Automation library · Alerts and monitoring

Triage data exfiltration volume alerts with Splunk

Started by a clock, and works across Gmail and Slack. It hands the judgement calls to DeepSeek. 22 steps, 2 branches, 3 loops or waits: large, and worth reading before you trust it with anything live.

LargeCalls a model: DeepSeek

Download free
22 stepsLarge: read it before trusting it with anything live
2Branches: places the flow splits
3Loops or waits
2Services it connects to

The flow

Starts it 1Model 4Logic 8Service 9

The steps in the order they run, from what starts it.

  1. 1Scan For Outbound Volume SpikesSchedule triggerStarts it
  2. 2DeepSeek Chat ModelLm Chat Deep SeekModel
  3. 3DeepSeek Fixer ModelLm Chat Deep SeekModel
  4. 4Create Outbound Volume Search JobSplunkService
  5. 5Assess Exfiltration RiskAgentModel
  6. 6Parse Risk VerdictOutput Parser StructuredModel
  7. 7Wait Before Checking JobWaitLogic
  8. 8Log Async FailureNo OpLogic
  9. 9Route By Risk VerdictSwitchLogic
  10. 10Check Search Job StatusSplunkService
  11. 11Prepare High-Risk AlertsNo OpLogic
  12. 12Notify SOC - Medium-Risk Exfil PatternSlackService
  13. 13Log Low-Risk to Audit ChannelSlackService
  14. 14IF Search Job CompleteIfLogic
  15. 15Alert SOC - High-Risk Exfil PatternSlackService
  16. 16Email Security Lead - High-Risk Exfil AlertGmailService
  17. 17Get Flagged Exfil Volume ResultsSplunkService
  18. 18Wait To Retry Job StatusWaitLogic
  19. 19Create User Context Search JobSplunkService
  20. 20Wait For Context Search JobWaitLogic
  21. 21Get User Context Search ResultsSplunkService
  22. 22Build AI Triage ContextCodeLogic

How it's built

Starts on
A clock
Steps
22, with 2 branches, 3 loops or waits
Size
Large: read it before trusting it with anything live
Connects to
Gmail, Slack
Model
DeepSeek

Questions

What does it need to run?

An n8n account, plus your own Gmail and Slack accounts, and a key for DeepSeek. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

Yes. It calls DeepSeek. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Take your time. At 22 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 22 steps before you point it at anything that matters.