IP reputation check & SOC alerts with Splunk, VirusTotal and AlienVault

by Rajneesh Gupta · 2,509 views · created 2025-07-15 · SecOps

What this workflow does

This workflow has 12 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects ServiceNow, Slack and Gmail.

How it runs

Trigger: When an HTTP POST request hits its webhook URL.

1. Extract IOCs (Code): runs custom JavaScript code
2. VirusTotal IP reputation check (HTTP Request): calls an HTTP API (GET)
3. AlienVault Lookup (HTTP Request): calls an HTTP API (GET)
4. Merge: merges the data from its input branches
5. Process Intel Data (Code): runs custom JavaScript code
6. Generate IP Summary (Code): runs custom JavaScript code
7. IP summary display (HTML): parses or builds HTML
8. Filter Suspicious IPs (Switch): routes items into 1 branches
9. Gmail: uses Gmail
10. Create IP Incident (ServiceNow): create (incident)

…plus 1 more step. See the full node list below.

Services it uses

ServiceNowSlackGmail

Before you upgrade to n8n 3.0

Nodes used (9)

• HTTP Requestn8n-nodes-base.httpRequest
• HTMLn8n-nodes-base.html
• Coden8n-nodes-base.code
• Mergen8n-nodes-base.merge
• Switchn8n-nodes-base.switch
• ServiceNown8n-nodes-base.serviceNow
• Slackn8n-nodes-base.slack
• Gmailn8n-nodes-base.gmail
• Webhookn8n-nodes-base.webhook

From the author

IP Reputation Check & Threat Summary using Splunk + VirusTotal + AlienVault + n8n This workflow automates IP reputation analysis using Splunk alerts, enriches data via VirusTotal and AlienVault OTX, and generates actionable threat summaries for SOC teams —…

View the original on n8n.io → Check your own copy