AI 보안 SOPHOS

• •HTTP Webhook 엔드포인트(n8n이 자동으로 생성)
• •Telegram Bot Token
• •대상 API의 인증 정보가 필요할 수 있음
• •Google Gemini API Key

{
  "id": "yFPHgzz31QViOb19",
  "name": "AI SOC SOPHOS",
  "tags": [],
  "nodes": [
    {
      "id": "67fbedd3-c1f2-4efb-9b98-769eb9fe07ad",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -240,
        -180
      ],
      "parameters": {
        "path": "replace-with-your-webhook-path",
        "options": {},
        "httpMethod": "POST"
      },
      "typeVersion": 2
    },
    {
      "id": "d6ac962c-f117-468b-867d-0f4943742cbd",
      "name": "If",
      "type": "n8n-nodes-base.if",
      "position": [
        -20,
        -180
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "or",
          "conditions": [
            {
              "id": "9ed981f2-c77a-4a3b-bf57-d5a9d93708f8",
              "operator": {
                "type": "string",
                "operation": "regex"
              },
              "leftValue": "={{ $json.body.event.severity }}",
              "rightValue": "high|critical"
            },
            {
              "id": "fd811333-cce8-499b-bd27-411cec0641e2",
              "operator": {
                "type": "string",
                "operation": "contains"
              },
              "leftValue": "={{ $json.body.event.type }}",
              "rightValue": "Event::Endpoint::Threat"
            },
            {
              "id": "872198a1-0a59-482d-b5f9-4c2ffd48dcdc",
              "operator": {
                "type": "string",
                "operation": "contains"
              },
              "leftValue": "={{ $json.body.event.type }}",
              "rightValue": "Event::Endpoint::WebControlViolation"
            },
            {
              "id": "f472f90d-ce54-456b-958f-ebb5af4ad70b",
              "operator": {
                "type": "string",
                "operation": "contains"
              },
              "leftValue": "={{ $json.body.event.type }}",
              "rightValue": "Event::Endpoint::WebFilteringBlocked"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "5fc88577-6634-4a19-812d-af5b9698686a",
      "name": "Google Gemini Chat Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatGoogleGemini",
      "position": [
        880,
        40
      ],
      "parameters": {
        "options": {}
      },
      "typeVersion": 1
    },
    {
      "id": "206432d6-e7d3-438e-95ad-afdbaf412b41",
      "name": "문자 메시지 전송",
      "type": "n8n-nodes-base.telegram",
      "position": [
        1220,
        -180
      ],
      "parameters": {
        "text": "=🚨 *PERINGATAN KEAMANAN {{ JSON.parse($node[\"AI Agent\"].json.output.match(/{[\\s\\S]*}/)[0]).risk_level.toUpperCase() }}* 🚨\n\n*Ancaman Terdeteksi:* `{{ $('Webhook').item.json.body.event.name }}`\n\n_{{ JSON.parse($node[\"AI Agent\"].json.output.match(/{[\\s\\S]*}/)[0]).summary }}_\n\n*Laporan VirusTotal ({{ $('Code').item.json.indicator_value }}):*\nDideteksi oleh {{ $('For_Gemini_Prompt').item.json.totalFlags }} mesin keamanan. Vendor yang menandai:\n{{ $node[\"For_Gemini_Prompt\"].json.vendorsListText }}\n\n*⚙️ Rekomendasi Mitigasi (oleh Gemini AI):*\n{{ JSON.parse($node[\"AI Agent\"].json.output.match(/{[\\s\\S]*}/)[0]).mitigation_steps.map((step, index) => `${index + 1}. ${step}`).join('\\n') }}",
        "chatId": "YOUR_CHAT_ID",
        "additionalFields": {}
      },
      "typeVersion": 1.2
    },
    {
      "id": "c434340f-dbf1-43d9-91a7-9dc0dd1d8fbe",
      "name": "Code",
      "type": "n8n-nodes-base.code",
      "position": [
        200,
        -180
      ],
      "parameters": {
        "jsCode": "// Mengambil data event dari input\nconst event = $input.item.json.body.event;\n\n// Fungsi baru untuk mengekstrak DOMAIN dari dalam field 'name'\nconst extractDomainFromName = (nameField) => {\n  if (!nameField || typeof nameField !== 'string') { return null; }\n  // Memecah teks berdasarkan karakter '\"'\n  const parts = nameField.split('\"');\n  // Domain biasanya adalah bagian kedua (indeks 1)\n  if (parts.length >= 2) {\n    const potentialDomain = parts[1];\n    // Cek sederhana, jika mengandung titik, kita anggap itu domain\n    if (potentialDomain.includes('.')) {\n      return potentialDomain;\n    }\n  }\n  return null;\n};\n\n// Coba ekstrak domain dari field 'name'\nconst domainFromName = extractDomainFromName(event.name);\n\nlet finalUrl = \"\";\nlet indicatorType = \"\";\nlet indicatorValue = \"\";\n\n// --- LOGIKA PRIORITAS BARU ---\n\n// 1. Cek hash file\nif (event?.data?.sha256) {\n  indicatorType = \"file\";\n  indicatorValue = event.data.sha256;\n  finalUrl = `https://www.virustotal.com/api/v3/files/${indicatorValue}`;\n} \n// 2. Cek DOMAIN (bukan URL lagi)\nelse if (domainFromName) {\n  indicatorType = \"domain\";\n  indicatorValue = domainFromName;\n  // Menggunakan endpoint DOMAIN di VirusTotal\n  finalUrl = `https://www.virustotal.com/api/v3/domains/${indicatorValue}`;\n}\n// 3. Cek Alamat IP\nelse if (event?.source_ip) {\n  indicatorType = \"ip\";\n  indicatorValue = event.source_ip;\n  finalUrl = `https://www.virustotal.com/api/v3/ip_addresses/${indicatorValue}`;\n}\n\n// Pastikan kita punya URL untuk diperiksa\nif (!finalUrl) {\n  throw new Error(\"Tidak ada indikator (sha256, domain, atau source_ip) yang ditemukan.\");\n}\n\n// Kembalikan objek terstruktur untuk digunakan di node selanjutnya\nreturn {\n  url_to_check: finalUrl,\n  indicator_type: indicatorType,\n  indicator_value: indicatorValue\n};"
      },
      "typeVersion": 2
    },
    {
      "id": "cab1af6a-bc38-4148-af28-cb16c289b631",
      "name": "AI Agent",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        860,
        -180
      ],
      "parameters": {
        "text": "=Anda adalah seorang Analis Keamanan Jaringan Senior yang sangat teliti dan berbasis fakta juga mendalami Security Operation Center (SOC).\n\nPENTING: Gunakan HANYA data yang tersedia dari log dan data reputasi. Jangan menambahkan, mengubah, atau mengasumsikan detail seperti alamat IP, Url, maupun Sha256. Selalu gunakan alamat IP, Url, maupun Sha256 yang sama persis seperti yang tertera di input.\n\nAnalisis data event IPS dari FortiGate dan data reputasi IP dari VirusTotal berikut.\n\nData Log Sophos:\n{{ $('If').item.json.body }}\n\nData Reputasi VirusTotal untuk{{ $('Code').item.json.indicator_value }} :\n{{ JSON.stringify($node[\"Virus_Total\"].json.data.attributes.last_analysis_stats) }}\n\nTugas Anda: Berikan output HANYA dalam format JSON yang valid dengan kunci berikut:\n- \"event\" : {{ $('If').item.json.body.event.name }}\n- \"summary\": Ringkasan insiden dalam 1-2 kalimat singkat.\n- \"risk_level\": {{ $('Webhook').item.json.body.event.severity }} dan Pilih salah satu: 'Kritis', 'Tinggi'.\n- \"ip_reputation, url atau sha256\": Deskripsi singkat reputasi berdasarkan data VirusTotal{{ $json.vendorsListText  }}{{ $json.reputationSummaryForGemini }}.\n- \"affected_internal_ip\": Ulangi nilai \"{{ $('Webhook').item.json.body.event.source_info.ip }} dengan User {{ $('Webhook').item.json.body.event.suser }} dan host pc {{ $('Webhook').item.json.body.event.dhost }}\" dari \"Data Log Sophos\" di sini tanpa perubahan.\n- \"mitigation_steps\": Array of strings berisi 3 rekomendasi utama yang spesifik dan bisa dijalankan.",
        "options": {},
        "promptType": "define"
      },
      "typeVersion": 2
    },
    {
      "id": "461d4e12-c62c-49ac-8fe1-f687d993de20",
      "name": "For_Gemini_Prompt",
      "type": "n8n-nodes-base.code",
      "position": [
        640,
        -180
      ],
      "parameters": {
        "jsCode": "// KODE UNTUK NODE \"Format Hasil VT\"\n\n// Mengambil output JSON dari node VirusTotal sebelumnya\nconst vtData = $input.item.json;\nconst detailedResults = vtData.data?.attributes?.last_analysis_results || {};\n\nconst flaggingVendors = [];\nlet totalFlags = 0;\n\n// Loop melalui setiap hasil vendor\nfor (const vendor in detailedResults) {\n  const result = detailedResults[vendor];\n  // Cek jika kategori-nya berbahaya atau mencurigakan\n  if (result.category === 'malicious' || result.category === 'suspicious') {\n    totalFlags++;\n    // Format: - `NamaVendor`: *malicious*\n    flaggingVendors.push(`- \\`${vendor}\\`: *${result.category}*`);\n  }\n}\n\n// Buat teks daftar vendor, atau pesan default jika kosong\nconst vendorsListText = flaggingVendors.length > 0\n  ? flaggingVendors.join('\\n')\n  : \"Tidak ada vendor yang menandai sebagai berbahaya.\";\n\n// Buat ringkasan singkat untuk dikirim ke Gemini\nconst reputationSummaryForGemini = `Indikator ini ditandai sebagai berbahaya/mencurigakan oleh ${totalFlags} vendor keamanan di VirusTotal.`;\n\n// Kembalikan semua data yang sudah diformat\nreturn {\n  vendorsListText: vendorsListText,\n  reputationSummaryForGemini: reputationSummaryForGemini,\n  totalFlags: totalFlags\n};"
      },
      "typeVersion": 2
    },
    {
      "id": "0a97c373-db22-4ec4-ab40-b4992bf9ef2f",
      "name": "Virus_Total",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        420,
        -180
      ],
      "parameters": {
        "url": "={{ $json.url_to_check }}",
        "options": {},
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth"
      },
      "typeVersion": 4.2
    },
    {
      "id": "6a6b3013-bf04-4f30-9e6d-0d790e451c38",
      "name": "Simple Memory",
      "type": "@n8n/n8n-nodes-langchain.memoryBufferWindow",
      "position": [
        1000,
        40
      ],
      "parameters": {
        "sessionKey": "={{ $('Webhook').item.json.body.event.customer_id }}",
        "sessionIdType": "customKey"
      },
      "typeVersion": 1.3
    }
  ],
  "active": true,
  "pinData": {},
  "settings": {
    "executionOrder": "v1"
  },
  "connections": {
    "d6ac962c-f117-468b-867d-0f4943742cbd": {
      "main": [
        [
          {
            "node": "c434340f-dbf1-43d9-91a7-9dc0dd1d8fbe",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "c434340f-dbf1-43d9-91a7-9dc0dd1d8fbe": {
      "main": [
        [
          {
            "node": "0a97c373-db22-4ec4-ab40-b4992bf9ef2f",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "67fbedd3-c1f2-4efb-9b98-769eb9fe07ad": {
      "main": [
        [
          {
            "node": "d6ac962c-f117-468b-867d-0f4943742cbd",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "cab1af6a-bc38-4148-af28-cb16c289b631": {
      "main": [
        [
          {
            "node": "206432d6-e7d3-438e-95ad-afdbaf412b41",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "0a97c373-db22-4ec4-ab40-b4992bf9ef2f": {
      "main": [
        [
          {
            "node": "461d4e12-c62c-49ac-8fe1-f687d993de20",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "6a6b3013-bf04-4f30-9e6d-0d790e451c38": {
      "ai_memory": [
        [
          {
            "node": "cab1af6a-bc38-4148-af28-cb16c289b631",
            "type": "ai_memory",
            "index": 0
          }
        ]
      ]
    },
    "461d4e12-c62c-49ac-8fe1-f687d993de20": {
      "main": [
        [
          {
            "node": "cab1af6a-bc38-4148-af28-cb16c289b631",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "5fc88577-6634-4a19-812d-af5b9698686a": {
      "ai_languageModel": [
        [
          {
            "node": "cab1af6a-bc38-4148-af28-cb16c289b631",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    }
  }
}