Skip to Workflow Atlas
Playbook AtlasWorkflow Atlas
Workflow blueprintBrowse workflows
ETL PipelineAI systemIntermediate

IP Threat Intelligence and Reporting Workflow

IP Threat Intelligence and Reporting Workflow is a 23-node automation blueprint connecting VirusTotal, GreyNoise, Slack. Inspect its trigger, execution graph, branches, and implementation requirements.

VirusTotalGreyNoiseSlackGmail

Interactive system map

The entire automation, wired and inspectable.

Brand marks identify the operational stack. Focus or select any node to isolate its real incoming and outgoing connections.

23

Nodes

26

Edges

6

Zones

System stack

4 integrations

  • VirusTotal
  • GreyNoise
  • Slack
  • Gmail
IP Threat Intelligence and Reporting Workflow interactive execution graphStructural view of 23 workflow nodes and 26 visible connections. Focus any node to inspect its connected path. Parameters and credentials are intentionally excluded.Form Trigger. trigger node, formTrigger. 0 incoming and 1 outgoing connections.Form TriggerTRIGGERFORMTRIGGER0 IN / 1 OUTWebhook. trigger node, webhook. 0 incoming and 1 outgoing connections.WebhookTRIGGERWEBHOOK0 IN / 1 OUTGet List of URLs. transform node, itemLists. 1 incoming and 1 outgoing connections.Get List of URLsTRANSFORMITEMLISTS1 IN / 1 OUTSet Email. transform node, set. 1 incoming and 1 outgoing connections.Set EmailTRANSFORMSET1 IN / 1 OUTSet IP. transform node, set. 1 incoming and 1 outgoing connections.Set IPTRANSFORMSET1 IN / 1 OUTIs IP?. decision node, if. 2 incoming and 2 outgoing connections.Is IP?DECISIONIF2 IN / 2 OUTDNS Lookup. integration node, httpRequest. 1 incoming and 1 outgoing connections.DNS LookupINTEGRATIONHTTPREQUEST1 IN / 1 OUTSet IP From Lookup. transform node, code. 1 incoming and 1 outgoing connections.Set IP From LookupTRANSFORMCODE1 IN / 1 OUTGreyNoise RIOT lookup. integration node, httpRequest. 1 incoming and 1 outgoing connections.GreyNoise RIOT lookupINTEGRATIONHTTPREQUEST1 IN / 1 OUTMerge. decision node, merge. 2 incoming and 3 outgoing connections.MergeDECISIONMERGE2 IN / 3 OUTGreyNoise IP Check. integration node, httpRequest. 1 incoming and 1 outgoing connections.GreyNoise IP CheckINTEGRATIONHTTPREQUEST1 IN / 1 OUTStart VirusTotal Scan. integration node, httpRequest. 1 incoming and 1 outgoing connections.Start VirusTotal ScanINTEGRATIONHTTPREQUEST1 IN / 1 OUTMerge Greynoise results. decision node, merge. 2 incoming and 1 outgoing connections.Merge Greynoise resultsDECISIONMERGE2 IN / 1 OUTGreynoise Summary. transform node, set. 1 incoming and 1 outgoing connections.Greynoise SummaryTRANSFORMSET1 IN / 1 OUTWait 5s. integration node, wait. 2 incoming and 1 outgoing connections.Wait 5sINTEGRATIONWAIT2 IN / 1 OUTVirusTotal result. integration node, httpRequest. 1 incoming and 1 outgoing connections.VirusTotal resultINTEGRATIONHTTPREQUEST1 IN / 1 OUTFilter. decision node, filter. 1 incoming and 1 outgoing connections.FilterDECISIONFILTER1 IN / 1 OUTCombine looped items. transform node, code. 1 incoming and 1 outgoing connections.Combine looped itemsTRANSFORMCODE1 IN / 1 OUTVirusTotal Summary. transform node, set. 1 incoming and 1 outgoing connections.VirusTotal SummaryTRANSFORMSET1 IN / 1 OUTVirusTotal ready?. decision node, if. 1 incoming and 2 outgoing connections.VirusTotal ready?DECISIONIF1 IN / 2 OUTMerge VirusTotal & Greynoise results. decision node, merge. 2 incoming and 2 outgoing connections.Merge VirusTotal & Greyno…DECISIONMERGE2 IN / 2 OUTSend Report Email. Gmail node, gmail. 1 incoming and 0 outgoing connections.Send Report EmailGMAILGMAIL1 IN / 0 OUTSend Report Slack. Slack node, slack. 1 incoming and 0 outgoing connections.Send Report SlackSLACKSLACK1 IN / 0 OUT

Signal inspector

Focus, hover, or select a node to illuminate its real path.

triggeraidecisiontransformintegration
Scroll horizontally to inspect every zone.23 connected nodesEnter or click to lock · Escape to clear

Structured review

Read the workflow as a system, not a node dump.

The workflow is grouped into operational zones, then reviewed for the controls needed to adapt the pattern safely.

01

Entry signals

2 nodes

Events, schedules, and unconnected roots that can start an execution.

Webhook

Trigger

Form Trigger

Trigger

02

Data & operations

13 nodes

Transformations and external-system actions that move the work forward.

VirusTotal result

Integration

DNS Lookup

Integration

Set IP From Lookup

Transform

Set IP

Transform

Start VirusTotal Scan

Integration

VirusTotal Summary

Transform

+ 7 more in system map
03

Intelligence & routing

6 nodes

Model calls and control points that interpret, branch, or govern the run.

Merge VirusTotal & Greynoise results

Decision

Is IP?

Decision

VirusTotal ready?

Decision

Merge Greynoise results

Decision

Merge

Decision

Filter

Decision

04

Terminal actions

2 nodes

Nodes with no visible outgoing edge: the workflow’s observable outcomes.

Send Report Slack

Integration

Send Report Email

Integration

Adjacent systems

Keep tracing the stack.

Related workflows share tools and similar system patterns.

Turn the map into a plan

Adapt this blueprint to your company.

Bring the system shape into a workspace, then define the production controls, data boundaries, owners, and delivery sequence around your context.

Create a build planReturn to the atlas