{
  "name": "Check file hash reputation with VirusTotal and Slack alerts",
  "nodes": [
    {
      "id": "34008e71-38bb-4de3-a060-1eb96f1686fa",
      "name": "Receive File Hash",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -48,
        176
      ]
    },
    {
      "id": "9985ba85-7a31-44d0-beb3-d1a7541c0ef8",
      "name": "Respond - Clean or Unknown",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        1520,
        272
      ]
    },
    {
      "id": "3f542484-250d-416e-aa4e-4aeada8b029d",
      "name": "Slack - Malicious Hash Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        1520,
        80
      ]
    },
    {
      "id": "9119e5d5-bc35-4e7d-9a2c-5006b7063cea",
      "name": "IF - Malicious Verdict",
      "type": "n8n-nodes-base.if",
      "position": [
        1296,
        160
      ]
    },
    {
      "id": "84b36197-ed3a-4d5a-8017-d237c2daf6fd",
      "name": "Function - Calculate Verdict",
      "type": "n8n-nodes-base.code",
      "position": [
        1088,
        80
      ]
    },
    {
      "id": "189900ed-8e3d-4f24-87a2-284769506024",
      "name": "Respond - Invalid Hash",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        656,
        288
      ]
    },
    {
      "id": "cc43ad57-4842-48dc-959b-8185dcb16501",
      "name": "HTTP - VirusTotal Hash Lookup",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        656,
        96
      ]
    },
    {
      "id": "d31682ad-58d9-49e3-9b49-ee1037cf97b5",
      "name": "IF - Hash Exists in VT",
      "type": "n8n-nodes-base.if",
      "position": [
        864,
        176
      ]
    },
    {
      "id": "78006d40-ec95-4738-8356-1bc84ada73d0",
      "name": "IF - Valid Hash Format",
      "type": "n8n-nodes-base.if",
      "position": [
        416,
        176
      ]
    },
    {
      "id": "35faaee9-f154-47bf-8fc0-9dbfe4a3d324",
      "name": "Respond - Unknown Hash",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        1088,
        288
      ]
    },
    {
      "id": "d93e59a7-750a-4e8f-8a5f-e28a4c8f4f32",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -80,
        32
      ],
      "parameters": {
        "width": 416,
        "height": 432,
        "content": "## 1. Webhook Input & Normalization\n"
      }
    },
    {
      "id": "9200acad-94ac-4906-bcff-8b6019b29216",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        352,
        32
      ],
      "parameters": {
        "width": null,
        "height": 432,
        "content": "## 2. Hash Validation\n"
      }
    },
    {
      "id": "b5644510-eb31-484c-b1ab-311c62c9c472",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        608,
        32
      ],
      "parameters": {
        "width": 400,
        "height": 432,
        "content": "## 3. VirusTotal Lookup\n"
      }
    },
    {
      "id": "b69d7f7a-c2d3-4000-ac97-97d8ff2f55b3",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1024,
        32
      ],
      "parameters": {
        "width": 416,
        "height": 432,
        "content": "## 4. Verdict Calculation\n"
      }
    },
    {
      "id": "b61abd46-d1c3-40b7-b7a5-19498391e414",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1456,
        32
      ],
      "parameters": {
        "width": 432,
        "height": 432,
        "content": "## 5. Alerts & Responses\n"
      }
    },
    {
      "id": "f074671e-f814-4ba9-a6d7-ea3d5a73f1c3",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -544,
        -96
      ],
      "parameters": {
        "width": 432,
        "height": 752,
        "content": "## File Hash Reputation Checker\nThis is a security automation workflow that validates files hashes (**MD5**, **SHA1**, **SHA256**) and checks their reputation using the **VirusTotal API**. \n\nThe workf"
      }
    },
    {
      "id": "f712dae4-6336-4250-b8af-884ab56f8b25",
      "name": "Normalize Hash from Webhook",
      "type": "n8n-nodes-base.set",
      "position": [
        176,
        176
      ]
    },
    {
      "id": "2f7ebeae-77e0-44b0-a4f2-7ca207474757",
      "name": "Send a message",
      "type": "n8n-nodes-base.slack",
      "position": [
        1728,
        272
      ]
    }
  ],
  "connections": {
    "Receive File Hash": {
      "main": [
        [
          {
            "node": "Normalize Hash from Webhook",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Hash Exists in VT": {
      "main": [
        [
          {
            "node": "Function - Calculate Verdict",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond - Unknown Hash",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Malicious Verdict": {
      "main": [
        [
          {
            "node": "Slack - Malicious Hash Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond - Clean or Unknown",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Valid Hash Format": {
      "main": [
        [
          {
            "node": "HTTP - VirusTotal Hash Lookup",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond - Invalid Hash",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Respond - Clean or Unknown": {
      "main": [
        [
          {
            "node": "Send a message",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Normalize Hash from Webhook": {
      "main": [
        [
          {
            "node": "IF - Valid Hash Format",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Function - Calculate Verdict": {
      "main": [
        [
          {
            "node": "IF - Malicious Verdict",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP - VirusTotal Hash Lookup": {
      "main": [
        [
          {
            "node": "IF - Hash Exists in VT",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}