Skip to Workflow Atlas
Playbook AtlasWorkflow Atlas
Workflow blueprintBrowse workflows
ETL PipelineAI systemIntermediate

IP Threat Intelligence and Reporting Workflow

IP Threat Intelligence and Reporting Workflow is a 23-node automation blueprint connecting VirusTotal, GreyNoise, Slack. Inspect its trigger, execution graph, branches, and implementation requirements.

VirusTotalGreyNoiseSlackGmail

Interactive system map

Follow the runtime. Inspect what supports it.

Solid horizontal paths show main-channel execution. Violet dependencies sit beneath the exact step they configure or empower.

23

Nodes

26

Links

1

Run groups

Connected tools

4 integrations

  • VirusTotal
  • GreyNoise
  • Slack
  • Gmail

Canvas controls

Fit wide systems, then zoom into any run group.

IP Threat Intelligence and Reporting Workflow execution lanes1 run groups containing 23 workflow nodes and 26 visible links. Solid horizontal lines are main-channel runtime links. Violet dashed lines connect typed dependencies beneath the runtime step they support. Focus any node to inspect its immediate path.Form Trigger. trigger node, formTrigger. 0 incoming and 1 outgoing connections.STARTForm TriggerTRIGGERFORMTRIGGER0 IN / 1 OUTWebhook. trigger node, webhook. 0 incoming and 1 outgoing connections.STARTWebhookTRIGGERWEBHOOK0 IN / 1 OUTGet List of URLs. transform node, itemLists. 1 incoming and 1 outgoing connections.STEP 02Get List of URLsTRANSFORMITEMLISTS1 IN / 1 OUTSet Email. transform node, set. 1 incoming and 1 outgoing connections.STEP 03Set EmailTRANSFORMSET1 IN / 1 OUTIs IP?. decision node, if. 2 incoming and 2 outgoing connections.STEP 04Is IP?DECISIONIF2 IN / 2 OUTSet IP. transform node, set. 1 incoming and 1 outgoing connections.STEP 05Set IPTRANSFORMSET1 IN / 1 OUTDNS Lookup. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 05DNS LookupINTEGRATIONHTTPREQUEST1 IN / 1 OUTSet IP From Lookup. transform node, code. 1 incoming and 1 outgoing connections.STEP 06Set IP From LookupTRANSFORMCODE1 IN / 1 OUTMerge. decision node, merge. 2 incoming and 3 outgoing connections.STEP 07MergeDECISIONMERGE2 IN / 3 OUTGreyNoise RIOT lookup. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 08GreyNoise RIOT lookupINTEGRATIONHTTPREQUEST1 IN / 1 OUTGreyNoise IP Check. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 08GreyNoise IP CheckINTEGRATIONHTTPREQUEST1 IN / 1 OUTStart VirusTotal Scan. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 08Start VirusTotal ScanINTEGRATIONHTTPREQUEST1 IN / 1 OUTMerge Greynoise results. decision node, merge. 2 incoming and 1 outgoing connections.STEP 09Merge Greynoise resultsDECISIONMERGE2 IN / 1 OUTGreynoise Summary. transform node, set. 1 incoming and 1 outgoing connections.STEP 10Greynoise SummaryTRANSFORMSET1 IN / 1 OUTWait 5s. integration node, wait. 2 incoming and 1 outgoing connections.STEP 11Wait 5sINTEGRATIONWAIT2 IN / 1 OUTVirusTotal result. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 12VirusTotal resultINTEGRATIONHTTPREQUEST1 IN / 1 OUTFilter. decision node, filter. 1 incoming and 1 outgoing connections.STEP 13FilterDECISIONFILTER1 IN / 1 OUTVirusTotal ready?. decision node, if. 1 incoming and 2 outgoing connections.STEP 14VirusTotal ready?DECISIONIF1 IN / 2 OUTCombine looped items. transform node, code. 1 incoming and 1 outgoing connections.STEP 15Combine looped itemsTRANSFORMCODE1 IN / 1 OUTVirusTotal Summary. transform node, set. 1 incoming and 1 outgoing connections.STEP 16VirusTotal SummaryTRANSFORMSET1 IN / 1 OUTMerge VirusTotal & Greynoise results. decision node, merge. 2 incoming and 2 outgoing connections.STEP 17Merge VirusTotal & Greyno…DECISIONMERGE2 IN / 2 OUTSend Report Email. Gmail node, gmail. 1 incoming and 0 outgoing connections.STEP 18Send Report EmailGMAILGMAIL1 IN / 0 OUTSend Report Slack. Slack node, slack. 1 incoming and 0 outgoing connections.OUTCOMESend Report SlackSLACKSLACK1 IN / 0 OUT

Signal inspector

Focus, hover, or select a step to isolate its runtime and support links.

Main-channel runtimeTyped dependencytriggeraidecisiontransformintegration
Scroll horizontally to follow every connected flow.23 connected nodesEnter or click to lock · Escape to clear

Runtime breakdown

Read the execution spine before its dependencies.

Each run group separates main-channel steps from the models, tools, retrievers, and data services that support them. Start and outcome labels apply only to runtime nodes.

01

Run Group

Form Trigger

26 Execution Links

  1. Start

    Form Trigger

    Trigger

    Webhook

    Trigger

  2. Step 2

    Get List of URLs

    Transform

  3. Step 3

    Set Email

    Transform

  4. Step 4

    Is IP?

    Decision

  5. Step 5

    Set IP

    Transform

    DNS Lookup

    Integration

  6. Step 6

    Set IP From Lookup

    Transform

  7. Step 7

    Merge

    Decision

  8. Step 8

    GreyNoise RIOT lookup

    Integration

    GreyNoise IP Check

    Integration

    Start VirusTotal Scan

    Integration

  9. Step 9

    Merge Greynoise results

    Decision

  10. Step 10

    Greynoise Summary

    Transform

  11. Step 11

    Wait 5s

    Integration

  12. Step 12

    VirusTotal result

    Integration

  13. Step 13

    Filter

    Decision

  14. Step 14

    VirusTotal ready?

    Decision

  15. Step 15

    Combine looped items

    Transform

  16. Step 16

    VirusTotal Summary

    Transform

  17. Step 17

    Merge VirusTotal & Greynoise results

    Decision

  18. Step 18

    Send Report Email

    Integration

  19. Outcome

    Send Report Slack

    Integration

Turn the map into a plan

Adapt this blueprint to your company.

Bring the system shape into a workspace, then define the production controls, data boundaries, owners, and delivery sequence around your context.

Create a build planReturn to the atlas