{
  "name": "Alert on Falcon Guard GBP changes via Slack",
  "nodes": [
    {
      "parameters": {
        "content": "## Alert on Falcon Guard GBP Changes via Slack\n\n**Who is this for:** Business owners and agencies using Falcon Guard to monitor Google Business Profiles who need immediate alerts when unauthorized changes or suspicious activity is detected.\n\n**What this workflow does:**\n1. Checks Falcon Guard protected locations every 6 hours\n2. Compares current GBP data against the last known state\n3. Detects changes to business name, address, phone, hours, or categories\n4. Sends immediate Slack alert with change details\n5. Logs all changes to Google Sheets for audit trail\n\n**How to set up:**\n1. Add your Local Falcon API credentials (get your key at https://www.localfalcon.com/api/credentials)\n2. Connect your Slack workspace\n3. Create a Google Sheet for change logging\n4. Configure notification channel in Settings\n5. Activate the workflow\n\n**Requirements:**\n- Local Falcon account with Falcon Guard enabled\n- Locations added to Falcon Guard protection\n- Slack workspace with posting permissions\n\n**How to customize:**\n- Add email alerts for critical changes\n- Filter for specific location types\n- Adjust check frequency for high-risk profiles\n- Integrate with ticketing system for remediation tracking",
        "height": 580,
        "width": 460,
        "color": 5
      },
      "id": "sticky-main",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        100,
        -200
      ]
    },
    {
      "parameters": {
        "content": "### Why Monitor GBP Changes?\n\nGoogle removed 20M+ fake profiles in 2022 and 115M+ fake reviews in 2023. GBP hijacking is a growing threat where:\n\n- Competitors change your phone number\n- Spammers alter business hours\n- Bad actors modify your address\n\nFalcon Guard + this workflow = 24/7 protection",
        "height": 220,
        "width": 320
      },
      "id": "sticky-context",
      "name": "Sticky Note Context",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        580,
        -200
      ]
    },
    {
      "parameters": {
        "content": "### Step 1: Schedule\nChecks every 6 hours for changes.",
        "height": 100,
        "width": 200
      },
      "id": "sticky-step1",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        40,
        680
      ]
    },
    {
      "parameters": {
        "content": "### Step 2: Settings\nConfigure alert preferences.",
        "height": 100,
        "width": 200
      },
      "id": "sticky-step2",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        300,
        680
      ]
    },
    {
      "parameters": {
        "content": "### Step 3: Get Locations\nFetches all Falcon Guard protected locations.",
        "height": 100,
        "width": 200
      },
      "id": "sticky-step3",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        560,
        680
      ]
    },
    {
      "parameters": {
        "content": "### Step 4: Check Changes\nCompares data and identifies modifications.",
        "height": 100,
        "width": 200
      },
      "id": "sticky-step4",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        820,
        680
      ]
    },
    {
      "parameters": {
        "content": "### Step 5: Alert\nSends notification if changes detected.",
        "height": 100,
        "width": 200
      },
      "id": "sticky-step5",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        1080,
        680
      ]
    },
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "hoursInterval": 6
            }
          ]
        }
      },
      "id": "schedule",
      "name": "Every 6 Hours",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        140,
        460
      ]
    },
    {
      "parameters": {
        "mode": "raw",
        "jsonOutput": "{\n  \"slackChannel\": \"#gbp-alerts\",\n  \"logSheetId\": \"YOUR_GOOGLE_SHEET_ID\",\n  \"criticalFields\": [\"phone\", \"address\", \"name\", \"website\"]\n}",
        "options": {}
      },
      "id": "settings",
      "name": "Alert Settings",
      "type": "n8n-nodes-base.set",
      "typeVersion": 3.4,
      "position": [
        400,
        460
      ]
    },
    {
      "parameters": {
        "resource": "falconGuard",
        "operation": "listLocations",
        "additionalFields": {
          "limit": 100,
          "status": "protected"
        }
      },
      "id": "get-locations",
      "name": "Get Protected Locations",
      "type": "@local-falcon/n8n-nodes-localfalcon.localFalcon",
      "typeVersion": 1,
      "position": [
        660,
        460
      ],
      "credentials": {
        "localFalconApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "jsCode": "const settings = $('Alert Settings').first().json;\nconst locations = $input.first().json.locations || [];\nconst alerts = [];\n\nfor (const location of locations) {\n  // Check if there are any recent changes flagged by Falcon Guard\n  if (location.changes && location.changes.length > 0) {\n    for (const change of location.changes) {\n      const isCritical = settings.criticalFields.includes(change.field);\n      \n      alerts.push({\n        location_name: location.name || 'Unknown',\n        place_id: location.place_id,\n        field: change.field,\n        old_value: change.old_value || 'N/A',\n        new_value: change.new_value || 'N/A',\n        detected_at: change.detected_at || new Date().toISOString(),\n        is_critical: isCritical\n      });\n    }\n  }\n}\n\n// Stop if no changes\nif (alerts.length === 0) {\n  return [];\n}\n\n// Build Slack message\nconst criticalCount = alerts.filter(a => a.is_critical).length;\nlet message = `:rotating_light: *Falcon Guard Alert*\\n\\n`;\n\nif (criticalCount > 0) {\n  message += `:red_circle: *${criticalCount} CRITICAL change(s) detected!*\\n\\n`;\n}\n\nmessage += `*${alerts.length} total change(s) detected:*\\n\\n`;\n\nfor (const alert of alerts) {\n  const icon = alert.is_critical ? ':red_circle:' : ':yellow_circle:';\n  message += `${icon} *${alert.location_name}*\\n`;\n  message += `   Field: ${alert.field}\\n`;\n  message += `   Changed: \"${alert.old_value}\" \u2192 \"${alert.new_value}\"\\n`;\n  message += `   Detected: ${alert.detected_at}\\n\\n`;\n}\n\nmessage += `_Review these changes immediately in Local Falcon Falcon Guard_`;\n\nreturn [{\n  json: {\n    alerts,\n    alertCount: alerts.length,\n    criticalCount,\n    slackMessage: message,\n    slackChannel: settings.slackChannel\n  }\n}];"
      },
      "id": "check-changes",
      "name": "Check for Changes",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        920,
        460
      ]
    },
    {
      "parameters": {
        "select": "channel",
        "channelId": {
          "__rl": true,
          "mode": "name",
          "value": "={{ $json.slackChannel }}"
        },
        "text": "={{ $json.slackMessage }}",
        "otherOptions": {}
      },
      "id": "slack-alert",
      "name": "Send Alert to Slack",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.2,
      "position": [
        1180,
        460
      ],
      "credentials": {
        "slackApi": {
          "name": "<your credential>"
        }
      }
    }
  ],
  "connections": {
    "Every 6 Hours": {
      "main": [
        [
          {
            "node": "Alert Settings",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert Settings": {
      "main": [
        [
          {
            "node": "Get Protected Locations",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Protected Locations": {
      "main": [
        [
          {
            "node": "Check for Changes",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check for Changes": {
      "main": [
        [
          {
            "node": "Send Alert to Slack",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "meta": {
    "templateCredsSetupCompleted": true
  }
}