Phishing analysis - URLScan.io and VirusTotal

by n8n Team ✓ · 81,218 views · created 2023-11-27 · SecOps

What this workflow does

This workflow has 16 nodes and runs on a schedule (every day) (plus 1 other trigger). Along the way it connects Slack and Microsoft Outlook. It also calls virustotal.com over HTTP.

How it runs

Trigger: On a schedule (every day) (plus 1 other trigger).

1. Get all unread messages (Microsoft Outlook): get many
2. Mark as read (Microsoft Outlook): update
3. Split In Batches (Loop Over Items (Split in Batches)): loops over the items in batches
4. Find indicators of compromise (Code): runs custom Python code
5. Not empty? (Filter): keeps only the items that match a condition
6. Has URL? (If): checks a condition and branches into true / false
7. sends slack message (Slack): uses Slack
8. URLScan: Scan URL (urlscan.io): uses urlscan.io
9. VirusTotal: Scan URL (HTTP Request): calls virustotal.com (POST)
10. No error? (If): checks a condition and branches into true / false

…plus 4 more steps. See the full node list below.

Services it uses

SlackMicrosoft Outlook

HTTP calls to: virustotal.com

Before you upgrade to n8n 3.0

Nodes used (12)

• Manual Triggern8n-nodes-base.manualTrigger
• Slackn8n-nodes-base.slack
• Loop Over Items (Split in Batches)n8n-nodes-base.splitInBatches
• Microsoft Outlookn8n-nodes-base.microsoftOutlook
• HTTP Requestn8n-nodes-base.httpRequest
• Schedule Triggern8n-nodes-base.scheduleTrigger
• Coden8n-nodes-base.code
• urlscan.ion8n-nodes-base.urlScanIo
• Ifn8n-nodes-base.if
• Filtern8n-nodes-base.filter
• Waitn8n-nodes-base.wait
• Mergen8n-nodes-base.merge

From the author

This n8n workflow automates the analysis of email messages received in a Microsoft Outlook inbox to identify indicators of compromise (IOCs), specifically suspicious URLs. It can be triggered manually or scheduled to run daily at midnight. The workflow begins…

View the original on n8n.io → Check your own copy