Integration

n8n Community Node

IOC lookup inside an existing workflow

Drop a Check indicator node on the canvas, attach your isMalicious API credential, and enrich the item. This is a catalog node, not a dashboard destination.

Get API KeyNode source
Capabilities

Key Features

Everything you need to protect your infrastructure and users

Check IOC

IP, domain, or URL → malicious flag, score, categories, sources.

No extra deps

Uses n8n helpers.httpRequest so the package can be verified.

Same /check API

The lookup paying customers already run from scripts and Cortex.

Self-hosted install

Community nodes panel, or npm install n8n-nodes-ismalicious.

Applications

Use Cases

How security teams use this tool

Alert enrichment

Take an IP from a webhook or SIEM poll and attach an isMalicious report before Slack/email.

Allow/deny gates

Branch the workflow on malicious=true without a custom HTTP node.

Support

Frequently Asked Questions

Where is the node published?

The source lives at packages/n8n-nodes-ismalicious. Publish as n8n-nodes-ismalicious on npm, then submit the package in the n8n Creator Portal for verification.

What does the node do?

One operation: Check indicator. It calls GET /check with X-API-KEY and returns the JSON report. No webhook trigger in v0.1.0.

Does it add n8n dependencies?

No runtime dependencies. Verified community nodes cannot ship extra packages; the node uses n8n helpers.httpRequest.
Explore

Related Tools

Webhooks

Push events into n8n

Cortex / TheHive

Official analyzer

API docs

REST reference

Get Started

Ready to Get Started?

Join thousands of security teams using isMalicious to protect their infrastructure.

Get StartedContact Sales