Ransomware Containment Playbook

With this workflow, you get an importable n8n sub-workflow of twenty nodes that normalises the alert, evaluates whether encryption is still active on the host, and routes both "yes" and "unknown" toward containment because an unhandled unknown is where automation quietly stalls. It posts a decision summary to Slack and waits fifteen minutes for a human to authorise isolation. Decline, timeout and node failure all escalate loudly to a person; nothing dies silently in a queue. Host isolation ships mocked, so you can exercise every branch before the automation can touch a production machine.

It comes with a 26-page standard operating procedure rather than a README. Document control and revision history, numbered clauses, a RACI matrix, a full interface specification, a node register and field dictionary, a residual risk register, a validation test record with sign-off blocks, and a fault injection register. You can adopt it into your own document control, complete the approval table, and hand it to an auditor.

Requirements are n8n 1.x, a Slack app with chat:write scope, a publicly reachable webhook, and an upstream triage workflow to call it. An EDR API is optional at install and required before live use.

This workflow does not do detection engineering, forensics, or decide whether a breach is notifiable the procedure is explicit about what stays with a human, including the 72-hour notification clock under GDPR Article 33.