Detect and isolate ransomware with Claude (Anthropic), EDR, SIEM and Slack
File System Event Stream
Aggregate File Operations (30s Window)
Wait for Batch Window (30s)
noOp
Claude AI Ransomware Threat Analysis
openai
Claude AI Model
=claude-sonnet-4-20250514
Parse AI Threat Assessment
Threat Score >= 75? (Auto-Isolate Threshold)
Confirm Isolation Required
Capture Forensic Snapshot
Execute System Isolation
Terminate Encryption Process
Alert SOC — Critical Ransomware Detection
slack
Email Security Team
smtp
Trigger PagerDuty Incident
events.pagerduty.com
Forward to SIEM (Splunk/Elastic)
Write to Isolation Audit Log
googleSheets
Build Incident Response Summary
Send Detection Response
noOp
Enhanced Monitoring Mode
Notify SOC — Monitoring Alert
slack
Log Monitoring Alert
googleSheets
Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.