The Engine: What is n8n?

n8n is a "Fair-Code" workflow automation platform that is specifically favoured by technical teams and Security Engineers. Think of it as the "Swiss Army Knife" for SOC automation.

Why I chose n8n for this SOAR Project:

• Node-Based Visual Logic: It allows for complex, multi-branching workflows that mimic real-world SOC decision-making. If one tool fails or returns a specific result, the workflow can "branch" and take a different path, something linear tools struggle with.
• Self-Hostable & Secure: Unlike many SaaS platforms, n8n can be self-hosted. For a cybersecurity professional, this is critical because it ensures that sensitive data (like internal IP addresses or API keys) stays within your own controlled environment.
• The "Low-Code" Advantage: It strikes a perfect balance between speed and power. While it has a drag-and-drop interface, it also allows me to inject JavaScript/Python code nodes whenever I need to perform complex data parsing or custom logic.
• Deep API Integration: Using the HTTP Request node, I can connect to virtually any security tool with an API, even if a pre-built connector doesn't exist. This allowed me to seamlessly integrate VirusTotal, AlienVault, and urlscan.io into a single pane of glass.

Technical Architecture & Impact

Step 1: Google Sheets Trigger

The first node that will be added is the Google sheets trigger that triggers whenever a new row has been added.

In this node, you can modify the poll times, which determines the time interval between each time the google sheet is being checked for a new row being added.

Steps 2 & 3: Initial OSINT Enrichment

urlscan.io Scanning

We will then connect the urlscan.io node, to the Google Sheets trigger, where it will perform a scan based on the URL, which is the IP address added into the google sheets row.

Note: We can simply drag the “input URL/IP” field from our google sheets trigger and place it in the URL field.

VirusTotal Integration

Connect the VirusTotal node, to the Google Sheets trigger, where it will perform a scan based on the URL, which is the IP address added into the google sheets row.

Note: We can simply drag the “input URL/IP” field from our google sheets trigger and place it in the URL field.

Step 4: AlienVault OTX

We will then connect the AlienVault node, to the Google Sheets trigger, where it will perform a scan based on the URL, which is the IP address added into the google sheets row.

Note: We can simply drag the “input URL/IP” field from our google sheets trigger and place it in the URL field.

Steps 5 & 6: Merging Data Streams

Since we need to combine all the data collected from the 3 nodes, we will add a merge node as each node can only take an input from 1 node, while a merge node can take input from 2.

Merge 1

Merge 1 will combine VT and urlscan.io as demonstrated below. ]

Merge 2

Merge 2 will combine merge 1 and AlienVault as demonstrated below.

Step 7: AI Synthesis

Add a LLM chain node, where we will enter our prompt to the AI to give us our desired output using key pieces of data collected from the Threat Intelligence Platforms. [a: 51]

This LLM chain node is also connected to a “google gemini chat model”, which is the brains that do the analysis and thinking of the prompt that was given in the LLM chain node.

Sample Prompt:

“You are a Senior SOC Analyst. Analyze the following indicators:
VirusTotal Score: {{ $node["VirusTotal"].json["data"]["attributes"]["last_analysis_stats"]["malicious"] }} / {{ $node["VirusTotal"].json["data"]["attributes"]["last_analysis_stats"]["harmless"] }}{{ $('VirusTotal').item.json.data.attributes.reputation }}
AlienVault Pulses: {{ $('AlienVault HTTP Request').item.json.pulse_info.count }} {{ $('AlienVault HTTP Request').item.json.pulse_info.pulses }} 
urlscan.io Verdict: {{ $('urlscan.io').item.json.result }} 
ASN/Country: {{ $json.data.attributes.asn }} 

Provide your response in valid JSON with these fields: 
analysis: A 1-sentence technical summary. 
verdict: (Benign, Suspicious, or Malicious) 
confidence: A percentage (0-100%) based on how much the tools agree.
reasoning: Explain why you gave that confidence score, including Virustotal, urlscan.io, and data from otx, including the otx pulses and mention in brief what known threat actors is it linked to if available."
            

Step 8: Updating the Google Sheet

Finally, we will add an “update sheet” google sheet. This node places all the new data collected to the columns from our choosing.

Simply add columns on the google sheets, and you will see them in the node.

To enter an exact value, drag from the input section the field you want to be displayed in a specific column as demonstrated in the screenshot below.

End Product

Based on the values we added on the “merge 2” node, we can finally see the google sheets auto update with the ingested data after the automation was automatically triggered when an IP and date were added into a new row.