Splunk Security Alert Webhook Enrichment with AbuseIPDB + Email & Telegram

Turn Splunk security alerts into enriched, deduplicated alerts—instantly

This n8n workflow receives Splunk security alerts via webhook, detects duplicates within a 15-minute cooldown, enriches public source IPs with AbuseIPDB reputation data, calculates a composite risk score, and sends severity-based notifications through Email and Telegram—plus a daily digest.

What this workflow does

• Ingest & normalize: Accepts Splunk alert payloads using a POST webhook and normalizes key fields including severity, source IP, targeted users/hosts, event counts, and timestamps.
• Deterministic fingerprinting & deduplication: Creates a fingerprint per alert and checks the “Splunk Security Incidents” Data Table for the latest match. If an identical alert is found within a 15-minute cooldown window, it is suppressed.
• Duplicate handling: Duplicate alerts are stored with a zero risk score and no notifications are sent.
• AbuseIPDB enrichment: For public IPv4 addresses, the workflow enriches with AbuseIPDB** reputation data; non-public addresses use default threat-intelligence values.
• Composite risk scoring: Calculates risk using Splunk severity, failed attempts, AbuseIPDB confidence score, and targeted user/host counts.
• Severity-based notification routing: Sends Critical/High incidents via Email and Telegram, sends Medium incidents via Email, and stores Low incidents without notification.
• Daily digest: Runs daily at 18:00 to aggregate metrics from the previous 24 hours and email a summary.

Use cases

• Reduce alert fatigue by suppressing repeated Splunk detections within 15 minutes.
• Speed up triage by enriching public source IPs with AbuseIPDB before notifying responders.
• Centralize incident tracking in an n8n Data Table for reporting and daily security metrics.

Technical details

• Webhook (POST) for Splunk ingestion
• Data Table for deduplication and incident storage (“Splunk Security Incidents”)
• if, filter, code, no op for workflow logic and routing
• Telegram for Critical/High notifications
• Email for Medium/Critical/High plus the daily digest