Triage security alerts with AbuseIPDB, VirusTotal, ipinfo.io, OpenAI, and Slack
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 14 nodes and runs when an HTTP GET request hits its webhook URL. Along the way it connects OpenAI Chat Model.
How it runs
Trigger: When an HTTP GET request hits its webhook URL.
- Normalize Security Alert (Code): runs custom JavaScript code
- Fetch AbuseIPDB Data (HTTP Request): calls an HTTP API
- Fetch IP Geo Information (HTTP Request): calls an HTTP API
- Fetch VirusTotal File Data (HTTP Request): calls an HTTP API
- Consolidate Data Enrichment (Code): runs custom JavaScript code
- Security Triage Agent (AI Agent): runs an AI agent, with model: OpenAI Security Model
- Parse Triage Results (Code): runs custom JavaScript code
- Return Webhook Response (Respond to Webhook): sends the response back to the webhook caller
- Check Severity Level (If): checks a condition and branches into true / false
- Post to Slack Urgent Channel (HTTP Request): calls an HTTP API
…plus 2 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (7)
- Webhook
n8n-nodes-base.webhook - Code
n8n-nodes-base.code - HTTP Request
n8n-nodes-base.httpRequest - AI Agent
@n8n/n8n-nodes-langchain.agent - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - Respond to Webhook
n8n-nodes-base.respondToWebhook - If
n8n-nodes-base.if
From the author
Quick overview This workflow receives security alerts via a webhook, normalizes and enriches them with AbuseIPDB, ipinfo.io, and VirusTotal lookups, then uses OpenAI to generate a SOC-style triage (severity, summary, and actions) and routes urgent alerts to…