The flow
Starts it 2Model 2Logic 6Service 9
The steps in the order they run, from what starts it.
- 1Receive Security AlertWebhookStarts it
- 2Claude AI ModelLm Chat AnthropicModel
- 3Normalize and Validate AlertCodeLogic
- 4Assess Severity with Claude AIAgentModel
- 5Check IP on VirusTotalHttp RequestService
- 6Check IP on AbuseIPDBHttp RequestService
- 7Lookup Host on ShodanHttp RequestService
- 8Parse AI AssessmentCodeLogic
- 9Merge Threat IntelligenceMergeLogic
- 10Check Severity for Auto-ContainmentIfLogic
- 11Combine Enrichment DataCodeLogic
- 12Block Malicious IP on FirewallHttp RequestService
- 13Isolate Affected Host via EDRHttp RequestService
- 14Revoke User Tokens and SessionsHttp RequestService
- 15Notify SOC Team on SlackHttp RequestService
- 16Create Incident Ticket in JiraHttp RequestService
- 17Build Final Incident ReportCodeLogic
- 18Write Compliance Audit LogGoogle SheetsService
- 19Send Incident Response to CallerRespond To WebhookStarts it
How it's built
- Starts on
- Another system calling it
- Steps
- 19, with 1 branch
- Size
- Medium: a working afternoon
- Connects to
- Google Sheets
- Model
- Claude
Questions
What does it need to run?
An n8n account, plus your own Google Sheets account, and a key for Claude. You connect your own accounts after importing it; none are included.
What starts it?
It starts on another system calling it.
Does it use AI?
Yes. It calls Claude. Model calls are billed by the provider, not by n8n.
How long does it take to set up?
Plan an afternoon. 19 steps is enough that you should read each one before running it.
How do I import it?
Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.
Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 19 steps before you point it at anything that matters.