Splunk Exfiltration Alerts in n8n: DeepSeek AI + Slack/Gmail

Spot likely data exfiltration from Splunk—automatically triaged with DeepSeek and alerted to Slack + Gmail

This n8n workflow checks Splunk hourly for unusually large outbound HTTP/HTTPS transfers, enriches each finding with 24-hour context, then uses a DeepSeek AI SOC analyst agent to determine exfiltration risk and send targeted alerts via Slack and Gmail.

What this workflow does

• Runs every hour on a schedule to perform near-real-time monitoring of outbound traffic.
• Searches Splunk for users/hosts exceeding 5GB outbound traffic over ports 80/443, then polls the Splunk search job until it completes.
• Enriches each flagged src_user/src_ip with a second Splunk search covering the last 24 hours to gather activity context (event volume, unique destinations, processes/apps, and first/last seen times).
• Normalizes the triage payload (including GB conversion, an after-hours indicator, and matching backup/sync-like process signatures) to support more accurate risk assessment.
• Calls DeepSeek AI via a LangChain Agent chat model to produce a structured JSON verdict (risk level, confidence, hypothesis, reasoning, and recommended action).
• Routes results by risk:
  • High/medium/low outcomes are posted to the appropriate Slack channels.
  • High-risk cases also trigger an email to the security lead via Gmail.

Use cases

• Security operations teams monitoring potential HTTP/HTTPS data exfiltration with automated triage.
• SaaS operators needing consistent incident signal routing from Splunk to Slack and Gmail.
• Automation engineers deploying an n8n Splunk exfiltration alert workflow enhanced by AI risk scoring.

Technical details

• n8n nodes / tools used: if, code, no op, wait, gmail, slack.
• Integrations: Splunk (network/endpoint indexes) and DeepSeek (LangChain Agent chat model + fixer for structured output repair).
• Core mechanics: hourly Splunk search → 24-hour context enrichment → DeepSeek JSON verdict parsing → Slack/Gmail routing.