IP Reputation Check & SOC Alerts: Splunk, VirusTotal, AlienVault

This workflow ingests suspicious IP addresses from Splunk SIEM alerts via a webhook trigger. It performs comprehensive threat enrichment by querying VirusTotal for reputation scores, tags, and analysis stats, and AlienVault OTX for pulses, reputation, and WHOIS data. Data is merged, processed with custom function nodes for IOC extraction and intel summarization, and a rich HTML threat summary is generated for analyst review. Conditional logic via Switch nodes routes actions based on severity: l