Automated Threat Detection and Alert System for SOC

This n8n workflow automates the detection and analysis of security threats within a Security Operations Center (SOC). It begins with a webhook trigger receiving security event data, filters critical or high-severity events, and intelligently extracts relevant indicators like hashes, domains, or IP addresses from the event data. These indicators are then checked against VirusTotal’s API to gather reputation information, helping determine if an event is malicious or suspicious. An integrated AI agent analyzes the event log and VirusTotal data to generate a concise incident summary, risk level, and recommended mitigation steps. The workflow concludes by sending detailed alerts via Telegram, providing SOC teams with real-time, actionable intelligence to respond swiftly to security threats.