{"product_id":"splunk-exfiltration-alerts-in-n8n-deepseek-ai-slack-gmail","title":"Splunk Exfiltration Alerts in n8n: DeepSeek AI + Slack\/Gmail","description":"\u003ch3\u003eSpot likely data exfiltration from Splunk—automatically triaged with DeepSeek and alerted to Slack + Gmail\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow checks Splunk hourly for unusually large outbound HTTP\/HTTPS transfers, enriches each finding with 24-hour context, then uses a DeepSeek AI SOC analyst agent to determine exfiltration risk and send targeted alerts via \u003cstrong\u003eSlack\u003c\/strong\u003e and \u003cstrong\u003eGmail\u003c\/strong\u003e.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns every hour\u003c\/strong\u003e on a schedule to perform near-real-time monitoring of outbound traffic.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSearches Splunk\u003c\/strong\u003e for users\/hosts exceeding \u003cstrong\u003e5GB outbound traffic\u003c\/strong\u003e over ports \u003cstrong\u003e80\/443\u003c\/strong\u003e, then polls the Splunk search job until it completes.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eEnriches each flagged src_user\/src_ip\u003c\/strong\u003e with a \u003cstrong\u003esecond Splunk search\u003c\/strong\u003e covering the \u003cstrong\u003elast 24 hours\u003c\/strong\u003e to gather activity context (event volume, unique destinations, processes\/apps, and first\/last seen times).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eNormalizes the triage payload\u003c\/strong\u003e (including GB conversion, an after-hours indicator, and matching backup\/sync-like process signatures) to support more accurate risk assessment.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCalls DeepSeek AI\u003c\/strong\u003e via a LangChain Agent chat model to produce a structured \u003cstrong\u003eJSON verdict\u003c\/strong\u003e (risk level, confidence, hypothesis, reasoning, and recommended action).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRoutes results by risk\u003c\/strong\u003e:\n    \u003cul\u003e\n      \u003cli\u003e\n\u003cstrong\u003eHigh\/medium\/low\u003c\/strong\u003e outcomes are posted to the appropriate \u003cstrong\u003eSlack\u003c\/strong\u003e channels.\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eHigh-risk\u003c\/strong\u003e cases also trigger an email to the security lead via \u003cstrong\u003eGmail\u003c\/strong\u003e.\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eSecurity operations teams monitoring potential \u003cstrong\u003eHTTP\/HTTPS data exfiltration\u003c\/strong\u003e with automated triage.\u003c\/li\u003e\n  \u003cli\u003eSaaS operators needing consistent incident signal routing from \u003cstrong\u003eSplunk\u003c\/strong\u003e to \u003cstrong\u003eSlack\u003c\/strong\u003e and \u003cstrong\u003eGmail\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003eAutomation engineers deploying an \u003cstrong\u003en8n Splunk exfiltration alert\u003c\/strong\u003e workflow enhanced by AI risk scoring.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003en8n nodes \/ tools used:\u003c\/strong\u003e \u003cem\u003eif, code, no op, wait, gmail, slack\u003c\/em\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eIntegrations:\u003c\/strong\u003e \u003cstrong\u003eSplunk\u003c\/strong\u003e (network\/endpoint indexes) and \u003cstrong\u003eDeepSeek\u003c\/strong\u003e (LangChain Agent chat model + fixer for structured output repair).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCore mechanics:\u003c\/strong\u003e hourly Splunk search → 24-hour context enrichment → DeepSeek JSON verdict parsing → Slack\/Gmail routing.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45899972214963,"sku":"N8N-18683","price":21.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/7TU20uK0m3QuXkFRiTjdh_4iKtLqKw.png?v=1787736068","url":"https:\/\/buyflowscripts.com\/products\/splunk-exfiltration-alerts-in-n8n-deepseek-ai-slack-gmail","provider":"N8N Commerce","version":"1.0","type":"link"}