Malicious File Detection: Wazuh to VirusTotal + Slack Alerts

This n8n workflow streamlines SOC operations by ingesting Wazuh alerts on potential malicious files via a webhook, extracting key IOCs like SHA256/MD5 hashes and filenames using Function nodes, and querying VirusTotal's API for real-time reputation checks.

It then generates a structured, human-readable threat summary and employs If/Switch logic to route actions: always sending a Gmail email with details, while escalating high-threat files by creating incident tickets and firing urgent Slack alerts to the team. This eliminates manual triage delays, providing instant context and reducing false positives through enriched intelligence.

Ideal for security teams handling file-based threats, it saves hours per incident by automating validation, reporting, and escalation. Benefits include faster response times, centralized alerting, and scalable threat hunting without custom coding, leveraging proven integrations for reliable performance in production environments.

Tech stack: Wazuh for detection, VirusTotal for intel, n8n orchestration, Slack/Gmail for comms, and incident tools for ticketing. Perfect for IT/security pros seeking zero-touch file threat automation.