利用n8n构造安全自动化流程SOAR联动cloudflare自动封禁IP

// 获取当前时间和6小时前的UTC时间const now = new Date();const sixHoursAgo = new Date(now.getTime() - 6 * 60 * 60 * 1000); // 当前时间减去6小时//const sixHoursAgo = new Date(now.getTime() - 12 * 60 * 60 * 1000); // 当前时间减去6小时// 格式化函数const formatUTCTime = (date) => {  const year = date.getUTCFullYear();  const month = String(date.getUTCMonth() + 1).padStart(2, '0');  const day = String(date.getUTCDate()).padStart(2, '0');  const hours = String(date.getUTCHours()).padStart(2, '0');  const minutes = String(date.getUTCMinutes()).padStart(2, '0');  const seconds = String(date.getUTCSeconds()).padStart(2, '0');  return `${year}-${month}-${day}T${hours}:${minutes}:${seconds}Z`;};// 生成时间范围const datetime_leq = formatUTCTime(now);     // 当前时间（作为结束时间）const datetime_geq = formatUTCTime(sixHoursAgo); // 6小时前（作为开始时间）// 遍历所有条目并添加字段for (const item of $input.all()) {  item.json.datetime_geq = datetime_geq;  item.json.datetime_leq = datetime_leq;}return $input.all();

https://api.cloudflare.com/client/v4/graphql

{"operationName":"GetSecuritySampledLogs","variables":{"zoneTag":"xxxx9e4c7b4d06780fa34c744956xxxx","accountTag":"xxxx516d1d6a7456546b8ce85368xxxx","filter":{"AND":[{"datetime_geq":"2025-03-16T14:14:38Z","datetime_leq":"2025-03-17T02:14:38Z","requestSource":"eyeball"},{"wafAttackScoreClass":"attack"}]}},"query":"query GetSecuritySampledLogs {n  viewer {n    scope: zones(filter: {zoneTag: $zoneTag}) {n      logs: httpRequestsAdaptive(filter: $filter, limit: 100, orderBy: ["datetime_DESC"]) {n        leakedCredentialCheckResultn        cacheStatusn        clientASNDescriptionn        clientAsnn        clientCountryNamen        clientIPn        clientRequestHTTPHostn        clientRequestHTTPMethodNamen        clientRequestHTTPProtocoln        clientRequestPathn        clientRequestSchemen        userAgentn        securityActionn        securitySourcen        datetimen        rayNamen        clientRequestReferern        clientRequestQueryn        contentScanNumMaliciousObjn        contentScanNumObjn        edgeResponseContentTypeNamen        edgeResponseStatusn        xRequestedWithn        originResponseStatusn        wafAttackScoreClassn        __typenamen      }n      __typenamen    }n    __typenamen  }n}n"}

// 提取所有 clientIPconst logs = $input.all()[0].json.data.viewer.scope[0].logs;const ipCounts = {};// 统计 IP 出现次数logs.forEach(log => {  const ip = log.clientIP;  ipCounts[ip] = (ipCounts[ip] || 0) + 1;});// 过滤次数 >10 的 IPconst frequentIPs = Object.entries(ipCounts)  .filter(([ip, count]) => count > 5)  .map(([ip, count]) => ({ ip, count }));// 返回结果（符合 n8n 输出格式）return frequentIPs.map(ipInfo => ({  json: ipInfo}));

https://api.cloudflare.com/client/v4/accounts/xxxx516d1d6axxxx546b8ce85368xxxx/rules/lists/xxxx2d4f1fd148xxxxae72c6ccd1xxxx/items

[  {    "ip": "1.2.3.4",    "comment": ""  }]