Monitor VPS security with GPT-4 mini analysis via SSH and Telegram alerts

Monitor VPS security with AI analysis via SSH and Telegram alerts

This n8n template automatically monitors your VPS for suspicious processes and network connections using AI analysis. It connects to your server via SSH, analyzes running processes, and sends Telegram alerts when potential security threats are detected.

Who's it for

- System administrators managing VPS/dedicated servers - DevOps teams monitoring production environments - Security-conscious users who want automated threat detection - Anyone running services on Linux servers who wants proactive monitoring

How it works

The workflow runs on a scheduled basis and performs the following steps:

1. SSH Connection: Connects to your VPS via SSH and executes system commands to gather process and network information 2. Data Collection: Runs ps aux --sort=-%cpu,-%mem && ss -tulpn to capture running processes sorted by CPU/memory usage and active network connections 3. AI Analysis: Uses OpenAI's language model to analyze the collected data for suspicious patterns, malware signatures, unusual network connections, or abnormal resource usage 4. Structured Output: Parses AI responses into structured data identifying malicious and suspicious activities with explanations 5. Alert System: Sends immediate Telegram notifications when malicious processes are detected

Requirements