# Deduplicate security alerts into unified cases with Claude: n8n workflow

> Started by another system calling it, and works across Slack. It hands the judgement calls to Claude.

Source: https://millionrounds.com/workflow/deduplicate-security-alerts-into-unified-cases-with-claude (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Alerts and monitoring](https://millionrounds.com/workflows?category=Alerts+and+monitoring#library)

# Deduplicate security alerts into unified cases with Claude

Started by another system calling it, and works across Slack. It hands the judgement calls to Claude. 20 steps, 1 branch: a working afternoon to understand properly.

Medium Calls a model: Claude

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fdeduplicate-security-alerts-into-unified-cases-with-claude)

**20 steps** Medium: a working afternoon

**1** Branch: places the flow splits

**0** Loops or waits

**1** Service it connects to

## The flow

Starts it 4 Model 2 Logic 10 Service 4

The steps in the order they run, from what starts it.

- 1 **When SIEM Alert Received** Webhook *Starts it*
- 2 **When EDR Alert Received** Webhook *Starts it*
- 3 **When Cloud Alert Received** Webhook *Starts it*
- 4 **Every Batch Processing Window** Schedule trigger *Starts it*
- 5 **Claude Clustering Model** Lm Chat Anthropic *Model*
- 6 **Normalize SIEM Alert** Code *Logic*
- 7 **Normalize EDR Alert** Code *Logic*
- 8 **Normalize Cloud Alert** Code *Logic*
- 9 **Fetch Buffered Alerts** Http Request *Service*
- 10 **AI Semantic Clustering Agent** Agent *Model*
- 11 **Merge Normalized Alerts** Merge *Logic*
- 12 **Pre-Cluster Alerts** Code *Logic*
- 13 **Apply AI Cluster Resolution** Code *Logic*
- 14 **Post Alert to Buffer** Http Request *Service*
- 15 **Check for Ambiguous Clusters** If *Logic*
- 16 **Merge Cluster Results** Merge *Logic*
- 17 **Pass Clear Clusters** Code *Logic*
- 18 **Build Security Cases** Code *Logic*
- 19 **Post to Ticket System API** Http Request *Service*
- 20 **Send Slack Notification** Slack *Service*

## How it's built

- **Starts on:** Another system calling it
- **Steps:** 20, with 1 branch
- **Size:** Medium: a working afternoon
- **Connects to:** Slack
- **Model:** Claude

## Questions

What does it need to run?

An n8n account, plus your own Slack account, and a key for Claude. You connect your own accounts after importing it; none are included.

What starts it?

It starts on another system calling it.

Does it use AI?

Yes. It calls Claude. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Plan an afternoon. 20 steps is enough that you should read each one before running it.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 20 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fdeduplicate-security-alerts-into-unified-cases-with-claude)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Slack](https://millionrounds.com/workflows?service=Slack#library)

## Workflows like it

Also alerts and monitoring, with the same services where possible, closest in size first.

- [**Automate peer review assignments with Slack** 20 steps · calls a model · Email, Postgres](https://millionrounds.com/workflow/automate-peer-review-assignments-with-slack)
- [**Monitor NASA asteroid threats with OpenAI and Apify** 20 steps · calls a model · Apify, Discord](https://millionrounds.com/workflow/monitor-nasa-asteroid-threats-with-openai-and-apify)
- [**Monitor and auto-heal failed n8n workflow executions** 20 steps · calls a model · Google Sheets, Slack](https://millionrounds.com/workflow/monitor-and-auto-heal-failed-n8n-workflow-executions)
- [**Monitor programme performance and governance with OpenAI** 20 steps · calls a model · Email, Slack](https://millionrounds.com/workflow/monitor-programme-performance-and-governance-with-openai)
- [**Real-time oil price crisis detection with Qwq-32b AI** 20 steps · calls a model · Gmail, Postgres](https://millionrounds.com/workflow/real-time-oil-price-crisis-detection-with-qwq-32b-ai)
- [**Track contract utilization and send risk alerts with Groq** 20 steps · calls a model · Gmail, Google Sheets](https://millionrounds.com/workflow/track-contract-utilization-and-send-risk-alerts-with-groq)