{
  "name": "URL and IP lookups through Greynoise and VirusTotal",
  "nodes": [
    {
      "id": "dbb98f7d-6737-4eaa-9a66-9779c042c575",
      "name": "VirusTotal result",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        2430,
        1648
      ]
    },
    {
      "id": "fb71337b-ebd3-4331-9f18-ff953c6b068b",
      "name": "DNS Lookup",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1330,
        1028
      ]
    },
    {
      "id": "290c6e9c-31d1-4476-9beb-b72a795ecfbb",
      "name": "Set IP From Lookup",
      "type": "n8n-nodes-base.code",
      "position": [
        1530,
        1028
      ]
    },
    {
      "id": "2e25aa5e-479c-4e3b-b866-89f2bdbabbba",
      "name": "Set IP",
      "type": "n8n-nodes-base.set",
      "position": [
        1390,
        828
      ]
    },
    {
      "id": "69b89cd7-1456-4067-a9da-d81ef3f86097",
      "name": "Merge VirusTotal & Greynoise results",
      "type": "n8n-nodes-base.merge",
      "position": [
        3610,
        948
      ]
    },
    {
      "id": "1011bb3b-3f75-40b8-a473-e07b70079b60",
      "name": "Is IP?",
      "type": "n8n-nodes-base.if",
      "position": [
        1110,
        848
      ]
    },
    {
      "id": "770b4056-1497-48ed-bcd7-ad6e7106cc7d",
      "name": "Start VirusTotal Scan",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1990,
        1648
      ]
    },
    {
      "id": "d5d31e4a-2f95-4151-af35-bb8129f2e5a3",
      "name": "VirusTotal Summary",
      "type": "n8n-nodes-base.set",
      "position": [
        3230,
        1628
      ]
    },
    {
      "id": "467c795f-6f13-4d6d-a8cf-5cf9be2e7a77",
      "name": "VirusTotal ready?",
      "type": "n8n-nodes-base.if",
      "position": [
        2790,
        1648
      ]
    },
    {
      "id": "284728e4-dc74-4c37-890b-5305970960c0",
      "name": "Wait 5s",
      "type": "n8n-nodes-base.wait",
      "position": [
        2230,
        1648
      ]
    },
    {
      "id": "76e1414a-d690-44df-a3b8-8dbb4a192720",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        450,
        1448
      ]
    },
    {
      "id": "b3e188f3-0a39-4451-ab70-632282243f03",
      "name": "Get List of URLs",
      "type": "n8n-nodes-base.itemLists",
      "position": [
        650,
        1448
      ]
    },
    {
      "id": "360628b7-afc0-4444-a8c0-a85fae54b0e3",
      "name": "Set Email",
      "type": "n8n-nodes-base.set",
      "position": [
        850,
        1448
      ]
    },
    {
      "id": "6df9593b-5f9f-4b50-bddb-97dcb2017d6e",
      "name": "Merge Greynoise results",
      "type": "n8n-nodes-base.merge",
      "position": [
        2370,
        728
      ]
    },
    {
      "id": "1957a675-7a5a-4ccd-b334-f2c4f9749f58",
      "name": "Send Report Slack",
      "type": "n8n-nodes-base.slack",
      "position": [
        3850,
        1168
      ]
    },
    {
      "id": "4d64351f-0233-4859-afd2-fc31e3fc37cd",
      "name": "Send Report Email",
      "type": "n8n-nodes-base.gmail",
      "position": [
        3850,
        948
      ]
    },
    {
      "id": "e4305eb1-8e57-49d0-97b7-391200bd0042",
      "name": "Greynoise Summary",
      "type": "n8n-nodes-base.set",
      "position": [
        2650,
        728
      ]
    },
    {
      "id": "c149b1f3-e447-4194-a94e-7d8e0bf38241",
      "name": "Merge",
      "type": "n8n-nodes-base.merge",
      "position": [
        1750,
        848
      ]
    },
    {
      "id": "88c30a1d-c232-4da5-87c3-4d67234b6a29",
      "name": "Combine looped items",
      "type": "n8n-nodes-base.code",
      "position": [
        3010,
        1628
      ]
    },
    {
      "id": "839170f5-7c97-40fd-aeaa-ad57262a586e",
      "name": "Filter",
      "type": "n8n-nodes-base.filter",
      "position": [
        2610,
        1648
      ]
    },
    {
      "id": "d68db329-4628-44a8-8f97-b06cbf18e238",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        380,
        240
      ],
      "parameters": {
        "width": 651.1325602067182,
        "height": 703.911103299255,
        "content": "## Form Input Overview\n\n- **Purpose**: \n  - Instead of forcing other departments to use a full threat platform, simplify the interaction with our Threat Intel workflow which allows other departments t"
      }
    },
    {
      "id": "f9081f7d-35ab-489c-87bb-c2deba7515f9",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        370,
        968
      ],
      "parameters": {
        "width": 653.8285114211884,
        "height": 663.9676956356055,
        "content": "## API Integration\nWant to submit URLs and IPs automatically? Utilize the JSON structure below to upload multiple indicators simultaneously. The workflow leverages 'Item list' to parse the 'data' fiel"
      }
    },
    {
      "id": "aaaac5aa-f0a0-4452-99b4-d78d55a80564",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1070,
        266.9400418986032
      ],
      "parameters": {
        "width": 827.7173647545219,
        "height": 936.2889303743061,
        "content": "![VirusTotal](https://upload.wikimedia.org/wikipedia/commons/thumb/2/2f/Google_2015_logo.svg/320px-Google_2015_logo.svg.png)\n## Data Standardization & Google DNS Integration\n-   Purpose:\n\n    -   Stan"
      }
    },
    {
      "id": "32e80421-b608-4d89-b6fe-a95ab5b9e3bd",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1950,
        68.30371042491026
      ],
      "parameters": {
        "width": 1485.5734904392764,
        "height": 987.7653566551932,
        "content": "![VirusTotal](https://i.imgur.com/fd6Ng5R.png)\n## Greynoise Integration\n\n-   Purpose:\n    -   The aim is to tap into Greynoise's robust API to enrich and contextualize IP-related information within th"
      }
    },
    {
      "id": "adda919b-f65f-4fe0-9f66-11a5a9b65674",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1952,
        1088
      ],
      "parameters": {
        "width": 1483.145187368557,
        "height": 774.1502041707245,
        "content": "![VirusTotal](https://upload.wikimedia.org/wikipedia/commons/thumb/b/b7/VirusTotal_logo.svg/320px-VirusTotal_logo.svg.png)\n## VirusTotal Integration\n-   Purpose:\n    -   This workflow component is spe"
      }
    },
    {
      "id": "cdaec18e-e9f1-4567-89e6-f5474bff42c4",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        3470,
        247
      ],
      "parameters": {
        "width": 898.9279259630971,
        "height": 1146.6423884335761,
        "content": "![VirusTotal](https://upload.wikimedia.org/wikipedia/commons/thumb/2/2f/Slack_Logo_Pre_2019.svg/320px-Slack_Logo_Pre_2019.svg.png)\n![VirusTotal](https://i.imgur.com/f6f6my0.png)\n## Reporting Integrati"
      }
    },
    {
      "id": "577d4b74-9155-440f-a752-6654f8e54669",
      "name": "GreyNoise RIOT lookup",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        2070,
        708
      ]
    },
    {
      "id": "9a41df79-3d81-4b2e-b21c-7f31985d8d1e",
      "name": "GreyNoise IP Check",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        2070,
        888
      ]
    },
    {
      "id": "006eb997-5851-41bd-9d5c-9f44d3b7ec08",
      "name": "Form Trigger",
      "type": "n8n-nodes-base.formTrigger",
      "position": [
        640,
        800
      ]
    }
  ],
  "connections": {
    "Merge": {
      "main": [
        [
          {
            "node": "Start VirusTotal Scan",
            "type": "main",
            "index": 0
          },
          {
            "node": "GreyNoise IP Check",
            "type": "main",
            "index": 0
          },
          {
            "node": "GreyNoise RIOT lookup",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Filter": {
      "main": [
        [
          {
            "node": "VirusTotal ready?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Is IP?": {
      "main": [
        [
          {
            "node": "Set IP",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "DNS Lookup",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set IP": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait 5s": {
      "main": [
        [
          {
            "node": "VirusTotal result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Webhook": {
      "main": [
        [
          {
            "node": "Get List of URLs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Email": {
      "main": [
        [
          {
            "node": "Is IP?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "DNS Lookup": {
      "main": [
        [
          {
            "node": "Set IP From Lookup",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Form Trigger": {
      "main": [
        [
          {
            "node": "Is IP?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get List of URLs": {
      "main": [
        [
          {
            "node": "Set Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Greynoise Summary": {
      "main": [
        [
          {
            "node": "Merge VirusTotal & Greynoise results",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "VirusTotal ready?": {
      "main": [
        [
          {
            "node": "Combine looped items",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Wait 5s",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "VirusTotal result": {
      "main": [
        [
          {
            "node": "Filter",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "GreyNoise IP Check": {
      "main": [
        [
          {
            "node": "Merge Greynoise results",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Set IP From Lookup": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "VirusTotal Summary": {
      "main": [
        [
          {
            "node": "Merge VirusTotal & Greynoise results",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Combine looped items": {
      "main": [
        [
          {
            "node": "VirusTotal Summary",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "GreyNoise RIOT lookup": {
      "main": [
        [
          {
            "node": "Merge Greynoise results",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Start VirusTotal Scan": {
      "main": [
        [
          {
            "node": "Wait 5s",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge Greynoise results": {
      "main": [
        [
          {
            "node": "Greynoise Summary",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge VirusTotal & Greynoise results": {
      "main": [
        [
          {
            "node": "Send Report Slack",
            "type": "main",
            "index": 0
          },
          {
            "node": "Send Report Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}