Automate cybersecurity incident response with Claude AI, VirusTotal and Slack
Needs changesWhat this workflow does
This AI workflow has 19 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Anthropic Chat Model and Google Sheets. It also calls api.abuseipdb.com and slack.com over HTTP.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Normalize and Validate Alert (Code): runs custom JavaScript code
- Check IP on VirusTotal (HTTP Request): calls an HTTP API
- Check IP on AbuseIPDB (HTTP Request): calls api.abuseipdb.com
- Lookup Host on Shodan (HTTP Request): calls an HTTP API
- Merge: merges the data from its input branches
- Combine Enrichment Data (Code): runs custom JavaScript code
- Assess Severity with Claude AI (AI Agent): runs an AI agent, with model: Claude AI Model
- Parse AI Assessment (Code): runs custom JavaScript code
- Check Severity for Auto-Containment (If): checks a condition and branches into true / false
- Block Malicious IP on Firewall (HTTP Request): calls an HTTP API (POST)
…plus 7 more steps. See the full node list below.
Services it uses
HTTP calls to: api.abuseipdb.com, slack.com
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- AI Agent v1 (old agent modes) in Assess Severity with Claude AI (v1.6): replace with Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent.
Rather not rewrite it? Many of these flows can be rebuilt in Make (free plan).
| Removed in 3.0 | Replace with |
|---|---|
| AI Agent v1 (old agent modes) Assess Severity with Claude AI (v1.6) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Nodes used (9)
- Webhook
n8n-nodes-base.webhook - Code
n8n-nodes-base.code - HTTP Request
n8n-nodes-base.httpRequest - Merge
n8n-nodes-base.merge - AI Agent
@n8n/n8n-nodes-langchain.agent - Anthropic Chat Model
@n8n/n8n-nodes-langchain.lmChatAnthropic - If
n8n-nodes-base.if - Google Sheets
n8n-nodes-base.googleSheets - Respond to Webhook
n8n-nodes-base.respondToWebhook
From the author
This workflow automates end-to-end cybersecurity incident response by ingesting alerts from multiple sources, enriching threat intelligence, assessing severity with Claude AI, executing containment actions, notifying stakeholders, and creating audit-ready…