nodes-energy Node Reference
The nodes-energy package provides workflow nodes that interact directly with
Energy SOAR Base and Automation. These are the primary building blocks for SOAR
playbooks running in the integrated n8n engine.
Four nodes are included:
Energy SOAR Base
Reads from and writes to the Energy SOAR Base case management module. Use this node to query cases, alerts, observables, and tasks, or to update them as part of an automated workflow.
Common operations
Fetch open cases (e.g. to drive SLA monitoring loops).
Fetch observables attached to a case (e.g. before submitting them to an analyzer).
Update a case field — severity, TLP, flag, custom field value.
Add or update a tag on a case or observable.
Create a task or task log entry.
Import an alert as a case.
Configuration
The node uses the Energy SOAR Base connection configured in the n8n credential store. The credential requires:
URL — Base URL of the Energy SOAR Base instance (e.g.
http://127.0.0.1:9000).API Key — a valid API key generated from the user account settings in Energy SOAR Base (see User Management).
Tip: Use the Get cases operation with a filter on status = Open as the
first node in scheduled playbooks. Pass each case to subsequent nodes using the
n8n item model.
Energy SOAR Automation
Submits analysis and response jobs to the Energy SOAR Automation module (Cortex). Use this node to run analyzers against observables or trigger responders on cases, tasks, alerts, or observables.
Common operations
Submit an observable (IP, domain, URL, hash) to one or more analyzers.
Retrieve the result of a completed analysis job.
Trigger a responder on a case or observable.
List available analyzers and responders for a given observable type.
Configuration
The node uses the Energy SOAR Automation (Cortex) connection configured in the n8n credential store. The credential requires:
URL — Base URL of the Automation instance.
API Key — a valid API key from an Automation user account.
Tip: After submitting a job, pair this node with a Wait node and a second
Energy SOAR Automation node in Get job mode. Poll until the job status is
Success or Failure before reading the report.
Generate Report
Triggers report generation for a case in Energy SOAR Base and optionally attaches the output to the case or sends it to an external destination.
Use this node at the end of a remediation workflow to produce a structured incident report without manual analyst intervention.
Configuration
Requires the same Energy SOAR Base credential as the Energy SOAR Base node. Specify the case identifier and the report template to apply.
Request Tracker
Creates and updates tickets in a connected Request Tracker (RT) instance. Use this node to mirror Energy SOAR cases as RT tickets for teams that operate outside the SOAR platform, or to feed ticketing SLAs from case events.
Common operations
Create an RT ticket from a case.
Update an RT ticket field when a case status changes.
Add a comment to an RT ticket when a task is completed.
Configuration
The node requires a Request Tracker credential in the n8n credential store:
URL — Base URL of the RT instance.
Username / Password — credentials of a service account in RT.
Connecting nodes-energy nodes to a workflow
All four nodes follow the same pattern as standard n8n nodes:
Add the node to the canvas from the node panel.
Double-click the node to open its settings.
Select the operation from the Resource and Operation dropdowns.
Configure any filters or field values.
Connect the node’s output to the next node in the workflow.
Error handling: if a job fails or the API returns an error, the node outputs the
error message as an item property. Use an IF node on error to branch into
an error-handling path, or enable Continue On Fail in the node settings to
pass the failed item downstream.
For workflow examples that use these nodes, see Built-in Workflow Examples. For a guide to writing custom nodes, see Creating Your First Node.