This workflow shows you how to post a message to a Slack channel and add a file attachment. It also shows you the general pattern for working with Binary data in n8n (any file like a PDF, Image etc). Specifically, this workflow shows how to download a file from a URL into your workflow, and then upload it to Slack.
Tags
Related workflows
See all Slack→Manage Slack channel and users automatically
Explore this workflow on its official n8n template page.
Monitor Domains & IPs on AbuseIPDB Blacklist with Slack Alerts
⚙ How It Works The automated blacklist monitor is designed to be a proactive, not reactive, tool. Here is the high-level process: Scheduled Checks: At regular intervals (e.g., every 30 minutes or every hour), a monitoring script or service sends a request to a list of predefined DNS blacklists (DNSBLs) and real-time blackhole lists (RBLs). Lookup Queries: For each check, the system performs a lookup query for our specified domains and IP addresses against the various blacklists. It essentially asks, "Is our-ip-address.com on your list?" Status Evaluation: The blacklist service responds with a status: either the asset is clean or it is listed. Alerting Mechanism: If a new listing is detected, the system immediately triggers a notification. This alert contains key information like the asset that was blacklisted (domain or IP), the specific blacklist it was found on (e.g., Spamhaus), and the time of detection. Status Logging: The status of each asset (clean or listed) is logged in a central dashboard. This allows us to track the history of an IP or domain, see when a listing occurred, and when it was resolved. Setup Steps Follow these steps to set up the automated blacklist monitor. S
Monitor Email Data Breaches with HIBP API and Send Slack Alerts
How It Works: The 5-Node Security Flow This workflow efficiently performs a scheduled data breach scan. 1. Scheduled Check (Cron Node) This is the workflow's trigger. It schedules the workflow to run at a specific, regular interval. Function:** Continuously runs on a set schedule, for example, every Monday morning. Process:* The *Cron** node automatically initiates the workflow, ensuring routine data breach scans are performed without manual intervention. 2. List Emails to Check (Code Node) This node acts as your static database, defining which email addresses to monitor for breaches. Function:** Stores a list of email addresses from your team or customers in a single, easy-to-update array. Process:** It configures the list of emails that are then processed by the subsequent nodes. This makes it simple to add or remove addresses as needed. 3. Query HIBP API (HTTP Request Node) This node connects to the HaveIBeenPwned (HIBP) API to check for breaches. Function:** Queries the HIBP API for each email address on your list. Process:** It sends a request to the HIBP API. The API responds with a list of data breaches that the email was found in, if any. 4. Is Breached? (If Node) This is t