IP Reputation Threat Analysis Workflow

This n8n workflow automates the process of analyzing and assessing the reputation of IP addresses from threat alerts. It begins by receiving alerts, extracting source IPs and threat reasons from Splunk, then querying VirusTotal and AlienVault for reputation and threat intelligence data. The workflow merges and summarizes this information, displaying a detailed threat report with tags, WHOIS data, and analysis stats. If an IP is flagged as suspicious, the workflow automatically creates a security incident in ServiceNow, sends Slack alerts, and emails a comprehensive HTML report to the SOC team. This automation helps security teams quickly identify, evaluate, and respond to potential threats, streamlining incident response and threat intelligence workflows.