Quick overview This workflow runs daily at 08:00 to pull yesterday’s invoices from Holded, aggregate invoice count and totals, identify the top customer, and post a formatted sales digest to a Slack channel. How it works Runs every day at 08:00 on a scheduled trigger. Retrieves all invoices from Holded dated yesterday. Calculates the number of invoices, total billed amount, and the top customer by billed total, then formats the results into a Slack-ready message. Posts the daily sales report message to the selected Slack channel. Setup Add your Holded API v2 credentials (API key) to allow the workflow to read invoices. Add your Slack credentials and select the channel where the report should be posted. Adjust the schedule time if you want the report to run at a different hour. Install the free Holded community node first: in n8n go to Settings → Community Nodes → Install and search for @francodesystems-npm/n8n-nodes-holded. It is a verified community node, so it is also available on n8n Cloud.
Tags
Related workflows
See all Slack→Monitor Domains & IPs on AbuseIPDB Blacklist with Slack Alerts
⚙ How It Works The automated blacklist monitor is designed to be a proactive, not reactive, tool. Here is the high-level process: Scheduled Checks: At regular intervals (e.g., every 30 minutes or every hour), a monitoring script or service sends a request to a list of predefined DNS blacklists (DNSBLs) and real-time blackhole lists (RBLs). Lookup Queries: For each check, the system performs a lookup query for our specified domains and IP addresses against the various blacklists. It essentially asks, "Is our-ip-address.com on your list?" Status Evaluation: The blacklist service responds with a status: either the asset is clean or it is listed. Alerting Mechanism: If a new listing is detected, the system immediately triggers a notification. This alert contains key information like the asset that was blacklisted (domain or IP), the specific blacklist it was found on (e.g., Spamhaus), and the time of detection. Status Logging: The status of each asset (clean or listed) is logged in a central dashboard. This allows us to track the history of an IP or domain, see when a listing occurred, and when it was resolved. Setup Steps Follow these steps to set up the automated blacklist monitor. S
Monitor Email Data Breaches with HIBP API and Send Slack Alerts
How It Works: The 5-Node Security Flow This workflow efficiently performs a scheduled data breach scan. 1. Scheduled Check (Cron Node) This is the workflow's trigger. It schedules the workflow to run at a specific, regular interval. Function:** Continuously runs on a set schedule, for example, every Monday morning. Process:* The *Cron** node automatically initiates the workflow, ensuring routine data breach scans are performed without manual intervention. 2. List Emails to Check (Code Node) This node acts as your static database, defining which email addresses to monitor for breaches. Function:** Stores a list of email addresses from your team or customers in a single, easy-to-update array. Process:** It configures the list of emails that are then processed by the subsequent nodes. This makes it simple to add or remove addresses as needed. 3. Query HIBP API (HTTP Request Node) This node connects to the HaveIBeenPwned (HIBP) API to check for breaches. Function:** Queries the HIBP API for each email address on your list. Process:** It sends a request to the HIBP API. The API responds with a list of data breaches that the email was found in, if any. 4. Is Breached? (If Node) This is t
Monitor Security Logs for Failed Login Attempts with Slack Alerts
How It Works: The 5-Node Anomaly Detection Flow This workflow efficiently processes logs to detect anomalies. Scheduled Check (Cron Node): This is the primary trigger. It schedules the workflow to run at a defined interval (e.g., every 15 minutes), ensuring logs are routinely scanned for suspicious activity. Fetch Logs (HTTP Request Node): This node is responsible for retrieving logs from an external source. It sends a request to your log API endpoint to get a batch of the most recent logs. Count Failed Logins (Code Node): This is the core of the detection logic. The JavaScript code filters the logs for a specific event ("login_failure"), counts the total, and identifies unique IPs involved. This information is then passed to the next node. Failed Logins > Threshold? (If Node): This node serves as the final filter. It checks if the number of failed logins exceeds a threshold you set (e.g., more than 5 attempts). If it does, the workflow is routed to the notification node; if not, the workflow ends safely. Send Anomaly Alert (Slack Node): This node sends an alert to your team if an anomaly is detected. The Slack message includes a summary of the anomaly, such as the number of fai