SourcesSource Types
n8n
Receive workflow automation logs from n8n showing workflow executions, node activities, and automation events.
Setup
n8n can send logs directly to RunReveal via webhook.
Step 1: Create Webhook Source in RunReveal
- Go to Sources in RunReveal
- Click the n8n source tile (or n8n Webhook if available)
- Give it a descriptive name (e.g., "n8n Webhook")
- Optionally enable bearer token authentication for added security
- Click Connect Source to generate a unique webhook URL
- Copy the generated webhook URL and bearer token (if enabled)
Step 2: Configure n8n
- Log into your n8n console
- Navigate to integrations or webhook settings
- Add a new webhook destination
- Configure the webhook:
- URL: Paste the RunReveal webhook URL you copied
- Method: POST
- Content-Type: application/json
- Authorization: If you enabled bearer token, add
Authorization: Bearer YOUR_TOKENheader
- Save the webhook configuration
Verify It's Working
Once added the source logs should begin flowing within a minute.
You can validate we are receiving your logs by running the following SQL query.
Schema
The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.
Table: n8n_logs (44 columns)
n8n_logs (44 columns)| Column | Type |
|---|---|
workspaceID | String |
sourceID | String |
sourceType | LowCardinality(String) |
sourceTTL | UInt32 |
receivedAt | DateTime |
id | String |
eventTime | DateTime |
eventName | String |
eventID | String |
srcIP | String |
srcASCountryCode | String |
srcASNumber | UInt32 |
srcASOrganization | String |
srcCity | String |
srcConnectionType | String |
srcISP | String |
srcLatitude | Float64 |
srcLongitude | Float64 |
srcUserType | String |
dstIP | String |
dstASCountryCode | String |
dstASNumber | UInt32 |
| Column | Type |
|---|---|
dstASOrganization | String |
dstCity | String |
dstConnectionType | String |
dstISP | String |
dstLatitude | Float64 |
dstLongitude | Float64 |
dstUserType | String |
actor | Map(String, String) |
tags | Map(String, String) |
resources | Array(String) |
serviceName | String |
enrichments | Array(Tuple(data Map(String, String), name String, provider String, type String, value String)) |
readOnly | Bool |
rawLog | String |
n8nEventId | String |
message | String |
workflowId | String |
workflowName | String |
executionId | String |
nodeType | String |
nodeName | String |
nodeId | String |