Check file hash reputation with VirusTotal and Slack alerts
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 12 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Slack.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Normalize Hash from Webhook (Edit Fields (Set)): sets 1 field: hash
- If: checks a condition and branches into true / false
- HTTP - VirusTotal Hash Lookup (HTTP Request): calls an HTTP API (GET)
- Respond - Invalid Hash (Respond to Webhook): sends the response back to the webhook caller
- If: checks a condition and branches into true / false
- Function - Calculate Verdict (Code): runs custom JavaScript code
- Respond - Unknown Hash (Respond to Webhook): sends the response back to the webhook caller
- If: checks a condition and branches into true / false
- Slack: uses Slack
- Respond - Clean or Unknown (Respond to Webhook): sends the response back to the webhook caller
…plus 1 more step. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (7)
- Webhook
n8n-nodes-base.webhook - Respond to Webhook
n8n-nodes-base.respondToWebhook - Slack
n8n-nodes-base.slack - If
n8n-nodes-base.if - Code
n8n-nodes-base.code - HTTP Request
n8n-nodes-base.httpRequest - Edit Fields (Set)
n8n-nodes-base.set
From the author
🧩 Template Description File Hash Reputation Checker is a security automation workflow that validates file hashes (MD5, SHA1, SHA256) and checks their reputation using the VirusTotal API. It is designed for SOC teams, security engineers, and automation…