Monitor VPS Security with AI Analysis

This is a 10-node security monitor that SSHes into a VPS every six hours, collects process, network, port, login, and resource data, and sends it to GPT-4 Mini for threat analysis. A Structured Output Parser returns a severity rating, and two IF nodes route malicious findings to an immediate Telegram alert and suspicious ones to a separate review channel.

What does this workflow do?

A 10-node security monitoring system that SSH-es into your VPS every six hours, gathers process and network data, and uses GPT-4 Mini to detect threats that static rule engines miss. This is what happens when you combine traditional server monitoring with AI pattern recognition. The workflow does not just check if a port is open -- it analyzes the full context of what is running, what is connecting, and whether the behavior pattern matches known threat signatures. Dual-severity Telegram alerts ensure you hear about genuine threats immediately and review suspicious activity when it is convenient.

Nodes	Category	Complexity	Key Integrations
10	DevOps / Security	Advanced	SSH, OpenAI (GPT-4 Mini), Telegram

How does the monitoring and analysis work?

Every six hours, this workflow connects to your VPS via SSH and runs a series of system commands that capture running processes, active network connections, listening ports, recent login attempts, and resource utilization. The raw output is packaged and sent to GPT-4 Mini with a specialized security analysis prompt.

The AI evaluates the data against known threat patterns: cryptominers disguised as legitimate processes, unauthorized outbound connections, suspicious listening ports, brute force login attempts, and privilege escalation indicators. It returns a structured assessment with severity classification -- malicious, suspicious, or clean.

The dual-alert system is the key design decision. Confirmed malicious activity triggers an immediate Telegram alert with full details and recommended actions. Suspicious-but-unconfirmed activity goes to a separate Telegram channel for review during business hours. Clean reports are logged silently. This prevents alert fatigue while ensuring genuine threats get immediate attention.

What do you need to run it, and how long does setup take?

• SSH access to the target VPS (key-based authentication recommended)
• OpenAI API key (GPT-4 Mini for cost-effective security analysis)
• Telegram Bot Token and two configured channels/chats (one for critical alerts, one for review)
• Linux-based VPS with standard system utilities (ps, netstat/ss, auth.log, crontab)
• n8n SSH credentials configured with the VPS host, port, and authentication details
• Knowledge level: Intermediate to Advanced -- requires understanding of Linux system administration, SSH, and basic security monitoring concepts

20-30 minutes including SSH credential configuration, Telegram bot setup with dual channels, and schedule trigger configuration.

What does the workflow look like?

Which nodes does it use?

Triggers

• Schedule Trigger

Configuration

• Set (Server Config)

Data Collection

• SSH

AI & Analysis

• LLM Chain
• OpenAI (GPT-4 Mini)
• Structured Output Parser

Alerting

• IF x2
• Telegram x2

How does the workflow run, step by step?

1. Schedule Trigger -- The workflow fires every six hours. This cadence balances timely detection with reasonable API costs. For higher-security environments, the interval can be reduced to hourly.

2. Server Configuration -- A Set node defines the target VPS connection parameters: hostname, SSH credentials reference, and which data collection commands to execute.

3. SSH Data Collection -- The SSH node connects to the VPS and executes a curated set of commands: process listing (ps aux), network connections (netstat or ss), listening ports, recent auth log entries, disk and memory usage, and crontab contents. The combined output forms the raw security snapshot.

4. AI Security Analysis -- The raw SSH output is sent to GPT-4 Mini via an LLM Chain with a detailed security analysis prompt. The prompt instructs the AI to evaluate each data category against specific threat indicators: unknown processes with high CPU usage, unexpected outbound connections to foreign IPs, unauthorized listening ports, brute force login patterns, and suspicious cron entries.

5. Structured Output -- The Structured Output Parser enforces a consistent response format: overall severity level (clean, suspicious, malicious), list of flagged items with individual severity ratings, detailed analysis for each finding, and recommended remediation actions.

6. Severity Branching -- Two IF nodes evaluate the severity classification. Malicious findings take the critical alert path. Suspicious findings take the review alert path. Clean reports exit silently without generating notifications.

7. Dual Telegram Alerts -- Malicious findings send an immediate, detailed alert to a high-priority Telegram channel or direct message. Suspicious findings send a less urgent notification to a review channel. Each alert includes the full analysis, specific findings, and recommended actions.

What makes this workflow different?

SSH-based server monitoring. This workflow does not rely on installed agents or third-party monitoring services. It connects directly via SSH, runs standard Linux commands, and analyzes the output. No software to install on the server, no agents to maintain, no vendor lock-in.

AI-powered threat detection. Static rule-based monitoring catches known signatures. AI analysis catches patterns -- a combination of individually benign indicators that together suggest compromise. GPT-4 Mini provides this contextual analysis at a fraction of GPT-4's cost, making frequent monitoring economically viable.

Dual severity alerting. Alert fatigue kills security monitoring. By separating confirmed threats (immediate Telegram alert) from suspicious activity (review queue), this workflow ensures that critical alerts always get attention while lower-confidence findings are still captured for review.

How much does it cost to run?

• OpenAI GPT-4 Mini: ~$0.01-0.03 per analysis run (system output is relatively small). Running 4 times daily costs roughly $0.04-0.12/day
• SSH: No cost -- uses your existing server access
• Telegram: Completely free for bot messaging
• Monthly estimated cost: $1-4 in OpenAI API fees for 6-hour monitoring intervals. Hourly monitoring would cost $3-12/month
• No infrastructure to maintain beyond your existing VPS and n8n instance

Who is this workflow for?

• DevOps teams monitoring production servers without expensive monitoring platforms
• System administrators adding AI-powered threat detection to existing infrastructure
• Small businesses running self-hosted applications on VPS infrastructure
• Managed service providers monitoring multiple client servers from a central n8n instance

What should you know about security and key techniques?

Warning: Security Note

Store SSH credentials using n8n's built-in credential management. Never hardcode SSH keys or passwords in workflow nodes. Ensure your n8n instance itself is properly secured, as it will hold access credentials for your production servers.

Tip: Key Techniques

SSH as Data Collection Layer -- Using SSH commands instead of installed agents means zero footprint on the monitored server. This is ideal for environments where you cannot or prefer not to install additional software. Standard Linux commands provide all the data needed for comprehensive security analysis.

GPT-4 Mini for Cost-Effective Analysis -- Security monitoring runs frequently, so API costs matter. GPT-4 Mini provides sufficient reasoning capability for pattern recognition at a fraction of GPT-4's cost. Reserve GPT-4 for complex investigations; use Mini for routine monitoring.

Dual-Channel Alerting -- Separate your alert channels by severity. Critical alerts go to a channel with push notifications enabled. Suspicious findings go to a channel checked during business hours. This prevents the alert fatigue that causes teams to ignore monitoring entirely.

How do you download and import the workflow?

The workflow.json file in this folder can be imported directly into your n8n instance via Settings > Import Workflow.

This build ships with its complete n8n workflow. Download the workflow JSON, then import it in n8n with Workflows, Import from file, and add your own credentials before the first run.