AIセキュリティSOPHOS

• •HTTP Webhookエンドポイント（n8nが自動生成）
• •Telegram Bot Token
• •ターゲットAPIの認証情報が必要な場合あり
• •Google Gemini API Key

{
  "id": "yFPHgzz31QViOb19",
  "name": "AI SOC SOPHOS",
  "tags": [],
  "nodes": [
    {
      "id": "67fbedd3-c1f2-4efb-9b98-769eb9fe07ad",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -240,
        -180
      ],
      "parameters": {
        "path": "replace-with-your-webhook-path",
        "options": {},
        "httpMethod": "POST"
      },
      "typeVersion": 2
    },
    {
      "id": "d6ac962c-f117-468b-867d-0f4943742cbd",
      "name": "If",
      "type": "n8n-nodes-base.if",
      "position": [
        -20,
        -180
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "or",
          "conditions": [
            {
              "id": "9ed981f2-c77a-4a3b-bf57-d5a9d93708f8",
              "operator": {
                "type": "string",
                "operation": "regex"
              },
              "leftValue": "={{ $json.body.event.severity }}",
              "rightValue": "high|critical"
            },
            {
              "id": "fd811333-cce8-499b-bd27-411cec0641e2",
              "operator": {
                "type": "string",
                "operation": "contains"
              },
              "leftValue": "={{ $json.body.event.type }}",
              "rightValue": "Event::Endpoint::Threat"
            },
            {
              "id": "872198a1-0a59-482d-b5f9-4c2ffd48dcdc",
              "operator": {
                "type": "string",
                "operation": "contains"
              },
              "leftValue": "={{ $json.body.event.type }}",
              "rightValue": "Event::Endpoint::WebControlViolation"
            },
            {
              "id": "f472f90d-ce54-456b-958f-ebb5af4ad70b",
              "operator": {
                "type": "string",
                "operation": "contains"
              },
              "leftValue": "={{ $json.body.event.type }}",
              "rightValue": "Event::Endpoint::WebFilteringBlocked"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "5fc88577-6634-4a19-812d-af5b9698686a",
      "name": "Google Gemini Chat Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatGoogleGemini",
      "position": [
        880,
        40
      ],
      "parameters": {
        "options": {}
      },
      "typeVersion": 1
    },
    {
      "id": "206432d6-e7d3-438e-95ad-afdbaf412b41",
      "name": "テキストメッセージ送信",
      "type": "n8n-nodes-base.telegram",
      "position": [
        1220,
        -180
      ],
      "parameters": {
        "text": "=🚨 *PERINGATAN KEAMANAN {{ JSON.parse($node[\"AI Agent\"].json.output.match(/{[\\s\\S]*}/)[0]).risk_level.toUpperCase() }}* 🚨\n\n*Ancaman Terdeteksi:* `{{ $('Webhook').item.json.body.event.name }}`\n\n_{{ JSON.parse($node[\"AI Agent\"].json.output.match(/{[\\s\\S]*}/)[0]).summary }}_\n\n*Laporan VirusTotal ({{ $('Code').item.json.indicator_value }}):*\nDideteksi oleh {{ $('For_Gemini_Prompt').item.json.totalFlags }} mesin keamanan. Vendor yang menandai:\n{{ $node[\"For_Gemini_Prompt\"].json.vendorsListText }}\n\n*⚙️ Rekomendasi Mitigasi (oleh Gemini AI):*\n{{ JSON.parse($node[\"AI Agent\"].json.output.match(/{[\\s\\S]*}/)[0]).mitigation_steps.map((step, index) => `${index + 1}. ${step}`).join('\\n') }}",
        "chatId": "YOUR_CHAT_ID",
        "additionalFields": {}
      },
      "typeVersion": 1.2
    },
    {
      "id": "c434340f-dbf1-43d9-91a7-9dc0dd1d8fbe",
      "name": "Code",
      "type": "n8n-nodes-base.code",
      "position": [
        200,
        -180
      ],
      "parameters": {
        "jsCode": "// Mengambil data event dari input\nconst event = $input.item.json.body.event;\n\n// Fungsi baru untuk mengekstrak DOMAIN dari dalam field 'name'\nconst extractDomainFromName = (nameField) => {\n  if (!nameField || typeof nameField !== 'string') { return null; }\n  // Memecah teks berdasarkan karakter '\"'\n  const parts = nameField.split('\"');\n  // Domain biasanya adalah bagian kedua (indeks 1)\n  if (parts.length >= 2) {\n    const potentialDomain = parts[1];\n    // Cek sederhana, jika mengandung titik, kita anggap itu domain\n    if (potentialDomain.includes('.')) {\n      return potentialDomain;\n    }\n  }\n  return null;\n};\n\n// Coba ekstrak domain dari field 'name'\nconst domainFromName = extractDomainFromName(event.name);\n\nlet finalUrl = \"\";\nlet indicatorType = \"\";\nlet indicatorValue = \"\";\n\n// --- LOGIKA PRIORITAS BARU ---\n\n// 1. Cek hash file\nif (event?.data?.sha256) {\n  indicatorType = \"file\";\n  indicatorValue = event.data.sha256;\n  finalUrl = `https://www.virustotal.com/api/v3/files/${indicatorValue}`;\n} \n// 2. Cek DOMAIN (bukan URL lagi)\nelse if (domainFromName) {\n  indicatorType = \"domain\";\n  indicatorValue = domainFromName;\n  // Menggunakan endpoint DOMAIN di VirusTotal\n  finalUrl = `https://www.virustotal.com/api/v3/domains/${indicatorValue}`;\n}\n// 3. Cek Alamat IP\nelse if (event?.source_ip) {\n  indicatorType = \"ip\";\n  indicatorValue = event.source_ip;\n  finalUrl = `https://www.virustotal.com/api/v3/ip_addresses/${indicatorValue}`;\n}\n\n// Pastikan kita punya URL untuk diperiksa\nif (!finalUrl) {\n  throw new Error(\"Tidak ada indikator (sha256, domain, atau source_ip) yang ditemukan.\");\n}\n\n// Kembalikan objek terstruktur untuk digunakan di node selanjutnya\nreturn {\n  url_to_check: finalUrl,\n  indicator_type: indicatorType,\n  indicator_value: indicatorValue\n};"
      },
      "typeVersion": 2
    },
    {
      "id": "cab1af6a-bc38-4148-af28-cb16c289b631",
      "name": "AI Agent",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        860,
        -180
      ],
      "parameters": {
        "text": "=Anda adalah seorang Analis Keamanan Jaringan Senior yang sangat teliti dan berbasis fakta juga mendalami Security Operation Center (SOC).\n\nPENTING: Gunakan HANYA data yang tersedia dari log dan data reputasi. Jangan menambahkan, mengubah, atau mengasumsikan detail seperti alamat IP, Url, maupun Sha256. Selalu gunakan alamat IP, Url, maupun Sha256 yang sama persis seperti yang tertera di input.\n\nAnalisis data event IPS dari FortiGate dan data reputasi IP dari VirusTotal berikut.\n\nData Log Sophos:\n{{ $('If').item.json.body }}\n\nData Reputasi VirusTotal untuk{{ $('Code').item.json.indicator_value }} :\n{{ JSON.stringify($node[\"Virus_Total\"].json.data.attributes.last_analysis_stats) }}\n\nTugas Anda: Berikan output HANYA dalam format JSON yang valid dengan kunci berikut:\n- \"event\" : {{ $('If').item.json.body.event.name }}\n- \"summary\": Ringkasan insiden dalam 1-2 kalimat singkat.\n- \"risk_level\": {{ $('Webhook').item.json.body.event.severity }} dan Pilih salah satu: 'Kritis', 'Tinggi'.\n- \"ip_reputation, url atau sha256\": Deskripsi singkat reputasi berdasarkan data VirusTotal{{ $json.vendorsListText  }}{{ $json.reputationSummaryForGemini }}.\n- \"affected_internal_ip\": Ulangi nilai \"{{ $('Webhook').item.json.body.event.source_info.ip }} dengan User {{ $('Webhook').item.json.body.event.suser }} dan host pc {{ $('Webhook').item.json.body.event.dhost }}\" dari \"Data Log Sophos\" di sini tanpa perubahan.\n- \"mitigation_steps\": Array of strings berisi 3 rekomendasi utama yang spesifik dan bisa dijalankan.",
        "options": {},
        "promptType": "define"
      },
      "typeVersion": 2
    },
    {
      "id": "461d4e12-c62c-49ac-8fe1-f687d993de20",
      "name": "For_Gemini_Prompt",
      "type": "n8n-nodes-base.code",
      "position": [
        640,
        -180
      ],
      "parameters": {
        "jsCode": "// KODE UNTUK NODE \"Format Hasil VT\"\n\n// Mengambil output JSON dari node VirusTotal sebelumnya\nconst vtData = $input.item.json;\nconst detailedResults = vtData.data?.attributes?.last_analysis_results || {};\n\nconst flaggingVendors = [];\nlet totalFlags = 0;\n\n// Loop melalui setiap hasil vendor\nfor (const vendor in detailedResults) {\n  const result = detailedResults[vendor];\n  // Cek jika kategori-nya berbahaya atau mencurigakan\n  if (result.category === 'malicious' || result.category === 'suspicious') {\n    totalFlags++;\n    // Format: - `NamaVendor`: *malicious*\n    flaggingVendors.push(`- \\`${vendor}\\`: *${result.category}*`);\n  }\n}\n\n// Buat teks daftar vendor, atau pesan default jika kosong\nconst vendorsListText = flaggingVendors.length > 0\n  ? flaggingVendors.join('\\n')\n  : \"Tidak ada vendor yang menandai sebagai berbahaya.\";\n\n// Buat ringkasan singkat untuk dikirim ke Gemini\nconst reputationSummaryForGemini = `Indikator ini ditandai sebagai berbahaya/mencurigakan oleh ${totalFlags} vendor keamanan di VirusTotal.`;\n\n// Kembalikan semua data yang sudah diformat\nreturn {\n  vendorsListText: vendorsListText,\n  reputationSummaryForGemini: reputationSummaryForGemini,\n  totalFlags: totalFlags\n};"
      },
      "typeVersion": 2
    },
    {
      "id": "0a97c373-db22-4ec4-ab40-b4992bf9ef2f",
      "name": "Virus_Total",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        420,
        -180
      ],
      "parameters": {
        "url": "={{ $json.url_to_check }}",
        "options": {},
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth"
      },
      "typeVersion": 4.2
    },
    {
      "id": "6a6b3013-bf04-4f30-9e6d-0d790e451c38",
      "name": "Simple Memory",
      "type": "@n8n/n8n-nodes-langchain.memoryBufferWindow",
      "position": [
        1000,
        40
      ],
      "parameters": {
        "sessionKey": "={{ $('Webhook').item.json.body.event.customer_id }}",
        "sessionIdType": "customKey"
      },
      "typeVersion": 1.3
    }
  ],
  "active": true,
  "pinData": {},
  "settings": {
    "executionOrder": "v1"
  },
  "connections": {
    "d6ac962c-f117-468b-867d-0f4943742cbd": {
      "main": [
        [
          {
            "node": "c434340f-dbf1-43d9-91a7-9dc0dd1d8fbe",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "c434340f-dbf1-43d9-91a7-9dc0dd1d8fbe": {
      "main": [
        [
          {
            "node": "0a97c373-db22-4ec4-ab40-b4992bf9ef2f",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "67fbedd3-c1f2-4efb-9b98-769eb9fe07ad": {
      "main": [
        [
          {
            "node": "d6ac962c-f117-468b-867d-0f4943742cbd",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "cab1af6a-bc38-4148-af28-cb16c289b631": {
      "main": [
        [
          {
            "node": "206432d6-e7d3-438e-95ad-afdbaf412b41",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "0a97c373-db22-4ec4-ab40-b4992bf9ef2f": {
      "main": [
        [
          {
            "node": "461d4e12-c62c-49ac-8fe1-f687d993de20",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "6a6b3013-bf04-4f30-9e6d-0d790e451c38": {
      "ai_memory": [
        [
          {
            "node": "cab1af6a-bc38-4148-af28-cb16c289b631",
            "type": "ai_memory",
            "index": 0
          }
        ]
      ]
    },
    "461d4e12-c62c-49ac-8fe1-f687d993de20": {
      "main": [
        [
          {
            "node": "cab1af6a-bc38-4148-af28-cb16c289b631",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "5fc88577-6634-4a19-812d-af5b9698686a": {
      "ai_languageModel": [
        [
          {
            "node": "cab1af6a-bc38-4148-af28-cb16c289b631",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    }
  }
}