Automate security incident triage with GPT-4o-mini and Gmail notifications

Open on n8n.io

$20/month : Unlimited workflows

2500 executions/month

Try free

THE #1 IN WEB SCRAPING

Scrape any website without limits

Try free

HOSTINGER

Early Deal
DISCOUNT 20%

Self-hosted n8n

Unlimited workflows - from $4.99/mo

Try free

#1 hub for scraping, AI & automation

6000+ actors - $5 credits/mo

Try free

Important notice

This workflow is provided as-is. Please review and test before using in production.

1. Workflow Overview

What this workflow does Automatically triages inbound security findings (e.g., from AWS Security Hub via EventBridge → SNS → Webhook), classifies them with an LLM, generates a 3 step remediation pl...

Best for

AI Summarization automation workflows
Multimodal AI automation workflows
intermediate n8n builders looking for reusable templates

Tools used

n8n-nodes-base.webhook, @n8n/n8n-nodes-langchain.openai, n8n-nodes-base.gmail, n8n-nodes-base.set, n8n-nodes-base.stickynote

Source and attribution

This workflow is cataloged by N8N Workflows and links back to its original n8n.io source page by Calistus Christian.

Original n8n.io source

1.1 Workflow description

Title: Automate security incident triage with GPT-4o-mini and Gmail notifications
Workflow name: Automate security incident triage with GPT-4o-mini and Gmail notifications

What this workflow does

Automatically triages inbound security findings (e.g., from AWS Security Hub via EventBridge → SNS → Webhook), classifies them with an LLM, generates a 3-step remediation plan, and emails a compact incident brief.

Pipeline: Webhook → Clean_Finding (normalize) → Classify (LLM) → Plan (LLM) → Gmail (email). You can substitute Microsoft Teams, Slack, etc.

Normalizes the incoming finding JSON (title, description, account, resource id/type, updated_at).
Uses an LLM to assign incident_type, severity (P0--P3), urgency, short_title, and why (concise rationale).
Produces a 3-step remediation plan with owner_hint and success_criteria---kept atomic and practical.
Sends a clean HTML email with all details (subject line includes short title, resource, and account).

Category: Security / Cloud / Incident Management
Time to set up: ~10--15 minutes
Difficulty: Beginner--Intermediate
Cost: Mostly free (n8n CE; OpenAI usage + Gmail/SMTP as used)

What you'll need

An n8n instance reachable over HTTP (for the Webhook node).
OpenAI (or compatible) credentials set in n8n.
Gmail OAuth2 credentials (or swap Gmail node for SMTP).
A source that can POST a Security-Hub-style finding to your webhook (EventBridge/SNS, a SIEM, or curl).

Output (Email)

Subject: <short_title> - <resource_id> in <account_id>
Body: HTML summary with Type, Account, Urgency, Why, Next Actions (3 steps), Owner, Success criteria.

1.2 Logical Blocks

This catalog entry is organized from the workflow JSON. The node-level section below shows the executable blocks available for review before importing the template.

2. Block-by-Block Analysis

Block 1 - Webhook

Type / Role: n8n-nodes-base.webhook - webhook
Config choices: Version 2.1

Block 2 - Classify

Type / Role: @n8n/n8n-nodes-langchain.openAi - openAi
Config choices: Version 1.8

Block 3 - Send a message

Type / Role: n8n-nodes-base.gmail - gmail
Config choices: Version 2.1

Block 4 - Plan

Type / Role: @n8n/n8n-nodes-langchain.openAi - openAi
Config choices: Version 1.8

Block 5 - Clean_Finding

Type / Role: n8n-nodes-base.set - set
Config choices: Version 3.4

Block 6 - Sticky Note

Type / Role: n8n-nodes-base.stickyNote - stickyNote
Config choices: Version 1

Block 7 - Sticky Note1

Type / Role: n8n-nodes-base.stickyNote - stickyNote
Config choices: Version 1

3. Summary Table

Workflow	Automate security incident triage with GPT-4o-mini and Gmail notifications
Complexity	intermediate
Nodes	7
Categories	AI Summarization, Multimodal AI
Author	Calistus Christian
Published	24 Aug 2025

4. Reproducing the Workflow from Scratch

1. Download the workflow JSON

Use the JSON export at /data/workflows/7785/7785.json as the source template for this automation.
2. Import the template into n8n

Open n8n, import the downloaded JSON, and review each node before activating the workflow.
3. Configure credentials and variables

Replace placeholder credentials, API keys, webhook URLs, account IDs, and environment-specific values with your own settings.
4. Test with sample data

Run the workflow manually or in a staging workspace, inspect node output, and confirm downstream systems receive the expected data.
5. Activate and monitor

Enable the workflow only after testing, then monitor executions, errors, and rate limits during the first production runs.

5. General Notes & Resources

Review imported nodes carefully before activation. This catalog entry is intended to help you inspect the workflow structure, understand required services, and find related templates faster.

Node names, credentials, schedules, webhook paths, and external service limits may need adjustment for your workspace.

Download workflow JSON Original n8n.io source AI Summarization workflows Multimodal AI workflows

Frequently asked questions

What does Automate security incident triage with GPT-4o-mini and Gmail notifications do?

What do I need before importing this workflow?

Review the workflow JSON, configure any required credentials in n8n, and test the automation in a safe workspace before using it in production.

Can I customize this workflow?

Yes. Use the block-by-block analysis and the downloadable JSON to inspect each node, then adjust credentials, prompts, schedules, filters, or destinations for your AI Summarization, Multimodal AI use case.

Calistus Christian

11 workflows

Nodes

n8n-nodes-base.webhook @n8n/n8n-nodes-langchain.openai n8n-nodes-base.gmail n8n-nodes-base.set n8n-nodes-base.stickynote

Complexity

intermediate

Published 24 Aug 2025

Likes 0

View on n8n.io Download Workflow

Install path: /data/workflows/7785/7785.json

Share Your Workflow

Have a useful automation to share? Publish it and help the community.

Submit Your Template How to Submit

Related Workflows

Build self-improving agent skills with cognee

## Quick overview A self-improving loop for agent skills, powered by the cognee Verified Node. When a skill's review scores below your threshold, it proposes a rewrite, and you approve the before/after diff before it's applied. No code required. ## How it works 1. Execute your workflow. 2. Set the demo inputs (skill name, dataset name, skill procedure markdown, review task text, and the score threshold). 3. Ingest the skill into cognee. 4. Cognee reviews the skill’s performance and returns a JSON with a score and gaps. 5. If the score is below the threshold, the workflow requests a cognee improvement proposal for the skill. 6. The workflow retrieves the full proposal from cognee and builds a human-readable before/after diff. 7. If the proposal is approved, the workflow applies the improvement in cognee, fetches the updated skill, and outputs the updated procedure and diff. ## Setup 1. Create a cognee API credential in n8n and use it in all cognee nodes (Ingest Skill, Review Skill, Propose Improvement, Get Proposal, Apply Improvement, Get Skill). Information for the credential (URL and API key) can be found in your Cognee Cloud account. 2. Update the skill parameters (skill_name, dataset_name, skill_markdown, task_text, score_threshold, and approved) to match your use case. 3. Ensure the referenced cognee dataset name exists so the skill can be stored and retrieved consistently.

View

Generate monthly BigQuery KPI PDF reports with Claude, Google Docs, Outlook and Teams

## Quick overview This workflow runs monthly to query KPI data from Google BigQuery, generates a narrative with Anthropic Claude, fills a Google Docs report template, exports it as a PDF, archives it to OneDrive, emails it via Microsoft Outlook, and posts a summary to Microsoft Teams. ## How it works 1. A schedule trigger fires on the 1st of every month at 07:00 and calculates the start and end dates of the previous full calendar month. 2. Four parallel BigQuery queries fetch revenue KPIs, top product categories, weekly sales trend, and top customers for that period. Each result set is tagged with a source label before merging. 3. All tagged rows are combined and aggregated into a single structured report payload containing KPI summaries, ranked tables, and company metadata. 4. The payload is split across two concurrent branches: one sends it to a Claude Sonnet LLM chain to generate an executive narrative with five sections (summary, revenue analysis, category insights, customer insights, and recommendation), and the other creates a named copy of a Google Docs template in your reports folder. 5. Once both branches complete, the narrative is merged into the report payload and the replacement requests for all template placeholders are constructed. 6. The Google Docs node applies all replacements in a single batchUpdate call, then the file is exported as a PDF via Google Drive. 7. The finished PDF is archived to OneDrive, emailed via Outlook with the report attached, and a formatted KPI summary card is posted to a Microsoft Teams channel. ## Setup 1. Set the following n8n environment variables before activating: GCP_PROJECT_ID, BQ_DATASET, GDOCS_TEMPLATE_FILE_ID, GDRIVE_REPORTS_FOLDER_ID, ONEDRIVE_REPORTS_FOLDER_ID, REPORT_RECIPIENTS, TEAMS_TEAM_ID, and TEAMS_CHANNEL_ID. 2. Connect a Google BigQuery credential and update the four SQL queries to match your dataset, table name, and column names. 3. Connect an Anthropic API credential to the Claude Chat Model sub-node, then manually wire its output to the ai_languageModel input (bottom connector) of the Create AI Narrative with Claude node on the canvas. 4. Connect Google Drive and Google Docs OAuth2 credentials. In Google Drive, create a master report template Doc containing the placeholder strings listed in the Customization section, note its file ID from the URL, and set GDOCS_TEMPLATE_FILE_ID accordingly. 5. Connect Microsoft OneDrive, Outlook, and Teams OAuth2 credentials. Retrieve your Teams team ID and channel ID using the Microsoft Graph Explorer and set the corresponding environment variables. ## Requirements - Google Cloud project with BigQuery enabled and an orders table matching the SQL schema in the workflow - Google Workspace account (Drive and Docs OAuth2 access) - Anthropic API key - Microsoft 365 account with OneDrive, Outlook, and Teams access ## Customization - To change the reporting cadence, update the cron expression in the schedule trigger: 0 7 * * 1 for weekly or 0 7 * * * for daily. - To adapt the SQL queries to your schema, replace orders, order_total, customer_id, is_new_customer, created_at, and product_category with your actual column names. - To change the AI model, update the model field in the Claude Chat Model sub-node. - To add more KPI sections, extend the SQL queries, the aggregation code in Consolidate BigQuery Data, and the replacements array in Construct Replacement Requests.

View

Monitor multi-city courier weather risk with Open-Meteo, GPT-4o, Gemini and Slack

## Quick overview This workflow checks 48-hour forecasts from Open-Meteo for multiple cities on a 6-hour schedule or via an on-demand n8n form, scores conditions against courier-impact thresholds, uses OpenAI (with Google Gemini fallback) to draft Slack-ready alerts, and posts operational updates to a Slack channel. ## How it works 1. Runs every 6 hours on a schedule or starts from an Operations Manager on-demand n8n form submission. 2. Builds a city configuration (all cities for scheduled runs, or a single selected city for on-demand runs) and constructs the Open-Meteo forecast API request. 3. Fetches a 48-hour hourly forecast from Open-Meteo and continues even if the request fails. 4. Scores each city’s forecast against rain, wind, snow, and heat thresholds across multiple time windows, applies 18-hour deduplication for scheduled runs, and flags any city feed failures. 5. Sends the alert candidates to OpenAI to generate a three-sentence, operations-focused message per city (using Google Gemini as the model fallback if configured). 6. Formats each alert as a Slack Block Kit message and posts it to the #ops-weather-alerts channel, and separately posts a Slack error notice if one or more city forecasts could not be fetched. ## Setup 1. Add an OpenAI API credential (used to write the Slack alert messages). 2. Add a Google Gemini (PaLM) API credential if you want the configured fallback model to be available. 3. Add a Slack OAuth2 credential and set or create the target channel (ops-weather-alerts / #ops-weather-alerts) in your Slack workspace. 4. For on-demand checks, share the n8n form URL with your team and update the city dropdown options and the city configuration code if you add or rename cities. 5. Review and adjust the per-city weather thresholds in the city configuration to match your courier operations risk tolerance. ## Requirements - OpenAI API key (GPT-4o / gpt-4o-mini) - Slack OAuth2 credential with chat:write scope - Google Gemini API key (optional, for AI fallback) ## Customization - Add or remove cities by editing the CITIES array in the City config node, no other nodes need to change. - Adjust URGENT/HEADS_UP score thresholds in the Score + dedup node to raise or lower sensitivity per city. - Change the delivery peak windows (default 11:00-14:00 and 17:00-22:00) in the same node to match your market hours. - Swap the Slack channel name in both Slack nodes to route alerts to a different channel. ## Additional info This workflow was built and tested on a self-hosted n8n instance (Oracle Cloud A1 Flex, Ubuntu 24.04) and is fully compatible with n8n Cloud. Weather data is sourced exclusively from Open-Meteo (open-meteo.com), an open-source weather API requiring no authentication. Forecast accuracy follows Open-Meteo's standard model ensemble — verify critical alerts against local meteorological services before operational decisions. Deduplication uses n8n workflow static data (global scope). Clearing static data manually or migrating the workflow to a new instance will reset the deduplication state, causing the next scheduled run to re-evaluate all cities as if no prior alerts have been sent. The GPT-4o prompt includes city-relative climate context so the model understands that an alert in Nairobi means sustained flooding rain, while an alert in Helsinki means genuinely exceptional conditions beyond the Nordic baseline. This prevents generic alert copy across climatically different markets. The form trigger is designed for Operations Managers with no technical background — no n8n access required. Share the webhook URL directly and they can force an immediate check from any browser. Peak delivery windows (11:00-14:00 and 17:00-22:00 local time) are used to escalate severity scoring during high-order-volume periods. Adjust these in the Score + dedup node to match your market's actual peak hours.

View

Need Custom Automation?

Get help designing a custom n8n workflow that connects your stack and fits your process.

Automate security incident triage with GPT-4o-mini and Gmail notifications

Workflow preview

Important notice

1. Workflow Overview

Best for

Tools used

Source and attribution

1.1 Workflow description

What this workflow does

What you'll need

1.2 Logical Blocks

2. Block-by-Block Analysis

Block 1 - Webhook

Block 2 - Classify

Block 3 - Send a message

Block 4 - Plan

Block 5 - Clean_Finding

Block 6 - Sticky Note

Block 7 - Sticky Note1

3. Summary Table

4. Reproducing the Workflow from Scratch

1. Download the workflow JSON

2. Import the template into n8n

3. Configure credentials and variables

4. Test with sample data

5. Activate and monitor

5. General Notes & Resources

Frequently asked questions