Adnan Tariq This workflow corresponds to n8n.io template #6413 — we link there as the canonical source.
This workflow follows the Emailsend → Google Sheets recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"id": "TnwffwDzH9RBOYrl",
"name": "M5 - Auto-Responder",
"tags": [],
"nodes": [
{
"id": "cb6ec5c4-564a-46ab-ae8d-d6afa03afdad",
"name": "Schedule Trigger",
"type": "n8n-nodes-base.scheduleTrigger",
"position": [
-940,
260
],
"parameters": {},
"typeVersion": 1.2
},
{
"id": "7806a940-9fbd-4b08-a1cf-78d32a5efda4",
"name": "\ud83d\udce7 Send Email Alert",
"type": "n8n-nodes-base.emailSend",
"position": [
40,
260
],
"parameters": {},
"typeVersion": 1
},
{
"id": "10565b12-171a-4cd2-9601-dae128d66bd9",
"name": "HTTP Request",
"type": "n8n-nodes-base.httpRequest",
"disabled": true,
"position": [
0,
0
],
"parameters": {},
"typeVersion": 4.2
},
{
"id": "a1821764-8318-4db9-9d5c-04a338f32460",
"name": "Google Sheets",
"type": "n8n-nodes-base.googleSheets",
"position": [
320,
260
],
"parameters": {},
"typeVersion": 4.5
},
{
"id": "aaab98dd-af7f-436f-8bb1-4fb8e4683788",
"name": "\ud83d\udcc4 Read Threat Data",
"type": "n8n-nodes-base.googleSheets",
"position": [
-700,
260
],
"parameters": {},
"typeVersion": 3
},
{
"id": "9ba1f731-4b78-43c3-8f13-305ba42aa6e2",
"name": "Classify Critical Alerts",
"type": "n8n-nodes-base.if",
"position": [
-500,
260
],
"parameters": {},
"typeVersion": 1
},
{
"id": "609f13d2-80ff-4aca-9e7f-251c95695b63",
"name": "Aggregate",
"type": "n8n-nodes-base.aggregate",
"position": [
-240,
240
],
"parameters": {},
"typeVersion": 1
},
{
"id": "6f967833-b2be-45a8-bc1a-2e3f272208e7",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
-880,
-80
],
"parameters": {
"content": ""
},
"typeVersion": 1
}
],
"active": false,
"settings": {
"executionOrder": "v1"
},
"versionId": "562b5bff-d41a-4662-af83-5f19f0a95bc6",
"connections": {
"Aggregate": {
"main": [
[
{
"node": "\ud83d\udce7 Send Email Alert",
"type": "main",
"index": 0
}
]
]
},
"Schedule Trigger": {
"main": [
[
{
"node": "\ud83d\udcc4 Read Threat Data",
"type": "main",
"index": 0
}
]
]
},
"\ud83d\udcc4 Read Threat Data": {
"main": [
[
{
"node": "Classify Critical Alerts",
"type": "main",
"index": 0
}
]
]
},
"\ud83d\udce7 Send Email Alert": {
"main": [
[
{
"node": "Google Sheets",
"type": "main",
"index": 0
}
]
]
},
"Classify Critical Alerts": {
"main": [
[
{
"node": "Aggregate",
"type": "main",
"index": 0
}
]
]
}
}
}
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
👤 Who it’s for SOC teams, incident responders, or solo defenders who need to automatically act on critical threats without manual triage.
Source: https://n8n.io/workflows/6413/ — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
Security teams, DevOps engineers, vulnerability analysts, and automation builders who want to eliminate repetitive Nessus scan parsing, AI-based risk triage, and manual reporting. Designed for orgs fo
This n8n workflow automatically finds apartments for rent in Germany, filters them by your city, rent budget, and number of rooms, and applies to them via email. Each application includes: A personali
👤 Who it’s for Blue Team leads, CISOs, and SOC managers who want automated visibility into threat metrics, endpoint alerts, and response actions — without needing a full SIEM or BI platform.
Workflow Overview Zoom Attendance Evaluator with Follow-up is an n8n automation workflow that automatically evaluates Zoom meeting attendance and sends follow-up emails to no-shows and early leavers w
This workflow automatically monitors Amazon product prices, tracks price changes, and sends alerts when significant price fluctuations occur. Built with ScrapeOps' structured data API, it provides a r