Who is this workflow for? This n8n workflow automatically analyzes email messages in a Microsoft Outlook inbox to detect potential phishing threats by identifying suspicious URLs. It streamlines the process of extracting indicators of compromise (IOCs) and leverages URLScan.io and VirusTotal to assess the safety of these URLs, ultimately notifying your team via Slack..

What does this workflow do?

  • Trigger Setup: The workflow can be initiated manually or scheduled to run daily at midnight.
  • Retrieve Emails: Connects to a Microsoft Outlook inbox and retrieves up to 100 unread email messages.
  • Mark as Read: Marks the retrieved emails as read to prevent duplicate processing in future runs.
  • Batch Processing: Splits the emails into individual items using the Split In Batches node for sequential analysis.
  • URL Extraction: Analyzes each email’s content to extract URLs, identifying them as potential indicators of compromise (IOCs).
  • Parallel Scanning:
  • URLScan.io: Sends extracted URLs to URLScan.io for threat assessment.
  • VirusTotal: Simultaneously scans the same URLs using VirusTotal.
  • Error Handling: If URLScan.io encounters errors, the workflow pauses for one minute and retries the scan.
  • Merge Results: Combines the results from URLScan.io and VirusTotal for a comprehensive analysis.
  • Data Filtering: Filters out emails where no suspicious URLs were detected.
  • Slack Notification: Sends a detailed summary to Slack, including the email subject, sender, date, URLScan report link, and VirusTotal verdict for any malicious URLs identified.

🤖 Why Use This Automation Workflow?

  • Enhanced Security: Quickly identifies and evaluates suspicious URLs in emails, reducing the risk of phishing attacks.
  • Automation Efficiency: Eliminates manual scanning of emails, saving time and minimizing human error.
  • Comprehensive Reporting: Provides detailed insights and summaries through Slack, facilitating prompt action on potential threats.

👨‍💻 Who is This Workflow For?

This workflow is ideal for IT security teams, cybersecurity analysts, and organizations that handle a high volume of email communications. It is designed for users seeking to enhance their email security measures without extensive manual intervention.

🎯 Use Cases

  1. Enterprise Email Security: Automatically monitor and analyze incoming emails for phishing attempts within large organizations.
  2. IT Security Operations: Integrate with existing security infrastructure to provide real-time threat assessments and notifications.
  3. Managed Security Service Providers (MSSPs): Offer automated email threat detection as part of security service packages for clients.

TL;DR

This n8n workflow provides an automated solution for detecting phishing threats in email communications by leveraging URLScan.io and VirusTotal. It efficiently processes emails, identifies suspicious URLs, evaluates their safety, and notifies your team through Slack, enhancing overall email security and response capabilities.

Get started with n8n
Need help with n8n?

Related

Monitor GitHub Event Updates with n8n

Stay informed with GitHub updates using n8n. Automate notifications and track events effortlessly. 

  • 611
  • 9

Convert Baserow Markdown to HTML in n8n

Transform Baserow markdown to HTML effortlessly. Automate conversions, enhance workflow efficiency, and maintain data integrity with key features. 

  • 622
  • 20

Automate Shopify Order Fulfillment with Onfleet Tasks

Streamline deliveries by integrating Shopify with Onfleet. Automatically create tasks, save time, and improve efficiency with this n8n template. 

  • 578
  • 25

Help us find the best n8n templates

About

A curated directory of the best n8n templates for workflow automations.

Navigation

Submit