Automated Security Alert Analysis with Sophos Gemini AI and VirusTotal

This n8n workflow automates the analysis of security alerts by leveraging Sophos Gemini AI for intelligent threat assessment and VirusTotal for comprehensive malware scanning. It streamlines the process of investigating suspicious files, providing a quick and informed response to potential threats.

What it does

This workflow simplifies and automates the following steps:

1. Receives Security Alerts: Listens for incoming security alerts via a webhook, expecting a JSON payload containing details about a suspicious file, including its hash.
2. Extracts File Hash: Extracts the file hash (SHA256) from the incoming alert payload.
3. Initial AI Assessment (Sophos Gemini): Sends the file hash to a Sophos Gemini AI Agent for an initial threat assessment. The AI agent provides an analysis and recommendation based on its knowledge.
4. VirusTotal Scan (Conditional): If the AI agent's assessment indicates a potential threat or requires further investigation, the workflow proceeds to scan the file hash with VirusTotal.
5. Analyzes VirusTotal Report: Processes the VirusTotal report to determine the detection rate and gather additional threat intelligence.
6. Conditional Alerting:
   • If VirusTotal reports a high detection rate (e.g., > 10 detections), a critical alert is sent to a Telegram channel, including the AI assessment, VirusTotal link, and detection details.
   • If VirusTotal reports a low detection rate (e.g., <= 10 detections) or if the AI assessment was inconclusive but not critical, a less severe alert is sent to Telegram, indicating the findings.
   • If the AI agent determines the file is benign and no VirusTotal scan is triggered, a confirmation message is sent to Telegram.
7. Sends Notifications: Delivers detailed security alerts and analysis summaries to a designated Telegram channel.

Prerequisites/Requirements

To use this workflow, you will need:

• n8n Instance: A running n8n instance.
• Webhook: An endpoint configured to send security alert payloads to the n8n webhook.
• Sophos Gemini AI Agent: Access to a Sophos Gemini AI Agent configured within n8n (via the AI Agent and Google Gemini Chat Model nodes). This requires appropriate credentials for Google Gemini.
• VirusTotal API Key: A VirusTotal API key for scanning file hashes. This will be configured as an HTTP Request credential.
• Telegram Bot Token: A Telegram Bot Token and Chat ID to send notifications. This will be configured as a Telegram credential.

Setup/Usage

1. Import the Workflow: Import the provided JSON into your n8n instance.
2. Configure Webhook:
   • Activate the "Webhook" trigger node.
   • Copy the generated webhook URL. This URL will be used by your security alert system to send payloads to n8n.
3. Configure Credentials:
   • Google Gemini Chat Model: Configure the "Google Gemini Chat Model" node with your Google Gemini credentials.
   • VirusTotal API Key: Create an HTTP Request credential for VirusTotal, including your API key.
   • Telegram: Configure the "Telegram" node with your Telegram Bot Token and the Chat ID where you want to receive alerts.
4. Customize Logic (Optional):
   • Adjust the conditions in the "If" nodes (e.g., the VirusTotal detection threshold) to match your organization's security policies.
   • Modify the messages sent by the "Telegram" nodes to include more specific details or formatting.
5. Activate the Workflow: Once all credentials and configurations are set, activate the workflow.

Now, whenever a security alert is sent to the webhook, the workflow will automatically analyze the suspicious file and notify you via Telegram.