AWS Security Posture Change Alerts with Claude & Slack (n8n)

AWS security posture changes, summarized with Claude and sent to Slack—automatically

This n8n workflow continuously (or on-demand) detects changes in your AWS Security Hub/Config findings snapshot, enriches them with asset inventory context, and uses Anthropic Claude to produce a structured change summary, severity, and compliance impact—then routes alerts to Slack (and compliance logging) for faster SecOps triage.

What this workflow does

• Schedules or manual trigger to start an AWS security posture check.
• Fetches the latest findings snapshot from a Security Hub/Config proxy API endpoint via HTTP.
• Compares snapshot vs. a stored baseline kept in workflow static data and stops immediately if nothing changed.
• Detects meaningful diffs and gathers resource context from an asset inventory/CMDB API.
• Calls Anthropic Claude (via an AI Agent) with previous/current snapshots and asset context to generate:
  • a structured change summary
  • severity assessment
  • compliance frameworks impacted
  • required actions
• Routes notifications based on severity: Critical findings go to a sign-off wait step; other severities are posted to a Slack review channel.
• On approval (or for non-Critical): updates the security posture record via HTTP, writes an audit entry to a compliance log API, notifies SecOps and Compliance in Slack, sends an email summary, and persists the new snapshot as the baseline.

Use cases

• Alerting SecOps teams only when AWS Security Hub/Config findings truly change.
• Providing compliance-ready context (frameworks impacted + actions) for governance workflows.
• Reducing alert fatigue by stopping runs when snapshots are unchanged.
• Introducing human sign-off for Critical posture changes before updates are committed.

Technical details

• n8n nodes/logic: if, set, code, no op, wait, slack
• Integrations:
  • HTTP endpoints for Security Hub/Config proxy findings snapshots
  • Asset inventory/CMDB API for account and resource context
  • Anthropic Claude via an AI Agent for structured severity/compliance change assessment
  • Slack for review and SecOps/Compliance notifications
  • HTTP-based compliance logging and security posture record updates