Automate cybersecurity incident response with Claude AI, VirusTotal and Slack

Name: Automate cybersecurity incident response with Claude AI, VirusTotal and Slack
Availability: InStock
Author: Oneclick AI Squad

Automate cybersecurity incident response with Claude AI, VirusTotal and Slack preview

Open on n8n.io

$20/month : Unlimited workflows

2500 executions/month

Try free

THE #1 IN WEB SCRAPING

Scrape any website without limits

Try free

HOSTINGER

Early Deal
DISCOUNT 20%

Self-hosted n8n

Unlimited workflows - from $4.99/mo

Try free

#1 hub for scraping, AI & automation

6000+ actors - $5 credits/mo

Try free

Overview

This workflow automates end-to-end cybersecurity incident response by ingesting alerts from multiple sources, enriching threat intelligence, assessing severity with Claude AI, executing containment actions, notifying stakeholders, and creating audit-ready tickets.

How it works

Ingest Alert - Webhook receives alerts from SIEM, EDR, firewall, IDS/IPS
Validate & Normalize - Standardizes alert format across all sources
Enrich Threat Intel - Queries VirusTotal, AbuseIPDB, Shodan for context
AI Severity Assessment - Claude AI classifies severity and recommends response
Containment Actions - Auto-blocks IPs, isolates hosts, revokes tokens based on severity
Notify Stakeholders - Alerts SOC team via Slack/email based on severity level
Create Incident Ticket - Logs to Jira/ServiceNow with full enrichment data
Audit Log - Writes compliance-ready record to Google Sheets

Setup Steps

Import workflow into n8n
Configure credentials:

Webhook - Point your SIEM/EDR to the webhook URL
Anthropic API - Claude AI for severity classification
VirusTotal API - Threat intelligence enrichment
AbuseIPDB API - IP reputation checking
Slack OAuth - SOC team notifications
Jira API - Incident ticket creation
Google Sheets - Compliance audit log

Update firewall/EDR API endpoints in containment nodes
Set your Slack channel IDs and Jira project key
Activate the workflow

Sample Alert Payload

{
 "source": "splunk",
 "alertType": "brute_force",
 "sourceIP": "192.168.1.100",
 "destinationIP": "10.0.0.5",
 "affectedHost": "prod-server-01",
 "affectedUser": "[email protected]",
 "timestamp": "2025-02-22T10:30:00Z",
 "rawLog": "Failed login attempt x50 in 60s"
}

Features

Multi-source ingestion - SIEM, EDR, firewall, IDS/IPS
Real-time threat enrichment from VirusTotal & AbuseIPDB
AI-powered severity scoring with recommended playbooks
Automated containment for Critical/High severity
Compliance audit trail with full chain of custody

Industries That Benefit

Financial Services: Rapid containment of fraud and data exfiltration attempts.
Healthcare: Protect PHI with automated isolation and HIPAA-compliant logging.
Retail & E-commerce: Prevent POS breaches and payment card compromises.
Government & Defense: Enforce zero-trust response with full audit trails.
Critical Infrastructure: Contain OT threats before operational disruption.

Prerequisites

SIEM/EDR alerting configured to forward to webhook
API access to threat intelligence platforms (VirusTotal, OTX, MISP)
EDR (CrowdStrike, Carbon Black) or firewall API credentials
ITSM system (Jira, ServiceNow) with API access
n8n instance with HTTP Request, Function, Slack, and Email nodes enabled
SMTP, Slack, or SMS gateway credentials

Modification Options

Add phishing triage with email detonation sandbox.
Integrate SOAR playbooks for ransomware response.
Enable auto-remediation (e.g., disable user in AD).
Add forensic artifact collection (memory dump, logs).
Trigger war room creation in Slack/Teams for Major incidents.
Export incidents to case management (e.g., TheHive, Cortex).

Explore More Cybersecurity Automation Workflows: Contact us to build custom SOAR, threat hunting, and compliance automation solutions powered by n8n and AI.

Oneclick AI Squad

199 workflows

Complexity

advanced

Published 07 Nov 2025

Likes 0

View on n8n.io Download Workflow

Install path: /data/workflows/10587/10587.json

Share Your Workflow

Have a useful automation to share? Publish it and help the community.

Submit Your Template How to Submit

Related Workflows

Orchestrate multi-agent compliance monitoring and audit logging with GPT-4o and Slack

## How It Works This workflow automates enterprise compliance governance using a multi-agent AI architecture. It targets compliance officers, legal teams, and risk managers who need continuous, jurisdiction-aware monitoring without manual intervention.The workflow runs on two paths: a scheduled governance check and an event-driven compliance signal receiver. Both converge on a central Governance Agent that orchestrates four specialised sub-agents, Compliance Signal, Jurisdiction Analysis, Remediation Planning, and Audit Documentation, each backed by dedicated AI models. External tools handle API lookups, penalty calculations, escalation notifications, and structured output parsing. Results feed into immutable audit logs, merged with scheduled reports, and dispatched as a daily email summary. Escalation logic ensures critical violations trigger immediate alerts. This eliminates fragmented compliance tracking, reduces human error, and provides auditable, timestamped records across multiple regulatory jurisdictions. ## Setup Steps 1. Add Claude/OpenAI credentials to all Chat Model nodes. 2. Configure the External Compliance API Tool with your regulatory API key and endpoint. 3. Set the Compliance Data Calculation Tool parameters (jurisdiction codes, penalty thresholds). 4. Connect the Escalation Notification Tool to your email or Slack credentials. 5. Set the Periodic Compliance Check schedule (cron) to your audit cadence. ## Prerequisites - External compliance/regulatory API access - Email or Slack account for notifications - n8n instance (v1.40+ recommended) ## Use Cases - Automated GDPR/MAS/SOX compliance monitoring across jurisdictions ## Customization Swap AI models per agent for cost optimisation. ## Benefits Eliminates manual compliance checks with autonomous multi-agent orchestration.

View

Detect WooCommerce order fraud and send alerts to Slack

# WooCommerce Fraud Detection & Slack Alert Workflow This workflow automatically monitors WooCommerce orders, evaluates them for fraud using multiple checks (address mismatch, high-value orders, suspicious emails, admin orders), calculates a fraud score and sends alerts to Slack when risk is detected. ### Quick Implementation Steps 1. Import the workflow JSON into n8n 2. Configure WooCommerce API credentials 3. Set up Slack API credentials and channel 4. Adjust fraud rules (amount threshold, email regex, etc.) 5. Test with sample order data 6. Activate the workflow ## What It Does This workflow automates fraud detection for WooCommerce orders by applying multiple validation checks and assigning a fraud score. It starts with scheduled execution, fetches order data and prepares it for evaluation by extracting key details such as billing information, order value and customer email. Once the data is prepared, the workflow applies a series of fraud detection rules. These include checking whether billing and shipping details mismatch, identifying high-value orders, detecting suspicious or disposable email addresses and verifying if the order was created by an admin. Each condition contributes to a fraud score based on predefined logic. Finally, all signals are merged and a fraud score is calculated. If the score crosses the defined threshold, a detailed alert is sent to a Slack channel with complete order and risk information, enabling quick manual review and action. ## Who’s It For - eCommerce store owners using WooCommerce - Fraud prevention and risk management teams - Operations teams handling order validation - Developers building automation workflows in n8n - Businesses wanting real-time fraud alerts in Slack ## Requirements to Use This Workflow - n8n instance (self-hosted or cloud) - WooCommerce store with API access enabled - WooCommerce API credentials configured in n8n - Slack workspace with API credentials - Slack channel ID for sending alerts - Basic understanding of n8n nodes and workflows ## How It Works & Set Up ### Setup Instructions 1. Import the workflow JSON into your n8n workspace 2. Configure the **Schedule Trigger** node to define execution frequency 3. Set up the **WooCommerce node**: - Add API credentials - Ensure correct store URL - Modify `orderId` if needed 4. Configure **Slack node**: - Connect Slack API credentials - Select or update the target channel 5. Review **Set nodes**: - Ensure fields like email, total and address are correctly mapped 6. Validate **IF conditions**: - Status check (pending/processing) - Address mismatch logic - High-value threshold (default: 500) - Email regex for disposable domains 7. Review **Code node** logic: - Fraud score calculation rules - Adjust scoring weights if needed 8. Test the workflow: - Use sample order data - Verify Slack alert output 9. Activate the workflow for automatic execution ## How To Customize Nodes - **Check High Value (>500)** Modify the threshold value to match your business needs - **Detect Disposable Email** Update regex pattern to include more domains - **Calculate Fraud Score (Code Node)** Adjust scoring logic: ```js if ($json.high_value_order) score += 3; ``` - **Fraud Threshold Check** Change minimum score required to trigger alerts - **Slack Message Node** Customize alert message format and included fields ## Add-ons (Enhancements) - Store fraud results in a database (MySQL, MongoDB, etc.) - Automatically cancel or hold suspicious orders via WooCommerce API - Send email alerts in addition to Slack notifications - Add IP geolocation checks for advanced fraud detection - Integrate with third-party fraud detection APIs - Add risk categorization (Low / Medium / High) ## Use Case Examples - Detect high-value fraudulent orders before fulfillment - Identify mismatched shipping addresses for manual review - Flag orders using disposable or temporary email addresses - Monitor admin-created orders to reduce internal misuse risk - Real-time fraud alerts for operations teams via Slack > There can be many more use cases depending on how you extend and customize this workflow. ## Troubleshooting Guide | Issue | Possible Cause | Solution | | --------------------------- | ------------------------------------- | -------------------------------------------- | | No orders fetched | Incorrect WooCommerce credentials | Verify API keys and store URL | | Slack message not sent | Wrong Slack credentials or channel ID | Reconnect Slack and check channel | | Fraud score always 0 | Conditions not triggering | Verify IF node logic and data mapping | | Email detection not working | Regex not matching | Update regex pattern | | Workflow not running | Schedule trigger not configured | Set interval correctly and activate workflow | ## Need Help? If you need assistance setting up this workflow, customizing fraud rules or adding advanced features, our [n8n workflow development team](https://www.weblineindia.com/hire-n8n-developers/) at **WeblineIndia** is here to help. We can help you: - Customize this workflow for your business needs - Integrate with external systems and APIs - Build advanced fraud detection logic - Create fully automated eCommerce workflows 👉 [Reach out to WeblineIndia](https://www.weblineindia.com/contact-us.html) for expert support and tailored automation solutions.

View

Secure AI agent webhook with HMAC, replay protection, and OpenAI GPT-5

## **⚠️ Disclaimer:** > I am **not a cybersecurity expert**. This workflow was built through research and with the assistance of an LLM (Claude Opus 4.6). While it implements well-established security patterns (HMAC-SHA256, timing-safe comparison, replay protection, strict payload validation), please review the logic carefully and ensure it meets your own security requirements before deploying it in production. ## Who is this for? This template is for anyone exposing an n8n workflow via webhook and wanting to ensure that only authenticated, untampered requests are processed. ## What problem does this solve? Public webhooks are vulnerable by default. Without proper verification, anyone who discovers your URL can send forged requests, replay old ones, or inject unexpected parameters. While n8n's built-in Webhook authentication modes (Basic Auth, Header Auth, JWT) verify who is calling, they don't verify that the payload hasn't been altered, that the request is fresh, or that the data structure matches what you expect. This template adds those missing layers: - **Authentication** — Verifies the sender's identity through HMAC-SHA256 signature validation - **Integrity** — Ensures the payload hasn't been modified by signing the raw body byte-for-byte - **Replay protection** — Rejects requests with expired timestamps (configurable, default: 5 minutes) - **Payload sanitization** — Strict whitelist filtering blocks unauthorized fields before they reach your logic ## What this workflow does The workflow chains six security layers before any business logic runs: 1. **Webhook** receives the request with Header Auth + Raw Body enabled to preserve the original payload 2. **Extract rawBody** (Code node) decodes the binary into a UTF-8 string and extracts the security headers 3. **Crypto** computes the HMAC-SHA256 signature of `{timestamp}.{rawBody}` using your HMAC secret 4. **Timing-Safe HMAC Check** (Code node) validates the timestamp freshness and compares signatures using `crypto.timingSafeEqual()` 5. **Strict Payload Validation** (Code node) parses the JSON, checks required fields, and rejects any unexpected keys 6. **AI Agent** processes the prompt only after all checks pass Invalid requests are immediately rejected with `403 Forbidden` (signature/timestamp failure) or `400 Bad Request` (payload validation failure), with no response body to avoid leaking internal logic. ## Example use case The included example protects an AI Agent endpoint that expects a simple `{"prompt": "..."}` payload. But this is just a **starting point** — replace the AI Agent with any node and adapt the payload validation to your own schema. **Common adaptations:** * CRM or SaaS event callbacks * CRUD operations on a database * Third-party API integrations ## Setup ### Prerequisites - An n8n instance (Cloud or Self-hosted) - A shared HMAC secret between the sender and this workflow — **keep it safe and never expose it in workflow logs or execution data** ## Going further This workflow is a solid starting point — it's more secure than a raw exposed webhook. However, it focuses on application-level security (authentication, integrity, replay protection, payload sanitization). For a production-grade setup, consider adding layers at the **infrastructure level** : - **Rate limiting** - **IP whitelisting** - **Reverse proxy hardening**

View

Need Custom Automation?

Get help designing a custom n8n workflow that connects your stack and fits your process.

Automate cybersecurity incident response with Claude AI, VirusTotal and Slack

Workflow preview

Overview

How it works

Setup Steps

Sample Alert Payload

Features

Industries That Benefit

Prerequisites

Modification Options