Malicious file detection & response: Wazuh to VirusTotal with Slack alerts
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 9 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Gmail, ServiceNow and Slack.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Extract IOCs (Code): runs custom JavaScript code
- VirusTotal File Hash Validation (HTTP Request): calls an HTTP API (GET)
- Generate File Summary (Code): runs custom JavaScript code
- file summary display (HTML): parses or builds HTML
- Filter Suspicious Files (Switch): routes items into 1 branches
- Gmail: uses Gmail
- Slack: uses Slack
- Create File Incident (ServiceNow): create (incident)
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (8)
- HTML
n8n-nodes-base.html - Gmail
n8n-nodes-base.gmail - Webhook
n8n-nodes-base.webhook - Code
n8n-nodes-base.code - Switch
n8n-nodes-base.switch - ServiceNow
n8n-nodes-base.serviceNow - Slack
n8n-nodes-base.slack - HTTP Request
n8n-nodes-base.httpRequest
From the author
Malicious File Detection & Threat Summary Automation using Wazuh + VirusTotal + n8n This workflow helps SOC teams automate the detection and reporting of potentially malicious files using Wazuh alerts, VirusTotal hash validation, and integrated summary/report…