IP Reputation Check & SOC Alerts: Splunk, VirusTotal, AlienVault

This workflow ingests suspicious IP addresses from Splunk SIEM alerts via a webhook trigger. It performs comprehensive threat enrichment by querying VirusTotal for reputation scores, tags, and analysis stats, and AlienVault OTX for pulses, reputation, and WHOIS data. Data is merged, processed with custom function nodes for IOC extraction and intel summarization, and a rich HTML threat summary is generated for analyst review.

Conditional logic via Switch nodes routes actions based on severity: low-risk IPs get Slack notifications, medium-risk create ServiceNow incidents, and high-risk trigger formatted HTML email reports to the SOC inbox. This no-code automation streamlines threat validation, reduces manual research time, and ensures rapid escalation.

Ideal for security operations centers (SOCs) handling SIEM logs, it provides quick multi-source context on IPs, enabling faster incident response. Benefits include centralized threat intel aggregation, customizable alerting, and integration with enterprise tools like Splunk, ServiceNow, Slack, and Gmail—saving hours of analyst effort daily.