{ "name": "Employee offboarding credential risk check with RelayShield", "tags": [ "security", "offboarding", "hr", "relayshield", "identity" ], "nodes": [ { "id": "b2c3d4e5-0000-0000-0000-000000000000", "name": "Sticky Note", "type": "n8n-nodes-base.stickyNote", "position": [ -460, 100 ], "parameters": { "color": 5, "width": 500, "height": 820, "content": "## Employee offboarding credential risk check with RelayShield\n\n### How it works\nRuns when your HR system POSTs to this workflow's webhook after an employee is offboarded. It checks the departing employee's email against three RelayShield signals \u2014 breach exposure, infostealer malware logs, and OAuth token exposure \u2014 and if any risk is found, alerts your security team in Slack, emails the employee's manager, and logs the result to Notion. Clean results are logged too, so every offboarding is auditable.\n\n### Setup steps\n- Point your HR system's offboarding webhook at this workflow's webhook URL, posting `{ email, name, department, manager_email }`\n- Add your RelayShield API credentials to all three RelayShield nodes\n- Set `notionOffboardingDbId` and `slackSecurityChannelId` in your n8n variables\n- Connect and authorize the Gmail and Slack credentials\n\n### Customization\nAdd more RelayShield checks (e.g. NHI exposure, identity graph) to broaden the risk signals, or adjust the alert routing to match your own security escalation process." }, "typeVersion": 1 }, { "id": "b2c3d4e5-0001-0001-0001-000000000001", "name": "HR Webhook \u2014 Employee Offboarded", "type": "n8n-nodes-base.webhook", "notes": "Receives an HTTP POST from your HR system when an employee is offboarded. Expected payload: { \"email\": \"employee@company.com\", \"name\": \"John Smith\", \"department\": \"Engineering\", \"manager_email\": \"manager@company.com\" }", "position": [ 240, 300 ], "parameters": { "path": "employee-offboard", "options": {}, "httpMethod": "POST", "responseData": "firstEntryJson", "responseMode": "onReceived" }, "typeVersion": 2 }, { "id": "b2c3d4e5-0002-0002-0002-000000000002", "name": "RelayShield - Breach Check", "type": "n8n-nodes-relayshield.relayShield", "notes": "Checks the departing employee's email for known credential breaches. A breach on an offboarded account that still has system access is an elevated risk.", "position": [ 480, 160 ], "parameters": { "email": "={{ $json.email }}", "operation": "breach" }, "credentials": { "relayShieldApi": { "name": "" } }, "typeVersion": 1 }, { "id": "b2c3d4e5-0003-0003-0003-000000000003", "name": "RelayShield - Infostealer Check", "type": "n8n-nodes-relayshield.relayShield", "notes": "Checks whether the employee's credentials appear in infostealer malware logs \u2014 indicating their device may have exfiltrated corporate credentials before departure.", "position": [ 480, 300 ], "parameters": { "email": "={{ $json.email }}", "operation": "infostealer" }, "credentials": { "relayShieldApi": { "name": "" } }, "typeVersion": 1 }, { "id": "b2c3d4e5-0004-0004-0004-000000000004", "name": "RelayShield - OAuth Watchlist", "type": "n8n-nodes-relayshield.relayShield", "notes": "Checks whether the employee's credentials appear in OAuth token exposure records \u2014 active tokens for Slack, GitHub, Google Workspace etc. that could persist after account deactivation.", "position": [ 480, 440 ], "parameters": { "email": "={{ $json.email }}", "operation": "oauthWatchlist" }, "credentials": { "relayShieldApi": { "name": "" } }, "typeVersion": 1 }, { "id": "b2c3d4e5-0005-0005-0005-000000000005", "name": "Any Credential Risk Found?", "type": "n8n-nodes-base.if", "notes": "Triggers alert path if breach, infostealer activity, or OAuth token exposure is found on the departing employee.", "position": [ 720, 300 ], "parameters": { "conditions": { "options": { "leftValue": "", "caseSensitive": true, "typeValidation": "strict" }, "combinator": "or", "conditions": [ { "id": "cond-001", "operator": { "type": "number", "operation": "gt" }, "leftValue": "={{ $('RelayShield - Breach Check').item.json.breach_count }}", "rightValue": 0 }, { "id": "cond-002", "operator": { "type": "boolean", "operation": "true" }, "leftValue": "={{ $('RelayShield - Infostealer Check').item.json.found }}", "rightValue": true }, { "id": "cond-003", "operator": { "type": "boolean", "operation": "true" }, "leftValue": "={{ $('RelayShield - OAuth Watchlist').item.json.matched }}", "rightValue": true } ] } }, "typeVersion": 2 }, { "id": "b2c3d4e5-0006-0006-0006-000000000006", "name": "Log Risk to Notion", "type": "n8n-nodes-base.notion", "notes": "Creates a page in your offboarding risk log Notion database. Set notionOffboardingDbId in your n8n variables to your database ID.", "position": [ 960, 160 ], "parameters": { "title": "={{ $('HR Webhook \u2014 Employee Offboarded').item.json.name }} \u2014 Offboarding Risk Flag", "resource": "page", "operation": "create", "databaseId": { "__rl": true, "mode": "id", "value": "={{ $vars.notionOffboardingDbId }}" }, "propertiesUi": { "propertyValues": [ { "key": "Employee Email", "textValue": "={{ $('HR Webhook \u2014 Employee Offboarded').item.json.email }}" }, { "key": "Department", "textValue": "={{ $('HR Webhook \u2014 Employee Offboarded').item.json.department }}" }, { "key": "Breach Count", "textValue": "={{ $('RelayShield - Breach Check').item.json.breach_count }}" }, { "key": "Infostealer Detected", "textValue": "={{ $('RelayShield - Infostealer Check').item.json.found ? 'Yes' : 'No' }}" }, { "key": "OAuth Exposure", "textValue": "={{ $('RelayShield - OAuth Watchlist').item.json.matched ? 'Yes' : 'No' }}" }, { "key": "Status", "textValue": "Pending Review" } ] }, "authentication": "oAuth2" }, "credentials": { "notionApi": { "name": "" } }, "typeVersion": 2.2 }, { "id": "b2c3d4e5-0007-0007-0007-000000000007", "name": "Alert Security Team in Slack", "type": "n8n-nodes-base.slack", "notes": "Posts a structured security alert to your security/IT Slack channel. Set slackSecurityChannelId in your n8n variables. Requires Slack Bot Token credentials.", "position": [ 960, 300 ], "parameters": { "select": "channel", "blocksUi": { "blocksValues": [ { "type": "header", "textUi": { "text": "\ud83d\udea8 Offboarding Security Risk \u2014 {{ $('HR Webhook \u2014 Employee Offboarded').item.json.name }}" } }, { "type": "section", "textUi": { "text": "*Employee:* {{ $('HR Webhook \u2014 Employee Offboarded').item.json.email }}\n*Department:* {{ $('HR Webhook \u2014 Employee Offboarded').item.json.department }}\n*Manager:* {{ $('HR Webhook \u2014 Employee Offboarded').item.json.manager_email }}\n\n*RelayShield Findings:*\n\u2022 Breaches detected: {{ $('RelayShield - Breach Check').item.json.breach_count }}\n\u2022 Infostealer activity: {{ $('RelayShield - Infostealer Check').item.json.found ? '\u26a0\ufe0f YES' : '\u2713 None' }}\n\u2022 OAuth token exposure: {{ $('RelayShield - OAuth Watchlist').item.json.matched ? '\u26a0\ufe0f YES' : '\u2713 None' }}\n\n*Recommended actions:*\n\u2022 Verify all system access has been revoked\n\u2022 Rotate any shared credentials the employee had access to\n\u2022 Review OAuth token grants for corporate apps" } } ] }, "channelId": { "__rl": true, "mode": "id", "value": "={{ $vars.slackSecurityChannelId }}" }, "messageType": "block" }, "credentials": { "slackApi": { "name": "" } }, "typeVersion": 2.2 }, { "id": "b2c3d4e5-0008-0008-0008-000000000008", "name": "Email Manager", "type": "n8n-nodes-base.gmail", "notes": "Sends a summary email to the departing employee's manager with findings and recommended actions.", "position": [ 960, 440 ], "parameters": { "sendTo": "={{ $('HR Webhook \u2014 Employee Offboarded').item.json.manager_email }}", "message": "=

Hi,

\n

RelayShield has flagged a credential security risk during the offboarding of {{ $('HR Webhook \u2014 Employee Offboarded').item.json.name }} ({{ $('HR Webhook \u2014 Employee Offboarded').item.json.email }}).

\n\n\n \n \n \n \n
CheckResult
Credential Breaches{{ $('RelayShield - Breach Check').item.json.breach_count }} breach(es) found
Infostealer Activity{{ $('RelayShield - Infostealer Check').item.json.found ? '\u26a0\ufe0f Device infection detected' : '\u2713 None detected' }}
OAuth Token Exposure{{ $('RelayShield - OAuth Watchlist').item.json.matched ? '\u26a0\ufe0f Active token exposure found' : '\u2713 None detected' }}
\n\n

Please verify:

\n
    \n
  • All system and application access has been revoked
    • \n
  • Shared passwords or API keys the employee had access to have been rotated
    • \n
  • Any OAuth connections to corporate tools (GitHub, Slack, Google) have been reviewed
    • \n
\n\n

Your IT security team has been notified. A log has been created in your offboarding risk tracker.

\n
\n

Powered by RelayShield \u2014 relayshield.net

", "options": {}, "subject": "Action Required \u2014 Offboarding Security Risk for {{ $('HR Webhook \u2014 Employee Offboarded').item.json.name }}", "emailType": "html" }, "credentials": { "gmailOAuth2": { "name": "" } }, "typeVersion": 2.1 }, { "id": "b2c3d4e5-0009-0009-0009-000000000009", "name": "Log Clean Result to Notion", "type": "n8n-nodes-base.notion", "notes": "Logs a clean result to Notion so every offboarding is auditable, even when no risk is found.", "position": [ 960, 580 ], "parameters": { "title": "={{ $('HR Webhook \u2014 Employee Offboarded').item.json.name }} \u2014 Offboarding Complete (No Risk)", "resource": "page", "operation": "create", "databaseId": { "__rl": true, "mode": "id", "value": "={{ $vars.notionOffboardingDbId }}" }, "propertiesUi": { "propertyValues": [ { "key": "Employee Email", "textValue": "={{ $('HR Webhook \u2014 Employee Offboarded').item.json.email }}" }, { "key": "Status", "textValue": "Clean \u2014 No Action Required" } ] }, "authentication": "oAuth2" }, "credentials": { "notionApi": { "name": "" } }, "typeVersion": 2.2 } ], "settings": { "callerPolicy": "workflowsFromSameOwner", "errorWorkflow": "", "executionOrder": "v1", "saveManualExecutions": true }, "updatedAt": "2026-06-24T00:00:00.000Z", "versionId": "v1", "staticData": null, "connections": { "Any Credential Risk Found?": { "main": [ [ { "node": "Log Risk to Notion", "type": "main", "index": 0 }, { "node": "Alert Security Team in Slack", "type": "main", "index": 0 }, { "node": "Email Manager", "type": "main", "index": 0 } ], [ { "node": "Log Clean Result to Notion", "type": "main", "index": 0 } ] ] }, "RelayShield - Breach Check": { "main": [ [ { "node": "Any Credential Risk Found?", "type": "main", "index": 0 } ] ] }, "RelayShield - OAuth Watchlist": { "main": [ [ { "node": "Any Credential Risk Found?", "type": "main", "index": 0 } ] ] }, "RelayShield - Infostealer Check": { "main": [ [ { "node": "Any Credential Risk Found?", "type": "main", "index": 0 } ] ] }, "HR Webhook \u2014 Employee Offboarded": { "main": [ [ { "node": "RelayShield - Breach Check", "type": "main", "index": 0 }, { "node": "RelayShield - Infostealer Check", "type": "main", "index": 0 }, { "node": "RelayShield - OAuth Watchlist", "type": "main", "index": 0 } ] ] } }, "triggerCount": 0 }