

Five workflows, run end to end

Each workflow was built and run on 29 September 2026 in n8n 2.41.3 against the live API; the demo posts to a local stand-in, so point the last node at your own tool.

Exploited CVE triage to a ticket 5 nodes, 1 credit a run

Every morning the ThreatCluster node lists CVEs that are in CISA KEV and have a public exploit. A Filter keeps the criticals, an Edit Fields node writes a ticket for each, and the last node creates it.

The workflow after a run: a schedule trigger, the ThreatCluster node returning 10 items, a filter keeping 8, a ticket-building node and a final request node
10 CVEs came back, 8 were critical, 8 tickets went out.
The ThreatCluster node with Vulnerability and Get Many selected and both KEV Only and Has Public Exploit switched on, beside its output table
KEV Only and Has Public Exploit are both on, so the API does the first cut.
The Edit Fields node mapping the CVE id, score and description into summary, description and priority fields, with the resulting tickets on the right
The ticket text is built from the item fields. The link at the end of each description goes to the CVE's ThreatCluster page.

Import it: cve-triage.json

Morning threat briefing 5 nodes, 1 credit a run

On weekdays at 07:30 the node fetches the incidents trending over the last 24 hours. A Limit node keeps the top 5 and a Code node turns them into one message.

The workflow after a run: a schedule trigger, the ThreatCluster node returning 50 items, a limit node keeping 5, a code node producing 1 item and a final request node
50 incidents in, 5 kept, 1 message out.
The ThreatCluster node with Threat Incident and Get Many selected, the time filter on the last 24 hours and sorting by trending
Threat Incident, Get Many, last 24 hours, sorted by trending.
The Code node with a few lines of JavaScript and, on the right, the briefing text listing five incidents with scores, article counts and links
A few lines of JavaScript. Each line of the briefing carries the threat score, the number of articles behind the incident and its link.

Import it: morning-briefing.json

Enrich a SIEM alert 4 nodes, 1 credit a call

The SIEM posts an alert that names a CVE. The workflow looks the CVE up, works out a priority and replies in the same request, so the SIEM can write the verdict straight onto the alert.

The workflow after a run: a webhook node, the ThreatCluster node, a verdict node and a respond-to-webhook node, each passing 1 item
One alert in, one reply out.
The Edit Fields node building cve, severity, exploited in the wild, public exploit, priority and reference fields from the lookup
The priority rule is one expression: P1 if the CVE is in KEV, P2 if its EPSS score is 0.1 or more, otherwise P3.
A terminal posting a test alert for CVE-2026-87902 to the webhook and receiving a JSON reply with severity HIGH 8.1, in CISA KEV since 25 September 2026, a public exploit and priority P1
What the SIEM gets back, formatted with jq. This is the call n8n's test URL received during the run above.

Import it: alert-enrichment.json

Malware hash watchlist for EDR 5 nodes, 3 credits a run

Every 4 hours the node pulls the hashes added to the indicator feed in the last day. A Filter keeps SHA-256, a Code node joins them one per line and the last node sends the list on.

The workflow after a run: a schedule trigger, the ThreatCluster node returning 6 items, a filter keeping 3, a code node producing 1 item and a final request node
6 hashes in the feed that day, 3 of them SHA-256.
The ThreatCluster node with IOC and Get Feed selected, the type set to Hashes and the window to 24 hours, beside a table of MD5 and SHA-256 values
Each row carries the type, the value, a confidence level and the reason it was flagged.
The Code node with one line of JavaScript and an output holding a count of 3 and the three hashes as one list
One line of JavaScript makes the list. The count travels with it so the receiving end can check nothing was dropped.

Import it: hash-watchlist.json

Alert on each new exploited CVE 3 nodes, 1 credit a poll

The trigger node polls every 30 minutes and emits one item for each CVE that entered KEV or gained a public exploit since the last poll. Use this pattern when you want a message per event instead of a daily batch.

The workflow after a test run: the ThreatCluster trigger node, a node writing the alert text and a final request node, each passing 1 item
A test run emits a single sample so the workflow is not flooded with history.
The ThreatCluster Trigger node with a 30 minute poll time and the New Exploited CVE event selected, beside the CVE it fetched as a test event
Fetch Test Event pulled a critical Apache Roller CVE, rated 9.8.
The Edit Fields node building a two-line alert from the CVE id, severity and score, with the finished text on the right
The alert is two lines: what it is, and where to read about it.

Import it: trigger-alert.json

The trigger

Three events: New Threat Incident, New Leak-Site Victim and New Exploited CVE, each with the filters the matching endpoint accepts, for example a sector on victims or a severity on CVEs.

Deduplication is handled for you: the trigger polls with since, keeps a set of seen ids, primes itself on the first run instead of flooding the workflow, and treats a 429 as "try again next interval".

Worked example: ransomware watch for your sector

  1. ThreatCluster Trigger, event New Leak-Site Victim, sector Healthcare, poll every 30 minutes.
  2. Slack node, message from the item fields. A listing arrives with the group, the victim name, the country, the sector and the date it was posted: 
    New leak-site listing: {{ $json.name }}
Group: {{ $json.group }}  ·  Sector: {{ $json.sector }}  ·  {{ $json.country }}
Posted {{ $json.discovered_at }}
{{ $json.url }}

Keep the wording "listing" or "claim". A group naming an organisation means the group says it attacked them; it is not a confirmed breach.

What it costs

Most calls cost 1 credit; Search costs 5; STIX and the IOC feed cost 3; Ask AI costs 25 to 50 and needs a paid plan. Get Credits is free. A free key has 100 credits a day, which covers a trigger polling every 30 minutes plus a handful of lookups. The node turns the three errors you will actually meet into plain English: 401 the key was rejected, 403 your plan does not allow it, 429 the daily budget is spent and refills at 00:00 UTC.

The same flows in Tines

Every workflow above translates to Tines with HTTP Request, Event Transform and Trigger actions — nothing paid is needed. Point an HTTP Request action at the same endpoints (for example /api/public/v1/darkweb/ransomware/victims with your key in X-API-Key), schedule it so the window matches the cadence (a daily run asks for one day of data), and send the result to Slack, a ticket or your SIEM. The curl guide has every endpoint, header and status code you need to build the actions.

Prefer a plain HTTP Request node? The curl guide has every endpoint and header, and a ready-made "IOC feed to Slack" workflow template is in the repository.