Deduplicate Security Alerts in n8n: Claude + Slack Unified Cases

Stop Alert Fatigue: Deduplicate SIEM/EDR/Cloud Security Alerts and Create Unified Cases

This n8n workflow automatically deduplicates incoming security alerts across SIEM, EDR, and cloud security tools, merges related events into unified ticket cases, and sends a concise update to your Slack channel—using Claude only when the duplicates aren’t obvious.

What this workflow does

• Receives alerts from three sources via dedicated HTTP webhooks: /alerts/siem, /alerts/edr, and /alerts/cloud.
• Normalizes every alert into a shared schema and posts it to an external alert-buffer API for temporary storage.
• Runs on a schedule to fetch alerts from the alert-buffer API for the latest processing window.
• Fingerprints and pre-clusters duplicates using host, rule ID, and severity, and pre-merges obvious duplicates that occur within a tight time window.
• Uses Anthropic Claude for ambiguity: only ambiguous clusters are sent to Anthropic Claude to decide whether they should be merged into a single case or kept separate.
• Builds unified security cases from the final clusters, then bulk creates or updates them in your external ticketing system.
• Notifies Slack with the number of unified cases created or updated for that cycle.

Use cases

• Reduce duplicate incidents when the same detection triggers across SIEM, endpoint telemetry (EDR), and cloud security monitoring.
• Create cleaner, operator-friendly case histories by grouping repeated events into unified security cases.
• Improve analyst throughput by delegating “merge vs. keep separate” decisions to Claude only for hard-to-classify clusters.

Technical details

• n8n nodes / capabilities: if, code, merge, slack, webhook, sticky note
• Integrations: HTTP webhooks (SIEM/EDR/cloud), alert-buffer API, Anthropic Claude, ticketing system (bulk create/update), Slack notifications
• Setup includes: configure tool webhooks, set HTTP Header Auth for the alert-buffer API, and add Anthropic credentials.

Result: fewer duplicate alerts, faster triage, and unified cases with minimal unnecessary AI calls.