Detect and isolate ransomware with Claude (Anthropic), EDR, SIEM and Slack
Needs changesWhat this workflow does
This AI workflow has 21 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Anthropic Chat Model, Slack and Google Sheets. It also calls events.pagerduty.com over HTTP.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Aggregate File Operations (30s Window) (Code): runs custom JavaScript code
- Wait: pauses until webhook
- Claude AI Ransomware Threat Analysis (AI Agent): runs an AI agent, with model: Claude AI Model
- Parse AI Threat Assessment (Code): runs custom JavaScript code
- Threat Score >= 75? (Auto-Isolate Threshold) (If): checks a condition and branches into true / false
- Confirm Isolation Required (If): checks a condition and branches into true / false
- Enhanced Monitoring Mode (Code): runs custom JavaScript code
- Capture Forensic Snapshot (HTTP Request): calls an HTTP API (POST)
- Notify SOC — Monitoring Alert (Slack): work with channel
- Execute System Isolation (HTTP Request): calls an HTTP API (POST)
…plus 9 more steps. See the full node list below.
Services it uses
HTTP calls to: events.pagerduty.com
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- AI Agent v1 (old agent modes) in Claude AI Ransomware Threat Analysis (v1.6): replace with Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent.
Rather not rewrite it? Many of these flows can be rebuilt in Make (free plan).
| Removed in 3.0 | Replace with |
|---|---|
| AI Agent v1 (old agent modes) Claude AI Ransomware Threat Analysis (v1.6) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Nodes used (11)
- Webhook
n8n-nodes-base.webhook - Code
n8n-nodes-base.code - Wait
n8n-nodes-base.wait - AI Agent
@n8n/n8n-nodes-langchain.agent - Anthropic Chat Model
@n8n/n8n-nodes-langchain.lmChatAnthropic - If
n8n-nodes-base.if - HTTP Request
n8n-nodes-base.httpRequest - Slack
n8n-nodes-base.slack - Send Email
n8n-nodes-base.emailSend - Google Sheets
n8n-nodes-base.googleSheets - Respond to Webhook
n8n-nodes-base.respondToWebhook
From the author
This workflow provides real-time detection of ransomware encryption patterns using Claude AI, with automated system isolation and incident response. How it works 1. File System Monitoring - Continuously monitors file operations (create, modify, rename,…