IP reputation check & SOC alerts with Splunk, VirusTotal and AlienVault

IP Reputation Check & Threat Summary using Splunk + VirusTotal + AlienVault + n8n

This workflow automates IP reputation analysis using Splunk alerts, enriches data via VirusTotal and AlienVault OTX, and generates actionable threat summaries for SOC teams — all without any coding.

What It Does

When a Splunk alert contains a suspicious IP:

• Ingests the IP from the Splunk alert via webhook.
• Performs dual threat enrichment using:
  • VirusTotal IP reputation & tags.
  • AlienVault OTX pulses, reputation & WHOIS.
• Merges & processes threat intel data.
• Generates a rich HTML summary for analyst review.
• Routes action based on severity:
  • Sends Slack alert for suspicious IPs.
  • Creates an incident in ServiceNow.
  • Emails a formatted HTML report to the SOC inbox.

Tech Stack Used

• Splunk – SIEM alert source
• VirusTotal API – Reputation check & analysis stats
• AlienVault OTX API – Community threat intel & pulse info
• n8n – For orchestration, merging, summary generation
• Slack, Gmail, ServiceNow – For SOC notifications and ticketing

Ideal Use Case

Perfect for security teams wanting to:

• Automatically validate IP reputation from SIEM logs
• Get quick context from multiple threat feeds
• Generate email-ready reports and escalate high-risk IPs

Included Nodes

• Webhook (Splunk)
• Function nodes for IOC extraction and intel processing
• HTTP Request (VirusTotal & AlienVault)
• Merge + Switch nodes for conditional logic
• Gmail, Slack, ServiceNow integration

Tips

• Add your VirusTotal and AlienVault credentials in n8n's credential manager.
• Use the Switch node to route based on your internal threat score logic.
• Easily extend this to include AbuseIPDB or GreyNoise for deeper enrichment.