{
 "name": "otorize · SOC: blocco IP con approvazione",
 "nodes": [
  {
   "parameters": {
    "httpMethod": "POST",
    "path": "siem-alert",
    "options": {}
   },
   "id": "86535f4a-142f-4756-96f3-551b71527ba1",
   "name": "Alert dal SIEM",
   "type": "n8n-nodes-base.webhook",
   "typeVersion": 2,
   "position": [
    0,
    0
   ],
   "webhookId": "98c491ff-d2c8-4d9f-a811-c5d818d56355"
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://api.anthropic.com/v1/messages",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ model: 'claude-sonnet-4-5', max_tokens: 500, messages: [{ role: 'user', content: 'Valuta questo alert: ' + JSON.stringify($json.body) }] }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "3a90e829-ad82-4fa7-929c-875c5f51a164",
   "name": "Claude: valuta l'alert",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    240,
    0
   ]
  },
  {
   "parameters": {
    "conditions": {
     "options": {
      "caseSensitive": true,
      "leftValue": "",
      "typeValidation": "strict"
     },
     "conditions": [
      {
       "id": "af3cf8e3-9d40-4797-91ae-8688ee023ffa",
       "leftValue": "={{ $json.verdict }}",
       "rightValue": "malicious",
       "operator": {
        "type": "string",
        "operation": "equals"
       }
      }
     ],
     "combinator": "and"
    },
    "options": {}
   },
   "id": "c65614d1-71b7-4074-b6df-831689a344a5",
   "name": "Serve un'azione?",
   "type": "n8n-nodes-base.if",
   "typeVersion": 2,
   "position": [
    480,
    0
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://api.otorize.app/v1/rooms/ROOM_ID/proposals?wait=25",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ action: 'firewall.block_ip', params: { ip: $json.ip, reason: $json.reason, duration_hours: $json.duration_hours } }) }}",
    "options": {
     "timeout": 40000
    },
    "authentication": "genericCredentialType",
    "genericAuthType": "httpHeaderAuth"
   },
   "id": "3ad3fcf6-9b63-4c1d-84c3-b74ad57efae8",
   "name": "otorize: chiedi il blocco",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    720,
    -120
   ]
  },
  {
   "parameters": {
    "assignments": {
     "assignments": [
      {
       "id": "fcd4cac1-fed3-4474-85f9-cce3c4625280",
       "name": "esito",
       "value": "={{ 'Falso positivo: ' + $json.reason }}",
       "type": "string"
      }
     ]
    },
    "options": {}
   },
   "id": "206d286e-9361-4fdd-a00e-a8eb01096bf9",
   "name": "Chiudi come falso positivo",
   "type": "n8n-nodes-base.set",
   "typeVersion": 3.4,
   "position": [
    720,
    140
   ]
  },
  {
   "parameters": {
    "conditions": {
     "options": {
      "caseSensitive": true,
      "leftValue": "",
      "typeValidation": "strict"
     },
     "conditions": [
      {
       "id": "b223d834-de56-4d64-b26f-c124c2108c1b",
       "leftValue": "={{ $json.proposal.status }}",
       "rightValue": "approved",
       "operator": {
        "type": "string",
        "operation": "equals"
       }
      }
     ],
     "combinator": "and"
    },
    "options": {}
   },
   "id": "c55b5470-6bce-4ca6-8ac3-f7506a51bf29",
   "name": "Approvato?",
   "type": "n8n-nodes-base.if",
   "typeVersion": 2,
   "position": [
    960,
    -120
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://firewall.example/api/v2/cmdb/firewall/address",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ name: 'otorize-' + $json.proposal.params.ip, subnet: $json.proposal.params.ip + ' 255.255.255.255' }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "5b8489bd-3175-48c1-b305-edd648f40b17",
   "name": "Blocca sul firewall",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1200,
    -260
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "={{ 'https://api.otorize.app/v1/proposals/' + $('otorize: chiedi il blocco').item.json.proposal.id + '/result' }}",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ status: 'executed', result: { firewall: $json.status } }) }}",
    "options": {
     "timeout": 40000
    },
    "authentication": "genericCredentialType",
    "genericAuthType": "httpHeaderAuth"
   },
   "id": "0f55474a-2558-45cf-bab1-b5852d2328f8",
   "name": "otorize: registra l'esito",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1440,
    -260
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://example.webhook.office.com/webhookb2/esempio",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ text: 'IP ' + $('otorize: chiedi il blocco').item.json.proposal.params.ip + ' bloccato dopo approvazione' }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "675a8f28-a4ec-4b3d-ac60-690acc5280f5",
   "name": "Avvisa il SOC",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1680,
    -260
   ]
  },
  {
   "parameters": {
    "method": "POST",
    "url": "https://example.webhook.office.com/webhookb2/esempio",
    "sendBody": true,
    "specifyBody": "json",
    "jsonBody": "={{ JSON.stringify({ text: 'Blocco non eseguito: ' + $json.proposal.status }) }}",
    "options": {
     "timeout": 40000
    }
   },
   "id": "7846c9fd-fee0-40f8-a9e9-cb0a3e017417",
   "name": "Notifica il reperibile",
   "type": "n8n-nodes-base.httpRequest",
   "typeVersion": 4.2,
   "position": [
    1200,
    20
   ]
  }
 ],
 "connections": {
  "Alert dal SIEM": {
   "main": [
    [
     {
      "node": "Claude: valuta l'alert",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Claude: valuta l'alert": {
   "main": [
    [
     {
      "node": "Serve un'azione?",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Serve un'azione?": {
   "main": [
    [
     {
      "node": "otorize: chiedi il blocco",
      "type": "main",
      "index": 0
     }
    ],
    [
     {
      "node": "Chiudi come falso positivo",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "otorize: chiedi il blocco": {
   "main": [
    [
     {
      "node": "Approvato?",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Approvato?": {
   "main": [
    [
     {
      "node": "Blocca sul firewall",
      "type": "main",
      "index": 0
     }
    ],
    [
     {
      "node": "Notifica il reperibile",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "Blocca sul firewall": {
   "main": [
    [
     {
      "node": "otorize: registra l'esito",
      "type": "main",
      "index": 0
     }
    ]
   ]
  },
  "otorize: registra l'esito": {
   "main": [
    [
     {
      "node": "Avvisa il SOC",
      "type": "main",
      "index": 0
     }
    ]
   ]
  }
 },
 "settings": {
  "executionOrder": "v1"
 },
 "pinData": {
  "Alert dal SIEM": [
   {
    "json": {
     "body": {
      "rule": "SSH brute force",
      "src_ip": "203.0.113.47",
      "dst": "vpn.example.it",
      "attempts": 312,
      "window": "5m",
      "severity": "high"
     }
    }
   }
  ],
  "Claude: valuta l'alert": [
   {
    "json": {
     "verdict": "malicious",
     "ip": "203.0.113.47",
     "reason": "312 tentativi SSH falliti in 5 minuti verso la VPN",
     "duration_hours": 24
    }
   }
  ],
  "Blocca sul firewall": [
   {
    "json": {
     "status": "success",
     "http_status": 200
    }
   }
  ],
  "Avvisa il SOC": [
   {
    "json": {
     "ok": true
    }
   }
  ],
  "Notifica il reperibile": [
   {
    "json": {
     "ok": true
    }
   }
  ]
 }
}