Automation library · Alerts and monitoring

Triage AWS security posture changes with Claude and Slack

Started by a clock, and works across Email, Slack and WhatsApp. It hands the judgement calls to Claude. 28 steps, 3 branches, 4 loops or waits: large, and worth reading before you trust it with anything live.

LargeCalls a model: Claude

Download free
28 stepsLarge: read it before trusting it with anything live
3Branches: places the flow splits
4Loops or waits
3Services it connects to

The flow

Starts it 2Model 2Logic 18Service 6

The steps in the order they run, from what starts it.

  1. 1Schedule Security Findings CheckSchedule triggerStarts it
  2. 2Manual Trigger for TestingManual triggerStarts it
  3. 3Claude Model for Security AnalysisLm Chat AnthropicModel
  4. 4Set AWS Configuration ParamsSetLogic
  5. 5Analyze Security ImpactAgentModel
  6. 6Wait Before Fetching FindingsWaitLogic
  7. 7Evaluate Security Analysis ResultsCodeLogic
  8. 8Simulate Security Findings DataCodeLogic
  9. 9Decide Based on Risk SeveritySwitchLogic
  10. 10Identify Changes in FindingsCodeLogic
  11. 11Pause for Manager ApprovalWaitLogic
  12. 12Inform Slack for ReviewSlackService
  13. 13Check Changes in FindingsIfLogic
  14. 14Verify Sign-Off StatusIfLogic
  15. 15Simulate Posture Record UpdateCodeLogic
  16. 16Simulate Asset Inventory DataCodeLogic
  17. 17Terminate Workflow if UnchangedNo OpLogic
  18. 18Mark as Rejection ConfirmedSetLogic
  19. 19Simulate Compliance Audit LogCodeLogic
  20. 20Merge Security and Asset DetailsCodeLogic
  21. 21Alert Slack on RejectionSlackService
  22. 22Wait Before Final NotificationsWaitLogic
  23. 23Wait Before AI AnalysisWaitLogic
  24. 24Notify SecOps via SlackSlackService
  25. 25Notify Compliance via SlackSlackService
  26. 26Send Email Security SummaryEmail SendService
  27. 27Send WhatsApp Security AlertWhats AppService
  28. 28Save Security Baseline DataCodeLogic

How it's built

Starts on
A clock
Steps
28, with 3 branches, 4 loops or waits
Size
Large: read it before trusting it with anything live
Connects to
Email, Slack, WhatsApp
Model
Claude

Questions

What does it need to run?

An n8n account, plus your own Email, Slack and WhatsApp accounts, and a key for Claude. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

Yes. It calls Claude. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Take your time. At 28 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 28 steps before you point it at anything that matters.