SECURITY AUTOMATION • N8N • SPLUNK • WEBHOOKS • SOAR

Security Automation & Automated Incident Triage

Automated SOC alert ingestion, validation, severity routing, incident enrichment, Splunk HEC forwarding, response validation, and failure handling using n8n.

I designed and implemented an end-to-end security automation workflow that receives security alerts through a webhook, normalizes and validates incoming data, routes incidents by severity, enriches alerts with analyst-ready context, and forwards structured incidents to Splunk for centralized investigation. The project also includes response validation, failure handling, end-to-end testing, and documented network troubleshooting.

View Workflow Back to Projects

Project Snapshot

Webhook Ingestion

Receives security alerts through an n8n production webhook and passes each event into the automation pipeline.

Normalization & Validation

Standardizes severity values and rejects malformed or unsupported alerts before response logic runs.

Severity-Based Routing

Routes HIGH, MEDIUM, and LOW incidents into dedicated triage branches.

Incident Enrichment

Adds incident IDs, timestamps, host and user context, MITRE ATT&CK information, response actions, and analyst notes.

Splunk HEC Integration

Forwards structured incidents to Splunk through the HTTP Event Collector for centralized security visibility.

Failure Handling

Checks Splunk responses and directs failed deliveries into a shared automation-failure handling path.

AUTOMATION ARCHITECTURE

End-to-End SOC Workflow

The workflow was designed as a complete alert-processing pipeline rather than a single one-off action.

Security Alert
     |
     v
+----------------------+
|       Webhook        |
+----------------------+
     |
     v
+----------------------+
|   Normalize Alert    |
+----------------------+
     |
     v
+----------------------+
|    Validate Alert    |
+----------------------+
     |
     +-------------------------> Invalid Alert
     |                                |
     |                                v
     |                         Failure Handling
     |
     v
+----------------------+
|   Severity Router    |
+----------------------+
     |
     +-------------------+-------------------+
     |                   |                   |
     v                   v                   v
    HIGH               MEDIUM               LOW
     |                   |                   |
     v                   v                   v
 Escalate             Review              Log
 Incident             Incident            Incident
     |                   |                   |
     v                   v                   v
 Format High         Format Medium       Format Normal
     |                   |                   |
     +-------------------+-------------------+
                         |
                         v
                 Splunk HEC Forwarding
                         |
                         v
                Validate HEC Response
                         |
                  +------+------+
                  |             |
                  v             v
               Success        Failure
                               |
                               v
                    Log Automation Failure

Complete n8n SOC security automation workflow — Complete n8n workflow showing webhook ingestion, normalization, validation, severity routing, incident formatting, Splunk forwarding, response checks, and failure handling.

ALERT INGESTION

SOC Alert Webhook

The workflow begins with an n8n webhook that receives security alert data and passes it into the automation pipeline.

DATA PROCESSING

Alert Normalization

Incoming severity values are standardized before routing so differences in capitalization, whitespace, or JSON structure do not break downstream logic.

JSONField NormalizationSeverity StandardizationInput Handling

n8n alert normalization execution — Alert normalization standardizing severity for consistent routing.

n8n alert normalization configuration — Normalization configuration used to derive the standardized severity field.

TRIAGE LOGIC

Validation & Severity Routing

Supported alerts are routed by normalized severity. Unsupported values are separated into an invalid-alert path instead of silently continuing.

HIGH

Immediate escalation with an immediate_review response action.

MEDIUM

Analyst review path with analyst_review response handling.

LOW

Logging and monitoring using log_and_monitor.

INVALID

Malformed or unsupported severity values are rejected and handled separately.

n8n severity router rules for high medium and low alerts — Severity Router rules separating HIGH, MEDIUM, and LOW incidents into dedicated branches.

HIGH-SEVERITY RESPONSE

Automated Escalation

High-severity alerts are automatically escalated, enriched, formatted, forwarded to Splunk, and checked for a successful HEC response.

Successful high severity n8n automation execution — Successful HIGH-severity execution through escalation, Splunk forwarding, and response validation.

SEVERITY-SPECIFIC ACTIONS

Medium & Low Incident Handling

Different severity levels receive different response actions instead of being treated identically.

Medium Priority

Medium incidents are marked for analyst review and assigned a review-oriented response action.

Low Priority

Low incidents are recorded for visibility and monitoring without unnecessary escalation.

Consistent Formatting

Each branch produces a structured event before sending it to Splunk.

Successful medium severity n8n automation execution — MEDIUM-severity alert routed into analyst-review handling.

Successful low severity n8n automation execution — LOW-severity alert routed into logging and monitoring handling.

INCIDENT ENRICHMENT

Analyst-Ready Incident Context

The workflow adds structured security and response context before an incident reaches Splunk.

Incident Metadata

Incident ID, creation time, alert name, host, username, source IP, and severity.

MITRE ATT&CK Context

Tactic and technique fields connect alerts to a recognized security framework.

Response Context

Escalation state, response action, detection source, and analyst notes are added.

n8n high incident enrichment fields — High-severity incident enrichment with response fields and MITRE ATT&CK context.

SIEM INTEGRATION

Splunk HTTP Event Collector

Structured incidents are forwarded from n8n to Splunk using HEC. The workflow then checks the Splunk response to confirm successful ingestion.

Splunk EnterpriseHECHTTPSJSON EventsSIEM Integration

Successful n8n Splunk HEC response — Successful Splunk HEC delivery response returned to n8n after event ingestion.

CENTRALIZED VISIBILITY

Automated Incidents in Splunk

End-to-end tests confirmed that incidents from all three severity branches reached the dedicated Splunk index with the expected enriched fields.

Splunk automated incidents overview — Splunk search results showing automated security incidents received from n8n.

Splunk automated incidents detailed fields — Detailed incident fields available in Splunk after automated enrichment and forwarding.

Splunk incident triage table — LOW, MEDIUM, and HIGH incidents with their triage and response fields.

RESILIENCY

Response Validation & Failure Handling

The workflow validates HEC responses and routes failed deliveries into a shared failure path instead of assuming every HTTP request succeeded.

Delivery Check

Each severity branch validates the Splunk response after the HTTP request.

Shared Failure Path

Failed ingestion attempts are routed into the common Log Automation Failure node.

Controlled Testing

Connection failures were observed during troubleshooting and used to validate workflow behavior.

Splunk HEC connection failure during troubleshooting — HEC connection failure captured during troubleshooting.

Splunk HEC connectivity restored after correcting the underlying network issue.

ENGINEERING TROUBLESHOOTING

Duplicate IP & ARP Conflict

AUTOMATION01 could reach its local management gateway but could not reach Splunk across the routed network. The actual cause was a duplicate IP conflict on the management network rather than a pfSense routing failure.

Symptom

n8n HEC requests timed out even though the automation host had a valid default route.

Diagnosis

The ARP neighbor entry for the gateway showed an unexpected VMware MAC address.

Root Cause

A Windows VMware host-only adapter also used 172.16.30.1, conflicting with pfSense MANAGEMENT.

Fix

The conflicting host adapter address was corrected and the ARP cache was flushed.

Validation

The gateway MAC changed to pfSense and cross-subnet connectivity to Splunk was restored.

Final Recovery

After network recovery and HEC authorization correction, HIGH, MEDIUM, and LOW incidents completed end to end.

Validation Summary

Webhook Reception

PASS
Security alerts successfully entered the n8n workflow.

Normalization

PASS
Severity values were standardized for downstream logic.

Validation

PASS
Unsupported values were separated from valid incidents.

Severity Routing

PASS
HIGH, MEDIUM, and LOW alerts followed the correct branches.

Splunk HEC

PASS
Structured incidents were successfully delivered to Splunk.

End-to-End Automation

OPERATIONAL
All three severity paths completed successfully.

Skills Demonstrated

n8n Security Automation SOAR Concepts Webhooks JSON Alert Normalization Input Validation Severity Routing Incident Enrichment MITRE ATT&CK Splunk Enterprise Splunk HEC SIEM Integration HTTP / HTTPS Response Validation Error Handling Linux Docker pfSense TCP/IP Routing ARP Troubleshooting Network Segmentation Technical Documentation

Security Automation Case Study

This project demonstrates a complete alert-processing workflow from ingestion through automated triage, enrichment, SIEM delivery, response validation, failure handling, and network troubleshooting.

Review Workflow Back to Projects