{
  "name": "Monitor VPS Security with GPT-4 Mini Analysis via SSH and Telegram Alerts",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "hoursInterval": 6
            }
          ]
        }
      },
      "id": "a6aa7451-42a1-4712-a57f-ddafd0f43f0f",
      "name": "Schedule Trigger - Every 6 Hours",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        512,
        608
      ],
      "typeVersion": 1.2
    },
    {
      "parameters": {
        "command": "ps aux --sort=-%cpu,-%mem && ss -tulpn > /vps_process_report.txt",
        "cwd": "/root"
      },
      "id": "65beee3f-6b67-4fc9-9edc-dcdd007372ed",
      "name": "SSH - Gather Process and Network Data",
      "type": "n8n-nodes-base.ssh",
      "position": [
        960,
        608
      ],
      "typeVersion": 1
    },
    {
      "parameters": {
        "promptType": "define",
        "text": "=You are a security analyst AI. I will provide you with a list of running processes and open network ports from a Linux VPS. Your task:\n\n1. Identify any processes, commands, or connections that appear suspicious, malicious, or unusual.\n2. Explain why you think they are suspicious (e.g., known malware patterns, unusual network connections, strange process names, or abnormal resource usage).\n3. Focus on: cryptocurrency miners, botnet activity, unauthorized network services, suspicious shell processes, or processes with unusual resource consumption.\n4. Provide structured output with malicious and suspicious findings separately.\n\nHere is the process and network information:\n\n {{ $json.stdout }}",
        "hasOutputParser": true,
        "batching": {}
      },
      "id": "ea71cc5e-f4a6-42a2-9d10-d81c37becb15",
      "name": "AI Security Analysis",
      "type": "@n8n/n8n-nodes-langchain.chainLlm",
      "position": [
        1136,
        608
      ],
      "typeVersion": 1.7
    },
    {
      "parameters": {
        "schemaType": "manual",
        "inputSchema": "{\n\t\"type\": \"object\",\n\t\"properties\": {\n\t\t\"malicious\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"List of confirmed malicious processes or activities\"\n\t\t},\n        \"malicious_explain\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"Detailed explanation of why these are considered malicious\"\n\t\t},\n\t\t\"suspicious\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"List of potentially suspicious but not confirmed malicious activities\"\n\t\t},\n        \"suspicious_explain\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"Explanation of suspicious findings that need investigation\"\n\t\t},\n\t\t\"status\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"Overall security status: clean, suspicious, or compromised\"\n\t\t}\n\t}\n}"
      },
      "id": "3412cc86-1495-4feb-95d5-ff1201736167",
      "name": "Parse Security Analysis Results",
      "type": "@n8n/n8n-nodes-langchain.outputParserStructured",
      "position": [
        1280,
        816
      ],
      "typeVersion": 1.3
    },
    {
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4o-mini",
          "cachedResultName": "gpt-4o-mini"
        },
        "options": {
          "temperature": 0.1
        }
      },
      "id": "39ba22a6-b234-4161-9072-be3c4c675717",
      "name": "OpenAI GPT-4 Mini Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        1120,
        800
      ],
      "typeVersion": 1.2
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "7a3a5d70-a8bc-4f03-b83e-20812b36c82e",
              "operator": {
                "type": "string",
                "operation": "notEmpty",
                "singleValue": true
              },
              "leftValue": "={{ $json.output.malicious }}",
              "rightValue": ""
            }
          ]
        },
        "options": {}
      },
      "id": "e40d0871-01db-44a7-bceb-c8d9e05430ed",
      "name": "Check for Malicious Activity",
      "type": "n8n-nodes-base.if",
      "position": [
        1472,
        608
      ],
      "typeVersion": 2.2
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "suspicious-check",
              "operator": {
                "type": "string",
                "operation": "notEmpty",
                "singleValue": true
              },
              "leftValue": "={{ $json.output.suspicious }}",
              "rightValue": ""
            }
          ]
        },
        "options": {}
      },
      "id": "b9fbd410-32d2-466b-ba7d-6b3ec21f8eb2",
      "name": "Check for Suspicious Activity",
      "type": "n8n-nodes-base.if",
      "position": [
        1472,
        816
      ],
      "typeVersion": 2.2
    },
    {
      "parameters": {
        "chatId": "={{ $('Configuration - User Settings').first().json.admin_telegram_id }}",
        "text": "=🚨 **SECURITY ALERT - MALICIOUS ACTIVITY DETECTED** 🚨\n\n**Server:** {{ $('Configuration - User Settings').first().json.server_name }}\n**Time:** {{ new Date().toLocaleString() }}\n\n**⚠️ Malicious Processes:**\n{{ $json.output.malicious }}\n\n**📋 Analysis:**\n{{ $json.output.malicious_explain }}\n\n**🔍 Overall Status:** {{ $json.output.status }}\n\n**Action Required:** Immediate investigation recommended!",
        "additionalFields": {
          "parse_mode": "Markdown"
        }
      },
      "id": "6a3eb62f-69cd-439c-8ed8-6d4ef84e2c5d",
      "name": "Send Malicious Activity Alert",
      "type": "n8n-nodes-base.telegram",
      "position": [
        1696,
        528
      ],
      "webhookId": "063b1b68-d772-4447-a9fb-61c84f4ab611",
      "typeVersion": 1.2
    },
    {
      "parameters": {
        "chatId": "={{ $('Configuration - User Settings').first().json.admin_telegram_id }}",
        "text": "=⚠️ **Security Notice - Suspicious Activity** ⚠️\n\n**Server:** {{ $('Configuration - User Settings').first().json.server_name }}\n**Time:** {{ new Date().toLocaleString() }}\n\n**🔍 Suspicious Processes:**\n{{ $json.output.suspicious }}\n\n**📋 Analysis:**\n{{ $json.output.suspicious_explain }}\n\n**Status:** {{ $json.output.status }}\n\n**Recommendation:** Monitor closely and investigate if needed.",
        "additionalFields": {
          "parse_mode": "Markdown"
        }
      },
      "id": "7b6333d6-8bf4-4603-b134-12a52017a1a6",
      "name": "Send Suspicious Activity Notice",
      "type": "n8n-nodes-base.telegram",
      "position": [
        1696,
        816
      ],
      "webhookId": "suspicious-alert-webhook",
      "typeVersion": 1.2
    },
    {
      "parameters": {
        "assignments": {
          "assignments": [
            {
              "id": "f30b7286-9424-4150-960c-925578bf143a",
              "name": "admin_telegram_id",
              "type": "string",
              "value": "YOUR_TELEGRAM_CHAT_ID"
            },
            {
              "id": "server-name-field",
              "name": "server_name",
              "type": "string",
              "value": "Production VPS"
            },
            {
              "id": "alert-level-field",
              "name": "alert_level",
              "type": "string",
              "value": "high"
            }
          ]
        },
        "options": {}
      },
      "id": "aa37b490-ba35-4b1b-b9fe-3730616564f4",
      "name": "Configuration - User Settings",
      "type": "n8n-nodes-base.set",
      "position": [
        720,
        608
      ],
      "typeVersion": 3.4
    },
    {
      "parameters": {
        "content": "## 🔐 VPS Security Monitor with AI Analysis\n\nThis workflow automatically monitors your VPS for security threats using AI analysis and sends alerts via Telegram.\n\n### 📋 How it works:\n1. **Scheduled Monitoring**: Runs every 6 hours (customizable)\n2. **SSH Data Collection**: Gathers process and network information\n3. **AI Security Analysis**: Uses OpenAI GPT-4 Mini to identify threats\n4. **Smart Alerting**: Only sends notifications for actual threats\n\n### ⚙️ Configuration Required:\n- Update SSH credentials in \"SSH - Gather Process and Network Data\" node\n- Add OpenAI API key in \"OpenAI GPT-4 Mini Model\" node  \n- Set your Telegram chat ID in \"Configuration - User Settings\"\n- Add Telegram bot token in alert nodes\n\n### 🎯 Features:\n- Detects malware, cryptocurrency miners, botnet activity\n- Monitors unusual network connections and resource usage\n- Structured AI analysis with clear explanations\n- Separate alerts for malicious vs suspicious activity\n\n### 💡 Customization:\n- Adjust monitoring frequency in Schedule Trigger\n- Modify AI prompt for specific security concerns\n- Add multiple servers by duplicating SSH nodes\n- Extend with email/Slack notifications",
        "height": 844,
        "width": 420
      },
      "id": "5606b628-d253-4fa7-aa7c-f8f9941dbce3",
      "name": "Sticky Note - Main Explanation",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        0,
        0
      ],
      "typeVersion": 1
    },
    {
      "parameters": {
        "content": "### Step 1: Data Collection\n\nSSH into VPS and gather:\n- Running processes (sorted by CPU/memory)\n- Active network connections\n- System information",
        "height": 184
      },
      "id": "88cd5703-b482-4366-99fa-def022f90150",
      "name": "Sticky Note - Step 1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        880,
        400
      ],
      "typeVersion": 1
    },
    {
      "parameters": {
        "content": "### Step 2: AI Analysis\n\nOpenAI analyzes data for:\n- Known malware patterns\n- Suspicious network activity\n- Unusual resource usage\n- Botnet indicators",
        "height": 184
      },
      "id": "8a1737bb-bb57-4e03-9cae-b82854ce4832",
      "name": "Sticky Note - Step 2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1120,
        400
      ],
      "typeVersion": 1
    },
    {
      "parameters": {
        "content": "### Step 3: Smart Alerting\n\nSeparate alerts for:\n- 🚨 Malicious: Confirmed threats\n- ⚠️ Suspicious: Needs investigation\n\nNo spam - only real threats!",
        "height": 216
      },
      "id": "3d04541f-555a-421b-aa8b-63f99cdc9f46",
      "name": "Sticky Note - Step 3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1632,
        304
      ],
      "typeVersion": 1
    }
  ],
  "pinData": {},
  "connections": {
    "Schedule Trigger - Every 6 Hours": {
      "main": [
        [
          {
            "node": "Configuration - User Settings",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "SSH - Gather Process and Network Data": {
      "main": [
        [
          {
            "node": "AI Security Analysis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "AI Security Analysis": {
      "main": [
        [
          {
            "node": "Check for Malicious Activity",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check for Suspicious Activity",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Parse Security Analysis Results": {
      "ai_outputParser": [
        [
          {
            "node": "AI Security Analysis",
            "type": "ai_outputParser",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI GPT-4 Mini Model": {
      "ai_languageModel": [
        [
          {
            "node": "AI Security Analysis",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Check for Malicious Activity": {
      "main": [
        [
          {
            "node": "Send Malicious Activity Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check for Suspicious Activity": {
      "main": [
        [
          {
            "node": "Send Suspicious Activity Notice",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Configuration - User Settings": {
      "main": [
        [
          {
            "node": "SSH - Gather Process and Network Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "active": false,
  "settings": {
    "executionOrder": "v1",
    "availableInMCP": false
  },
  "versionId": "eda59ec0-8569-41a4-b33d-111ba27085de",
  "meta": {
    "instanceId": "5ff5a5992c4c72af22abbdcfa574d8cdf93dc14d57eb9f66e3d9ef2a3e2dbb6c"
  },
  "id": "LujKULmeTZ6WQ1O2",
  "tags": []
}