AutomationFlowsData & Sheets › Auto-classify Security Incidents with Gpt-4 and Google Sheets for Soc Teams

Auto-classify Security Incidents with Gpt-4 and Google Sheets for Soc Teams

ByAdnan Tariq @adnantariq on n8n.io

Blue Team leads, SOC analysts, and IT responders looking to automatically classify security alerts using AI-driven logic and asset-based risk signals.

Cron / scheduled trigger★★★★☆ complexity6 nodesGoogle SheetsHTTP Request
Data & Sheets Trigger: Cron / scheduled Nodes: 6 Complexity: ★★★★☆ Added:

This workflow corresponds to n8n.io template #6412 — we link there as the canonical source.

This workflow follows the Google Sheets → HTTP Request recipe pattern — see all workflows that pair these two integrations.

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

Download .json
{
  "id": "QW7kCwPVKSKLDhCx",
  "name": "M4 - Incident Classifier",
  "tags": [],
  "nodes": [
    {
      "id": "46dd925e-64ff-484b-aaa5-5bb74a7b2962",
      "name": "\u270f\ufe0f Format Tags",
      "type": "n8n-nodes-base.set",
      "position": [
        640,
        0
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "505923f8-9721-4f62-a2ea-ce19696d3991",
      "name": "\ud83d\udcc4 Google Sheets - Read Alerts",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        220,
        0
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "98817baf-2004-4bae-b934-66dec5ba7187",
      "name": "\ud83e\udde0 Classify Incident (GPT)",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        440,
        0
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "618eeced-d0f2-4903-9217-150c38a95509",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        0,
        0
      ],
      "parameters": {},
      "typeVersion": 1.2
    },
    {
      "id": "4f3d43dd-e63b-4c27-8590-ef7a2c9f8a3e",
      "name": "Google Sheets",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        820,
        0
      ],
      "parameters": {},
      "typeVersion": 4.5
    },
    {
      "id": "7aaf5255-ba15-477c-b4c5-d3e4626fdd84",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        80,
        -220
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "c0181fb9-37ad-4204-8630-4741b3f5e72e",
  "connections": {
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "\ud83d\udcc4 Google Sheets - Read Alerts",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "\u270f\ufe0f Format Tags": {
      "main": [
        [
          {
            "node": "Google Sheets",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "\ud83e\udde0 Classify Incident (GPT)": {
      "main": [
        [
          {
            "node": "\u270f\ufe0f Format Tags",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "\ud83d\udcc4 Google Sheets - Read Alerts": {
      "main": [
        [
          {
            "node": "\ud83e\udde0 Classify Incident (GPT)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Pro

For the full experience including quality scoring and batch install features for each workflow upgrade to Pro

About this workflow

Blue Team leads, SOC analysts, and IT responders looking to automatically classify security alerts using AI-driven logic and asset-based risk signals.

Source: https://n8n.io/workflows/6412/ — original creator credit. Request a take-down →

More Data & Sheets workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.

Data & Sheets

This workflow automates video distribution to 9 social platforms simultaneously using Blotato's API. It includes both a scheduled publisher (checks Google Sheets for videos marked "Ready") and a subwo

Google Sheets, HTTP Request, Form Trigger +2
Data & Sheets

YogiAI. Uses googleSheets, googleSheetsTool, httpRequest, stopAndError. Scheduled trigger; 61 nodes.

Google Sheets, Google Sheets Tool, HTTP Request +1
Data & Sheets

This workflow monitors Google Calendar for events indicating that a customer will visit the company today or the next day, retrieves the required details, and sends reminder notifications to the relev

Google Calendar, Google Sheets, HTTP Request +1
Data & Sheets

ofn hook v0.24.0 beta. Uses start, httpRequest, functionItem, itemLists. Scheduled trigger; 42 nodes.

Start, HTTP Request, Function Item +3
Data & Sheets

Security teams, DevOps engineers, vulnerability analysts, and automation builders who want to eliminate repetitive Nessus scan parsing, AI-based risk triage, and manual reporting. Designed for orgs fo

Email Send, HTTP Request, Google Sheets +1