Enrich and route Splunk security alerts via AbuseIPDB, email, and Telegram

by Paolo Ronco ✓ · 3 views · created 2026-09-24 · SecOps, AI Summarization

What this workflow does

This workflow has 28 nodes and runs manually, when you click “Execute workflow” (plus 2 other triggers). Along the way it connects Telegram. It also calls api.abuseipdb.com over HTTP.

How it runs

Trigger: Manually, when you click “Execute workflow” (plus 2 other triggers).

1. Initialize Incident Data Table (Data table): create (table)
2. Normalize Splunk Alert Payload (Code): runs custom JavaScript code
3. Fetch Incidents from Last 24 Hours (Data table): get
4. Filter: keeps only the items that match a condition
5. Build Daily Security Digest (Code): runs custom JavaScript code
6. Generate Alert Fingerprint (Code): runs custom JavaScript code
7. Send Daily Security Digest (Send Email): sends an email over SMTP
8. Get Latest Matching Incident (Data table): get
9. Evaluate Deduplication Time Window (Code): runs custom JavaScript code
10. If: checks a condition and branches into true / false

…plus 14 more steps. See the full node list below.

Services it uses

Telegram

HTTP calls to: api.abuseipdb.com

Before you upgrade to n8n 3.0

Nodes used (11)

• Manual Triggern8n-nodes-base.manualTrigger
• Data tablen8n-nodes-base.dataTable
• Webhookn8n-nodes-base.webhook
• Coden8n-nodes-base.code
• Filtern8n-nodes-base.filter
• Ifn8n-nodes-base.if
• HTTP Requestn8n-nodes-base.httpRequest
• No Operation, do nothingn8n-nodes-base.noOp
• Send Emailn8n-nodes-base.emailSend
• Telegramn8n-nodes-base.telegram
• Schedule Triggern8n-nodes-base.scheduleTrigger

From the author

Quick overview This workflow ingests Splunk security alerts via webhook, normalizes and deduplicates them using an n8n Data Table, enriches public source IPs with AbuseIPDB reputation data, calculates a risk score, and sends severity-based notifications via…

View the original on n8n.io → Check your own copy