Integrate Malware Analysis Workflow To Your Security Solution

Overview:

This n8n workflow automates end to end malware triage. It submits a file or hash either manually through a form or automatically via a SIEM/EDR webhook, deduplicates repeat submissions, detonates uploaded files through threat inteligence (polling until the sandbox analysis completes) or looks up an existing report for a known hash, then hands the file report and behavioral summary to an AI triage agent equipped with threat intelligence tools so it can pivot on any IOCs it finds before returning a structured verdict (verdict, confidence, summary, MITRE ATT&CK techniques, and recommended actions); anything non-benign automatically opens a Jira case and posts a verdict summary to Slack, while benign results are logged and closed out with no manual ticket work required.

Required credentials

• VirusTotal API Key (Header Auth, x-apikey)
• AbuseIPDB API Key (Header Auth, Key)
• OpenAI account (swappable to Ollama — model node is a drop-in replacement)
• Jira account (Jira Software Cloud API)

Slack account (Slack API)