Receive_and_analyze_emails_with_rules_in_Sublime_Security
Configured with Email Read Imap, HTTP Request, Move Binary Data, Slack. Review the connections and setup before adapting this template.
Node categories in this workflow
- Messaging
- Transform
- Routing
- Code
- Trigger
- Web / API
Icons describe general node roles, inferred from node types. Inspect the parameters for the configured action.
Drag to pan; use + and − to zoom. Reconstructed from the exported node positions; nothing runs here. Dashed lines represent non-main connections. Full node names and notes appear below.
How it works
The exported workflow contains the following configured nodes. Their connections are shown above; inspect the JSON for the complete logic, expressions, and external actions.
| Node | Category | Type | Operation |
|---|---|---|---|
| Email Trigger (IMAP) | Messaging | Email Read Imap | See node parameters |
| Move Binary Data | Transform | Move Binary Data | See node parameters |
| IF email has attachment | Routing | If | See node parameters |
| Split to matched and unmatched | Code | Code | See node parameters |
| When clicking "Execute Workflow" | Trigger | Manual Trigger | See node parameters |
| Slack | Messaging | Slack | See node parameters |
| Format the message | Transform | Edit Fields | See node parameters |
| Notify about missing attachment | Messaging | Slack | See node parameters |
| Analyze email with Sublime Security | Web / API | HTTP Request | POST |
Setup
- Download the JSON and import it into an isolated n8n instance. Leave the workflow inactive.
- Connect your own credentials through n8n’s credential store. Replace
REPLACE_WITH_*values with your resource identifiers. - Inspect API destinations, Code nodes, database queries, file paths, and outbound actions.
- Run with synthetic data and harmless destinations. Enable triggers only after checking the actual outputs.
Requirements
An n8n instance with the listed node types and compatible versions. Service-connected workflows may require accounts, credentials, or paid APIs.
Credential types declared in the source
httpHeaderAuthimapslackApi
Workflow notes
Workflow Overview
Workflow Overview
Leverage n8n's IMAP node to seamlessly ingest emails as .eml attachments, streamlining your security protocols and response strategies.
This setup is crucial for organizations utilizing platforms like Outlook, which offers a specialized security feature that designates specific inboxes for phishing attempts.
When a phishing email is flagged through Outlook's interface, the system is designed to convert it into an .eml file and direct it to a dedicated phishing inbox. This process not only centralizes your phishing threat management but also ensures that each potential threat is queued for immediate and thorough analysis.
By integrating with n8n, you can automate the capture of these emails, transforming user-reported incidents into actionable data without manual intervention, enhancing your cybersecurity response and preserving your workflow's integrity.
Ingest emails as attachments as .eml file.
Set your phishing email inbox here via your imap credentials. You can also replace this with any other node that retrieves emails as .eml attachments.
Analyze Attachment and format output
Analyze Attachment and format output
If an attachment is detected, n8n facilitates its secure transfer to Sublime Security for detailed analysis. This automated process not only speeds up the threat detection mechanism but also formats the output for compatibility with other systems, such as Slack, ensuring a smooth and efficient workflow.
Through this automation, you're not just analyzing emails; you're fortifying your defense against cyber threats and enhancing operational efficiency with minimal user involvement.
Prep output for Slack Report
Prep output for Slack Report
n8n completes the cycle of threat analysis and communication by preparing and delivering comprehensive reports directly to your Slack channels.
This ensures that all stakeholders are immediately informed about potential threats, fostering a culture of transparency and prompt action.
In instances where no attachment is found, n8n proactively dispatches a notification to Slack, signaling your team to investigate further.
Check for attachments and send to sublime if any found
Check for attachments and send to sublime if any found
Upon receiving an email via the IMAP node, n8n executes a meticulous inspection to detect the presence of attachments. This is more than a mere check; it's an essential layer of your security posture to identify and handle potentially malicious content proactively.
If an attachment is found, the binary file is converted to JSON for further analysis.
Receive_and_analyze_emails_with_rules_in_Sublime_Security
Receive_and_analyze_emails_with_rules_in_Sublime_Security
Purpose and structure
This folder contains the Receive_and_analyze_emails_with_rules_in_Sublime_Security workflow. Its executable nodes use code, emailReadImap, httpRequest, if, manualTrigger, moveBinaryData, set, slack. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.
Setup
Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.
Entry points
When clicking "Execute Workflow"
Verification
Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.
Attribution
https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Code/1161_Code_Slack_Send_Webhook.json MIT; preserve source notices.