Notify_user_in_Slack_of_quarantined_email_and_create_Jira_ticket_if_opened
Configured with HTTP Request, Jira, Slack, Webhook. Review the connections and setup before adapting this template.
Node categories in this workflow
- Routing
- Trigger
- Web / API
- Integration
- Messaging
- Code
Icons describe general node roles, inferred from node types. Inspect the parameters for the configured action.
Drag to pan; use + and − to zoom. Reconstructed from the exported node positions; nothing runs here. Dashed lines represent non-main connections. Full node names and notes appear below.
How it works
The exported workflow contains the following configured nodes. Their connections are shown above; inspect the JSON for the complete logic, expressions, and external actions.
| Node | Category | Type | Operation |
|---|---|---|---|
| has email been opened? | Routing | If | See node parameters |
| Receive Sublime Security Alert | Trigger | Webhook | See node parameters |
| Get message details in Sublime Security | Web / API | HTTP Request | See node parameters |
| Jira Software | Integration | Jira | See node parameters |
| lookup slack user by email | Web / API | HTTP Request | See node parameters |
| user found? | Routing | If | See node parameters |
| Found, notify user | Messaging | Slack | See node parameters |
| Not Found, Do Nothing | Routing | No Op | See node parameters |
| No, do nothing | Routing | No Op | See node parameters |
| Yes, prep flaggedRules table | Code | Code | See node parameters |
Setup
- Download the JSON and import it into an isolated n8n instance. Leave the workflow inactive.
- Connect your own credentials through n8n’s credential store. Replace
REPLACE_WITH_*values with your resource identifiers. - Inspect API destinations, Code nodes, database queries, file paths, and outbound actions.
- Run with synthetic data and harmless destinations. Enable triggers only after checking the actual outputs.
Requirements
An n8n instance with the listed node types and compatible versions. Service-connected workflows may require accounts, credentials, or paid APIs.
Credential types declared in the source
httpHeaderAuthjiraSoftwareCloudApislackApislackOAuth2Api
Workflow notes
Workflow Overview
Workflow Overview
This workflow is initiated by Sublime Security whenever an inbound email undergoes scanning and triggers an alert.
In the event that Sublime Security is set up to automatically quarantine the email, this workflow will make an effort to inform the recipient through Slack. To accomplish this, it will utilize the recipient's mailbox address to search for their corresponding Slack username.
If the flagged email has already been opened, this workflow will additionally create a Jira ticket to manage the incident.
HTTP Request Node Requirements
- Create a rule in Sublime Security which has auto-quarantine enabled.
- Create a webhook in Sublime which will send an alert to the
Receive Sublime Security Alertnode whenever a selected rule is triggered.
Credentials
-
Sublime Security: Find your API key for Sublime Security and save it as an n8n credential with Header Auth in the format
Authorization: Bearer YOUR-API-KEY. -
Slack: Provide credentials for a Slack app that has access to
users:read.emailandim:writescopes.
Try to find quarantined email user's slack username
Try to find quarantined email user's slack username
With the quarantined email’s details at hand, n8n tries to notify the user via Slack. The message explains the reason for the email’s absence, provides identifying details, and instructs on further action if the user recognizes the email as safe.
If user opened email before quarantine, create jira ticket
If user opened email before quarantine, create jira ticket
If an email is opened prior to quarantine, n8n automatically creates a Jira ticket for further investigation. This ensures a swift response to potential threats that bypass the initial quarantine measures, highlighting n8n's critical role in incident response workflows.
Notify_user_in_Slack_of_quarantined_email_and_create_Jira_ticket_if_opened
Notify_user_in_Slack_of_quarantined_email_and_create_Jira_ticket_if_opened
Purpose and structure
This folder contains the Notify_user_in_Slack_of_quarantined_email_and_create_Jira_ticket_if_opened workflow. Its executable nodes use code, httpRequest, if, jira, noOp, slack, webhook. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.
Setup
Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.
Entry points
Receive Sublime Security Alert
Verification
Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.
Attribution
https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Webhook/1541_Webhook_Code_Create_Webhook.json MIT; preserve source notices.