Score DNS threats with VirusTotal, Abuse.ch, HashiCorp Vault, Gemini and Pi-hole
Knowledge & search workflow for n8n with 42 active steps. Starts with Schedule Trigger. Uses Google Gemini. Integrations include PostgreSQL, Google Gemini, SMTP email.
What it does
42 active nodes · Starts with Schedule Trigger.
Steps in the template include:
- Schedule Trigger (Schedule Trigger)
- Postgres Pass (hashi Corp Vault)
- Load AI configuration (Postgres) — executeQuery
- Select pending observable (Postgres) — executeQuery
Nodes and integrations
- Schedule Trigger
- hashi Corp Vault ×6
- Postgres ×7
- HTTP Request ×6
- Code ×8
- If ×5
- AI Agent
- Google Gemini Chat Model
- Postgres PGVector Store ×2
- Embeddings Google Gemini ×2
- Structured Output Parser
- Default Data Loader
- Send Email
See the author’s step names
- Schedule Trigger (Schedule Trigger)
- Postgres Pass (hashi Corp Vault)
- Load AI configuration (Postgres) — executeQuery
- Select pending observable (Postgres) — executeQuery
- Virus total API TOKEN (hashi Corp Vault)
- VirusTotal IP Scan (HTTP Request)
- Data reduction - VirusTotal (Code)
- VirusTotal detections ≥ threshold? (If)
- Abuse API TOKEN (hashi Corp Vault)
- Abuse.CH_ThreatFox request (HTTP Request)
- Abuse.CH_URLHaus request (HTTP Request)
- Data reduction - abuse.ch (Code)
- Supporting sources not checked (Code)
- Compute rule-based score (Postgres) — executeQuery
- AI analysis required? (If)
- Gemini AI Studio (hashi Corp Vault)
- Build AI prompt (Code)
- AI Agent (AI Agent)
- Google Gemini Chat Model (Google Gemini Chat Model)
- Postgres PGVector Store (Postgres PGVector Store)
- Embeddings Google Gemini (Embeddings Google Gemini)
- Structured Output Parser (Structured Output Parser)
- Parse AI Agent output (Code)
- Build clean scan verdict (Code)
- Insert raw payloads (Postgres) — executeQuery
- Insert AI verdict (Postgres) — executeQuery
- Insert AI audit (Postgres) — executeQuery
- AI verdict to remember? (If)
- Store verdict in vector memory (Postgres PGVector Store)
- Default Data Loader (Default Data Loader)
- Embeddings Google Gemini (store) (Embeddings Google Gemini)
- Send alert? (If)
- Get Email Pass (hashi Corp Vault)
- Build alert e-mail (Code)
- Send an Email (Send Email)
- Block in Pi-hole? (If)
- Pi-hole API password (hashi Corp Vault)
- Pi-hole login (HTTP Request)
- Pi-hole add to denylist (HTTP Request)
- Pi-hole logout (HTTP Request)
- Evaluate Pi-hole result (Code)
- Log Pi-hole block (Postgres) — executeQuery
Community node packages
- n8n-nodes-hashi-vault
Community nodes run third-party code and can access workflow data and the n8n host. Review the packages before running this template. Community node risks
Accounts and credentials
- PostgreSQL
- Google Gemini access
- SMTP email
Credential types in the graph: hashiCorpVaultApi, postgres, googlePalmApi, smtp
Check the HTTP request steps for any additional service accounts or API keys.
AI models and swaps
Google Gemini · Chat
models/gemini-3.1-flash-lite in Google Gemini Chat Model. Potentially swappable with a compatible n8n chat model node. Match tool calling and structured output before testing.
Google Gemini · Embeddings
Model ID not specified in the template in Embeddings Google Gemini. Changing the embedding model may require rebuilding the vector index and matching its dimensions.
Google Gemini · Embeddings
Model ID not specified in the template in Embeddings Google Gemini (store). Changing the embedding model may require rebuilding the vector index and matching its dimensions.
Inputs and setup options
- Google Gemini Chat Model: temperature 0.2
Resource information
- Credit basis
- Author listed by n8n
- Pricing
- Template access shown on n8n
- License
- Not specified
- Last record update
- Nov 5, 2026