Seed New Security Databases with Threat Context Automatically
You create a new security database in Notion but start with no threat context. Notis pulls the latest blacklist and seeds the database so you have baseline intelligence from day one, eliminating a manual setup task.
Trigger
Database Created
Triggers when a new Notion database (the container) is created. A database is the post-2025-09-03 container that holds one or more data sources. This trigger fires for the container's creation event (`database.created`), distinct from `NOTION_DATASOURCE_CREATED` which fires when a new data source is added to an existing database. Most customers calling Notion's `POST /v1/databases` (the legacy API) or creating a database via the Notion UI will see this event. Adding a new data source to an existing database fires `data_source.created` instead — use `NOTION_DATASOURCE_CREATED` for that. Notion's payload puts `entity.type: "block"` (the container is a `child_database` block in the content tree) and `entity.id` is the database id.
Action
Retrieve IP Blacklist
Tool to retrieve a list of the most reported ip addresses. use when building dynamic blocklists or threat intelligence feeds.
Why this helps
Setting up a new security tracking database means manually pulling threat intelligence separately, duplicating effort and delaying your ability to start tracking.
- New security databases start with threat context
- No separate threat intel import needed
- Faster database setup and readiness
Setup
Build it in a few focused steps.
- 1Connect your Notion workspace to Notis.
- 2Connect your Abuselpdb account to Notis.
- 3Create an automation: name it 'Seed Security Databases', prompt: 'When a new database is created in Notion for security purposes (check the name for keywords like security, threat, incident), retrieve the latest IP blacklist from Abuselpdb and create an entry with the blacklist snapshot and timestamp.'
- 4Select 'Database Created' as the trigger and configure notifications.
- 5Test by creating a new 'Security Incidents' database in Notion and verify the blacklist entry is created.
Questions about this workflow
How does Notis know if a database is for security?
It looks for keywords in the database name: security, threat, incident, abuse, attack, etc.
What if the database name doesn't contain keywords?
You can manually tag the automation prompt with the database ID for precise targeting.
Can I add multiple threat intel sources?
Yes. Extend the automation prompt to pull data from multiple threat feeds.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Notion to Abuselpdb. A trigger fires from one place; an action lands in another.
Notion triggers
Abuselpdb actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Retrieve IP Blacklist
Tool to retrieve a list of the most reported ip addresses. use when building dynamic blocklists or threat intelligence feeds.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Bulk Report
Tool to submit multiple ip abuse reports in bulk. use when you need to report a large set of ips at once by uploading a csv file with required headers. csv must include columns: ip, categories, reportdate, comment.
All Page Events
Triggers when any Notion page is created or updated across the workspace.
Check Block
Tool to check the reputation of all ip addresses in a cidr range. use when you need aggregated abuse data for a network block.
Comment Created
Triggers when a new comment is created in Notion. Optional `page_id` filter scopes to comments on a specific page. When omitted, fires for any new comment in the workspace the integration has access to. Requires the 'Read comments' capability on the Notion integration. If a connection was authorized before that capability was enabled, the user must re-authorize the connection for comment events to flow.
Check IP Reputation
Tool to check the reputation of an ip address. use when you need to determine if an ip address has been reported for abusive activity within a specified look-back period. example: checkip(ipaddress='8.8.8.8', maxageindays=90).
New Comment
Triggers when a new comment is added to a specified Notion block or page.
Clear Address Reports
Tool to remove all reports associated with a specific ip address. use when you need to purge your own abuse records after verifying control of the ip.
Database Created
Triggers when a new Notion database (the container) is created. A database is the post-2025-09-03 container that holds one or more data sources. This trigger fires for the container's creation event (`database.created`), distinct from `NOTION_DATASOURCE_CREATED` which fires when a new data source is added to an existing database. Most customers calling Notion's `POST /v1/databases` (the legacy API) or creating a database via the Notion UI will see this event. Adding a new data source to an existing database fires `data_source.created` instead — use `NOTION_DATASOURCE_CREATED` for that. Notion's payload puts `entity.type: "block"` (the container is a `child_database` block in the content tree) and `entity.id` is the database id.
Get Abuse Reports
Tool to retrieve a list of abuse reports for a specific ip address. use when you need to fetch historic reports with optional filtering by status, date range, reporter, and pagination.
Data Source Created
Triggers when a new Notion data source is created. Fires workspace-wide. The payload's `data.parent` carries the data source's tree parent (typically the teamspace) for downstream filtering. A single template-based database creation can fire multiple `data_source.created` events at once — one per data source the template instantiates.
Data Source Schema Updated
Triggers when a Notion data source's schema is updated. Fires on column add / remove / rename. Payload includes `data.updated_properties: [{id, name, action}]` so consumers can discriminate the kind of change downstream. Optional `data_source_id` filter scopes to schema changes on a single data source. When omitted, fires for any schema change in the workspace the integration has access to. Note: adding a column also fires `page.properties_updated` once per existing row in the data source. Customers wanting a single structural-change signal should use this trigger.
Connect any two apps with Notis in the middle.
Notion and Abuselpdb, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Abuselpdb.