Automate Security Incident Triage with Gpt-4o-mini and Gmail Notifications

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

{
  "id": "9R3de4CVLxlzUZuO",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "name": "Mini SOC Triage",
  "tags": [],
  "nodes": [
    {
      "id": "a9c71043-da13-45b2-954a-93f2e6c3832d",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "mini-triage",
        "options": {},
        "httpMethod": "POST"
      },
      "typeVersion": 2.1
    },
    {
      "id": "68cf1b53-2710-4218-a3b7-9f9a842a7b2e",
      "name": "Classify",
      "type": "@n8n/n8n-nodes-langchain.openAi",
      "position": [
        448,
        0
      ],
      "parameters": {
        "modelId": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4o-mini",
          "cachedResultName": "GPT-4O-MINI"
        },
        "options": {
          "temperature": 0.2
        },
        "messages": {
          "values": [
            {
              "role": "system",
              "content": "You are the SOC Classifier. Output VALID JSON only with keys:\n{\n  \"incident_type\": \"creds|malware|network|data|cloud|other\",\n  \"severity\": \"P0|P1|P2|P3\",\n  \"urgency\": \"now|today|this_week\",\n  \"short_title\": \"\u226412 words\",\n  \"why\": \"\u226450 words\"\n}\nRules:\n- Prefer \"cloud\" if resource_type looks like cloud infra (e.g., AwsS3Bucket, SecurityGroup, IAM).\n- If title contains \"public\", \"exposed\", \"leak\" \u2192 data|cloud depending on resource.\n- If unclear, return \"other\" and P3, but try to use title/description before giving up.\n- Be conservative with P0.\n\nExamples:\nInput: {\"title\":\"S3 bucket public READ\",\"description\":\"ACL allows public READ\",\"resource_type\":\"AwsS3Bucket\"}\nOutput: {\"incident_type\":\"cloud\",\"severity\":\"P2\",\"urgency\":\"today\",\"short_title\":\"Public S3 read\",\"why\":\"Public READ on bucket risks data exposure.\"}\n\nInput: {\"title\":\"Multiple failed logins\",\"description\":\"probable credential stuffing\"}\nOutput: {\"incident_type\":\"creds\",\"severity\":\"P2\",\"urgency\":\"today\",\"short_title\":\"Credential stuffing suspected\",\"why\":\"Repeated failures indicate attack; monitor & protect accounts.\"}\n"
            }
          ]
        },
        "jsonOutput": true
      },
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.8
    },
    {
      "id": "11785568-2cdb-4541-98b8-f9ae659a0f3d",
      "name": "Send a message",
      "type": "n8n-nodes-base.gmail",
      "position": [
        1152,
        0
      ],
      "parameters": {
        "sendTo": "user@example.com",
        "message": "=<h3>\n  {{ $('Classify').item.json.message.content.short_title }}\n  ({{ $('Classify').item.json.message.content.severity }})\n</h3>\n\n<p>\n  <b>Type:</b> {{ $('Classify').item.json.message.content.incident_type }}\n  &nbsp;|&nbsp;\n  <b>Resource Name:</b> {{ $('Clean_Finding').item.json.resource_id }}\n</p>\n\n<p>\n  <b>Account:</b> {{ $('Clean_Finding').item.json.account_id }}\n</p>\n\n<p>\n  <b>Urgency:</b> {{ $('Classify').item.json.message.content.urgency }}\n</p>\n\n<p>\n  <b>Why:</b> {{ $('Classify').item.json.message.content.why }}\n</p>\n\n<p><b>Next Actions</b></p>\n<ol>\n  <li>{{ $json.message.content.next_actions[0] }}</li>\n  <li>{{ $json.message.content.next_actions[1] }}</li>\n  <li>{{ $json.message.content.next_actions[2] }}</li>\n</ol>\n\n<p>\n  <b>Owner:</b> {{ $json.message.content.owner_hint }} <br/>\n  <b>Success:</b> {{ $json.message.content.success_criteria }}\n</p>\n",
        "options": {},
        "subject": "={{ $('Classify').item.json.message.content.short_title }}- {{ $('Clean_Finding').item.json.resource_id }} in {{ $('Clean_Finding').item.json.account_id }}"
      },
      "credentials": {
        "gmailOAuth2": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 2.1
    },
    {
      "id": "b2de9927-f64c-4a41-83f2-fb41e6d8d9e8",
      "name": "Plan",
      "type": "@n8n/n8n-nodes-langchain.openAi",
      "position": [
        800,
        0
      ],
      "parameters": {
        "modelId": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4o-mini",
          "cachedResultName": "GPT-4O-MINI"
        },
        "options": {
          "temperature": 0.2
        },
        "messages": {
          "values": [
            {
              "role": "system",
              "content": "You are the Remediation Planner. Based on the classifier output and original finding, return VALID JSON:\n{\n  \"next_actions\": [\"step 1\", \"step 2\", \"step 3\"],\n  \"owner_hint\": \"who should act first (e.g., Cloud On-Call, IAM, EDR)\",\n  \"success_criteria\": \"what proves it's resolved\"\n}\nKeep it to 3 atomic steps max. No speculation.\n"
            },
            {
              "content": "=Classifier:\n```json\n{{$node[\"Classify\"].json}}\n{{$node[\"Webhook\"].json}}\n\n"
            }
          ]
        },
        "jsonOutput": true
      },
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.8
    },
    {
      "id": "34aa6438-b428-4720-90b7-89c25bf16619",
      "name": "Clean_Finding",
      "type": "n8n-nodes-base.set",
      "position": [
        224,
        0
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "d9f10bb7-9869-4f49-a44d-3ca7beb3e0e9",
              "name": "Title",
              "type": "string",
              "value": "={{ $json.body.detail.findings[0].Title }}"
            },
            {
              "id": "df567881-cff9-40b3-acf1-d3e4b6499802",
              "name": "Description",
              "type": "string",
              "value": "={{ $json.body.detail.findings[0].Description }}"
            },
            {
              "id": "86a3f987-3bbe-4e16-8964-403b435f89cf",
              "name": "account_id",
              "type": "string",
              "value": "={{ $json.body.detail.findings[0].AwsAccountId }}"
            },
            {
              "id": "4ca89192-e879-435e-89c8-4e66a1e4ab77",
              "name": "resource_id",
              "type": "string",
              "value": "={{ $json.body.detail.findings[0].Resources[0].Id }}"
            },
            {
              "id": "9823717a-0340-4787-8d1c-b3fc118ad675",
              "name": "resource_type",
              "type": "string",
              "value": "={{ $json.body.detail.findings[0].Resources[0].Type }}"
            },
            {
              "id": "061b1afc-f74b-4743-9dab-55cb16fa061c",
              "name": "updated_at",
              "type": "string",
              "value": "={{$json.detail?.findings?.[0]?.UpdatedAt || new Date().toISOString()}}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "8f1880b6-bc09-4cc1-b587-9e4b92146927",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -480,
        -64
      ],
      "parameters": {
        "color": 4,
        "width": 384,
        "height": 336,
        "content": "\ud83d\udce5 ENTRY \n\nSend a POST to /mini-triage to get started!\n\nExample:\n\ncurl -X POST \"$YOUR_WEBHOOK_URL\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"detail\": {\n      \"findings\": [{\n        \"Title\": \"Multiple failed logins\",\n        \"Description\": \"probable credential stuffing\",\n        \"AwsAccountId\": \"111111111111\",\n        \"Resources\": [{ \"Id\": \"user:alice@example.com\", \"Type\": \"AwsIamUser\" }]\n      }]\n    }\n  }'\n"
      },
      "typeVersion": 1
    },
    {
      "id": "37bc3107-c1ac-4386-817c-95a0009cf9c0",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -464,
        304
      ],
      "parameters": {
        "color": 6,
        "width": 336,
        "height": 128,
        "content": "\u2709\ufe0f EMAIL & SECURITY\n  \nSubject = <short_title> - <resource_id> in <account_id>  \nReplace with your email/SMTP  \nKeep creds in n8n Credentials, not nodes"
      },
      "typeVersion": 1
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "39333a9c-5775-4440-aca6-0532fe50e307",
  "connections": {
    "Plan": {
      "main": [
        [
          {
            "node": "Send a message",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Webhook": {
      "main": [
        [
          {
            "node": "Clean_Finding",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify": {
      "main": [
        [
          {
            "node": "Plan",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Clean_Finding": {
      "main": [
        [
          {
            "node": "Classify",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

• gmailOAuth2
• openAiApi

About this workflow

What this workflow does

Source: https://n8n.io/workflows/7785/ — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.