{
 "name": "otorize · SOC: IP block with approval",
 "nodes": [
  {
   "parameters": {
    "httpMethod": "POST",
    "path": "siem-alert",
    "options": {}
   },
   "id": "70e7981f-46ca-4b9c-a637-1de6e5d494e6",
   "name": "Alert from the SIEM",
   "type": "n8n-nodes-base.webhook",
   "typeVersion": 2,
   "position": [
    0,
    0
   ],
   "webhookId": "890040d9-fb52-4f28-890b-7dadeef2bd4c"
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://api.anthropic.com/v1/messages",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ model: 'claude-sonnet-4-5', max_tokens: 500, messages: [{ role: 'user', content: 'Assess this alert: ' + JSON.stringify($json.body) }] }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "4678ef69-65ec-44a8-9def-316b4b9329cf",
   "name": "Claude: assess the alert",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    240,
    0
   ]
  },
  {
   "parameters": {
    "conditions": {
     "options": {
      "caseSensitive": true,
      "leftValue": "",
      "typeValidation": "strict"
     },
     "conditions": [
      {
       "id": "620d257e-378c-47f5-83e3-ae661e95846a",
       "leftValue": "={{ $json.verdict }}",
       "rightValue": "malicious",
       "operator": {
        "type": "string",
        "operation": "equals"
       }
      }
     ],
     "combinator": "and"
    },
    "options": {}
   },
   "id": "9ef7f17d-f38b-476a-ad7c-a191c34c9156",
   "name": "Action needed?",
   "type": "n8n-nodes-base.if",
   "typeVersion": 2,
   "position": [
    480,
    0
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://api.otorize.app/v1/rooms/ROOM_ID/proposals?wait=25",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ action: 'firewall.block_ip', params: { ip: $json.ip, reason: $json.reason, duration_hours: $json.duration_hours } }) }}",
    "options": {
     "timeout": 40000
    },
    "authentication": "genericCredentialType",
    "genericAuthType": "httpHeaderAuth"
   },
   "id": "77479e2e-cf43-4e2c-8b9a-430202bc935a",
   "name": "otorize: ask to block",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    720,
    -120
   ]
  },
  {
   "parameters": {
    "assignments": {
     "assignments": [
      {
       "id": "33322d19-7a35-4c94-a7b3-8764fb4b3ea9",
       "name": "esito",
       "value": "={{ 'False positive: ' + $json.reason }}",
       "type": "string"
      }
     ]
    },
    "options": {}
   },
   "id": "2808d4f3-9511-4828-9377-6ad2ede1cd62",
   "name": "Close as false positive",
   "type": "n8n-nodes-base.set",
   "typeVersion": 3.4,
   "position": [
    720,
    140
   ]
  },
  {
   "parameters": {
    "conditions": {
     "options": {
      "caseSensitive": true,
      "leftValue": "",
      "typeValidation": "strict"
     },
     "conditions": [
      {
       "id": "2eea588a-0b56-44ce-9ad3-46edf789e85d",
       "leftValue": "={{ $json.proposal.status }}",
       "rightValue": "approved",
       "operator": {
        "type": "string",
        "operation": "equals"
       }
      }
     ],
     "combinator": "and"
    },
    "options": {}
   },
   "id": "47326bb7-1c46-46da-ad44-a610dc56b8b7",
   "name": "Approved?",
   "type": "n8n-nodes-base.if",
   "typeVersion": 2,
   "position": [
    960,
    -120
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://firewall.example/api/v2/cmdb/firewall/address",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ name: 'otorize-' + $json.proposal.params.ip, subnet: $json.proposal.params.ip + ' 255.255.255.255' }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "84fc20fd-db4d-4b90-96c7-626383eabd9c",
   "name": "Block on the firewall",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1200,
    -260
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "={{ 'https://api.otorize.app/v1/proposals/' + $('otorize: ask to block').item.json.proposal.id + '/result' }}",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ status: 'executed', result: { firewall: $json.status } }) }}",
    "options": {
     "timeout": 40000
    },
    "authentication": "genericCredentialType",
    "genericAuthType": "httpHeaderAuth"
   },
   "id": "bc68958a-9908-429f-a8f9-0b3b6e2e8378",
   "name": "otorize: report the outcome",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1440,
    -260
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://example.webhook.office.com/webhookb2/esempio",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ text: 'IP ' + $('otorize: ask to block').item.json.proposal.params.ip + ' blocked after approval' }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "63dc70fc-8a70-4677-a305-fe1950fbeedf",
   "name": "Notify the SOC",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1680,
    -260
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://example.webhook.office.com/webhookb2/esempio",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ text: 'Block not carried out: ' + $json.proposal.status }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "4bfb078c-5ac5-4623-8d86-e71b443a8fd2",
   "name": "Page the on-call",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1200,
    20
   ]
  }
 ],
 "connections": {
  "Alert from the SIEM": {
   "main": [
    [
     {
      "node": "Claude: assess the alert",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Claude: assess the alert": {
   "main": [
    [
     {
      "node": "Action needed?",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Action needed?": {
   "main": [
    [
     {
      "node": "otorize: ask to block",
      "type": "main",
      "index": 0
     }
    ],
    [
     {
      "node": "Close as false positive",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "otorize: ask to block": {
   "main": [
    [
     {
      "node": "Approved?",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Approved?": {
   "main": [
    [
     {
      "node": "Block on the firewall",
      "type": "main",
      "index": 0
     }
    ],
    [
     {
      "node": "Page the on-call",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Block on the firewall": {
   "main": [
    [
     {
      "node": "otorize: report the outcome",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "otorize: report the outcome": {
   "main": [
    [
     {
      "node": "Notify the SOC",
      "type": "main",
      "index": 0
     }
    ]
   ]
  }
 },
 "settings": {
  "executionOrder": "v1"
 },
 "pinData": {
  "Alert from the SIEM": [
   {
    "json": {
     "body": {
      "rule": "SSH brute force",
      "src_ip": "203.0.113.47",
      "dst": "vpn.example.it",
      "attempts": 312,
      "window": "5m",
      "severity": "high"
     }
    }
   }
  ],
  "Claude: assess the alert": [
   {
    "json": {
     "verdict": "malicious",
     "ip": "203.0.113.47",
     "reason": "312 failed SSH attempts in 5 minutes against the VPN",
     "duration_hours": 24
    }
   }
  ],
  "Block on the firewall": [
   {
    "json": {
     "status": "success",
     "http_status": 200
    }
   }
  ],
  "Notify the SOC": [
   {
    "json": {
     "ok": true
    }
   }
  ],
  "Page the on-call": [
   {
    "json": {
     "ok": true
    }
   }
  ]
 }
}