Automated security alert analysis with Sophos, Gemini AI, and VirusTotal
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 9 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Google Gemini Chat Model and Telegram.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- If: checks a condition and branches into true / false
- Code: runs custom JavaScript code
- Virus_Total (HTTP Request): calls an HTTP API
- For_Gemini_Prompt (Code): runs custom JavaScript code
- AI Agent: runs an AI agent, with model: Google Gemini Chat Model; memory: Simple Memory
- Send a text message (Telegram): uses Telegram
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (8)
- Webhook
n8n-nodes-base.webhook - If
n8n-nodes-base.if - Google Gemini Chat Model
@n8n/n8n-nodes-langchain.lmChatGoogleGemini - Telegram
n8n-nodes-base.telegram - Code
n8n-nodes-base.code - AI Agent
@n8n/n8n-nodes-langchain.agent - HTTP Request
n8n-nodes-base.httpRequest - Simple Memory
@n8n/n8n-nodes-langchain.memoryBufferWindow
From the author
How It Works This workflow automates the analysis of security alerts from Sophos Central, turning raw events into actionable intelligence. It uses the official Sophos SIEM integration tool to fetch data, enriches it with VirusTotal, and leverages Google…