IP reputation check & SOC alerts with Splunk, VirusTotal and AlienVault

IP Reputation Check & Threat Summary using Splunk + VirusTotal + AlienVault + n8n

This workflow automates IP reputation analysis using Splunk alerts, enriches data via VirusTotal and AlienVault OTX, and generates actionable threat summaries for SOC teams — all without any coding.

---

What It Does

When a Splunk alert contains a suspicious IP:

- Ingests the IP from the Splunk alert via webhook. - Performs dual threat enrichment using: - VirusTotal IP reputation & tags. - AlienVault OTX pulses, reputation & WHOIS. - Merges & processes threat intel data. - Generates a rich HTML summary for analyst review. - Routes action based on severity: - Sends Slack alert for suspicious IPs. - Creates an incident in ServiceNow. - Emails a formatted HTML report to the SOC inbox.

---

Tech Stack Used