n8n Security Alert Triage Webhook with AbuseIPDB, VirusTotal

Automate SOC Security Alert Triage with an n8n Webhook + AbuseIPDB & VirusTotal

This n8n workflow receives security alerts via a webhook, enriches the data using AbuseIPDB and VirusTotal, then uses OpenAI to generate a structured SOC-style triage—automatically notifying Slack and creating tickets for urgent incidents.

What this workflow does

• Receives alerts through an HTTP POST webhook endpoint (/security-alert), accepting common security alert payload fields.
• Normalizes the input into a consistent JSON structure (IDs, IPs, host, user, rule name, severity, and file hash).
• Enriches the source IP with reputation data from AbuseIPDB and geolocation/ASN data from ipinfo.io.
• Checks the file hash in VirusTotal to add threat-intel context.
• Generates triage by sending the consolidated alert + enrichment results to an OpenAI chat model, producing structured JSON including severity, false-positive likelihood, summary, recommended actions, and confidence.
• Routes outcomes: high/critical alerts are posted to an urgent Slack incoming-webhook and trigger an incident via a configured ticketing HTTP endpoint; other severities go to a routine Slack logging channel.
• Responds back to the webhook caller with the enriched alert and the triage JSON.

Use cases

• Improve response time by triaging IDS/EDR/SIEM alerts automatically and escalating only high/critical findings.
• Reduce analyst workload with enriched context from AbuseIPDB and VirusTotal before investigation.
• Route actionable incident context to Slack and your ticketing system for consistent SOC operations.

Technical details

• n8n nodes: Webhook, HTTP Request, IF, Code, Sticky Note, and n8nn8n-nodes-langchainagent.
• External services: AbuseIPDB, ipinfo.io, VirusTotal, and an OpenAI chat model.
• Outputs: returns enriched alert + structured triage JSON; posts to Slack and calls a ticketing HTTP endpoint for urgent alerts.

Ideal for n8n users, automation engineers, and SaaS operators building practical security alert triage automation.