DarkMoon in n8n: an autonomous pentest node for your SOAR workflows

SOAR is glue, and n8n is one of the most popular ways to write it. The DarkMoon community node lets a workflow launch an autonomous pentest, react to what it finds, and route the result wherever your team already lives: a ticket, a Slack channel, a DefectDojo import, a scheduled digest.

Two nodes

• DarkMoon, an action node for the operations you call on demand.
• DarkMoon Trigger, a source node that starts a workflow when something happens.

Both authenticate through a single DarkmoonApi credential.

What the action node does

The action node is organised as resources and operations:

• Campaign: launch, get, list, get severity summary.
• Finding: get, list, get evidence metadata (counts only, never evidence bodies).
• Retest: launch, get verdicts (fixed, still present, regressed, new).
• Metric: get timeseries for severity, status, category and campaign posture.
• Webhook: register, list and delete signed webhooks.

Launch options include multiple targets, exclusions and focus, a severity cap, and a remediation opt-in that opens a fix pull request for human review. The remediation option uses an opaque credentialRef, a vault reference, so no repository secret ever passes through the workflow, and it never auto-merges.

What the trigger does

The trigger runs in Poll mode (recommended, no inbound exposure) or Webhook mode. It emits campaign.started, campaign.completed, campaign.stopped, campaign.aborted, finding.discovered, finding.confirmed, finding.exploited, finding.remediated, pr.opened and pr.updated. In poll mode it diffs campaigns, findings and pull requests between runs, so you get exactly the new events.

Templates to start from

The node ships four ready-made workflows:

• Export findings to DefectDojo.
• Alert Slack on an exploited finding.
• Auto-retest when a remediation PR is merged.
• A scheduled posture digest.

See the integrations catalog for how the n8n node pairs with the CI actions and the SecOps dashboards.