Automates Sophos Central security alert analysis by filtering high-severity events, enriching with VirusTotal, and using Gemini AI for threat summaries and mitigation plans sent via Telegram.
This workflow streamlines security operations by ingesting alerts from Sophos Central via a webhook (fed by an external Python SIEM integration script). It filters for high or critical severity events to eliminate noise, extracts key indicators like file hashes, URLs, or IPs, and queries VirusTotal for reputation data including vendor flags.
Next, it processes VirusTotal results into a readable format and feeds the full dataset—Sophos logs, alerts, and VT intel—into Google Gemini AI. The AI gen
Platform
n8n
Category
Health & Fitness
Price
$24.99
Creator
QualityWorkflows
security
sophos
virustotal
gemini
ai
threat-analysis
siem
automation
telegram
soc
How to import this workflow into n8n
1Purchase or download the workflow to get the n8n workflow JSON file.
2In your n8n instance, open Workflows and choose "Import from File" (or paste the JSON with Ctrl+V on the canvas).
3Open each node marked with a credential warning and connect your own accounts and API keys.
4Run the workflow once manually to verify the data flow, then toggle it to Active.