The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
cortexApiimaptheHiveApi
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
Analyze emails with S1EM. Uses emailReadImap, theHive, cortex. Manual trigger; 15 nodes.
Source: https://github.com/tommyshum/n8n_template_library/blob/87d0b7db31db00fcf781424ca7d9e86f1c9a9e1b/templates/official/template_1602/workflow.json — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
Email. Uses emailReadImap, theHive, cortex. Manual trigger; 15 nodes.
With workflow, you analyze Email with TheHive/Cortex
Email. Uses emailReadImap, theHive, cortex. Event-driven trigger; 16 nodes.
If you are a postmaster or you manage email server, you can set up DKIM and SPF records to ensure that spoofing your email address is hard. On your domain you can also set up DMARC record to receive X
This workflow automates URL reporting to Spamhaus based on incoming spam/phishing sample emails. It watches one or more IMAP folders, extracts URLs from each email body, removes duplicates and common