Workflow Overview

This n8n workflow is engineered to enhance cybersecurity measures by analyzing potential phishing URLs using URLScan.io and VirusTotal.

It is designed to automatically process and evaluate URLs from incoming messages for malicious content.

This workflow is tuned specifically for Outlook, but you can replace outlook with your mail provider of choice.

The workflow can be initiated manually or scheduled to run automatically, ensuring consistent checks against phishing threats. By integrating with leading cybersecurity tools, it provides a comprehensive analysis, strengthening your organization's defense against phishing attacks.

Execution Schedule

It can be triggered at will by clicking "Execute Workflow" or set to run on a schedule. To align with your operational needs, customize the Schedule Trigger to your preferred frequency, ensuring continuous monitoring for phishing attempts.

Email Processing for Phishing Analysis

This segment of the workflow interfaces with Microsoft Outlook to retrieve and process all messages marked as unread. This section can be replaced with any mail provider.

Once an email is fetched, the Get all unread messages node captures the details, while the Mark as read node updates the message's status.

This ensures that each email is only processed once, maintaining a clean and organized inbox, and preventing reprocessing of the same messages.

Indicator of Compromise Detection Loop

This workflow section leverages n8n's Split In Batches node, a powerful feature for iterative processing. It is set to dissect the batch of emails one by one, allowing for individual examination of each message's content for potential threats.

With the Find indicators of compromise node, the workflow employs Python code to parse the email content and extract URLs, which are common indicators of compromise (IoCs) in phishing attempts. By utilizing the ioc-finder library, it systematically scans for and isolates these IoCs from the email body.

The Has URL? node then checks if the email contains any urls. If no URLs are found, then the loop moves on to the next email, as there is nothing to scan. If it does find one, it allows the email to flow to the next sections.

The splitting of batches is key to the workflow's efficiency, enabling the loop to handle vast quantities of emails methodically. This step is crucial in pinpointing and extracting suspicious elements from each email, highlighting the workflow's meticulous approach to security analysis.

URL Scanning and Verification

This portion of the workflow engages with URLScan.io, a tool for scanning and analyzing websites for potential security threats.

The URLScan: Scan URL node begins the process by submitting the URL extracted from the email content. It's configured to continue even if an error occurs, which allows us to then do an error check in the No error? node instead.

This is because if the URLScan: Scan URL node fails, the whole workflow will grind to a stop. This is not good because in theory, we maybe processing another email after this one, and we need to ensure the workflow moves on to the next email.

Following the submission, the Wait 1 Minute node pauses the workflow, giving URLScan.io adequate time to perform the scan and generate a report. This wait ensures that the subsequent retrieval of the report reflects the most recent and comprehensive analysis.

Final Reporting on Phishing Analysis

In the concluding phase of the workflow, we consolidate the analysis into actionable intelligence and report through Slack.

The Not empty? node filters the data, ensuring that only URLs with a completed analysis proceed to the reporting stage. This step is crucial to avoid alerting on incomplete data, which could lead to misinformed decisions.

The sends slack message node is the final touchpoint of the workflow, where it compiles a detailed report and posts it on Slack. The message includes the subject, sender, and date of the analyzed email, along with the URLScan and VirusTotal reports. It provides a concise verdict by tallying the number of malicious and suspicious flags against the total checks performed, offering a clear indication of the potential threat level.

This Slack notification serves as a prompt for the cybersecurity team to take appropriate action, completing the workflow's aim of providing streamlined, accurate, and timely phishing threat analysis.

Phishing URL Analysis with VirusTotal

This segment of the workflow deploys VirusTotal's capabilities to scrutinize URLs for signs of phishing.

The VirusTotal: Scan URL node initiates the process by sending the URL to VirusTotal for analysis. Once the scan is triggered, the workflow moves on to the VirusTotal: Get report node, which retrieves the detailed analysis report after a certain interval, ensuring that the data received includes all findings from the scan.

Finally, the Merge Reports node combines the results from both URLScan.io and VirusTotal, aligning the data side by side for a comprehensive view. This merging by position is vital as it correlates the analysis from different sources, providing a layered security assessment of the URL in question.

Phishing_analysis__URLScan_io_and_Virustotal_

Purpose and structure

This folder contains the Phishing_analysis__URLScan_io_and_Virustotal_ workflow. Its executable nodes use code, filter, httpRequest, if, manualTrigger, merge, microsoftOutlook, scheduleTrigger, slack, splitInBatches, urlScanIo, wait. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

When clicking "Execute Workflow", Schedule Trigger

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Wait/1600_Wait_Code_Automation_Scheduled.json MIT; preserve source notices.