# Auto-classify security incidents with Google Sheets: n8n workflow

> Started by a clock, and works across Google Sheets. 5 steps: small enough to read in one sitting and change without fear.

Source: https://millionrounds.com/workflow/auto-classify-security-incidents-with-google-sheets (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Data collection](https://millionrounds.com/workflows?category=Data+collection#library)

# Auto-classify security incidents with Google Sheets

Started by a clock, and works across Google Sheets. 5 steps: small enough to read in one sitting and change without fear.

Small

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fauto-classify-security-incidents-with-google-sheets)

**5 steps** Small: readable in one sitting

**0** Branches: places the flow splits

**0** Loops or waits

**1** Service it connects to

## The flow

Starts it 1 Logic 1 Service 3

The steps in the order they run, from what starts it.

- 1 **Schedule Trigger** Schedule trigger *Starts it*
- 2 **📄 Google Sheets - Read Alerts** Google Sheets *Service*
- 3 **🧠 Classify Incident (GPT)** Http Request *Service*
- 4 **✏️ Format Tags** Set *Logic*
- 5 **Google Sheets** Google Sheets *Service*

## How it's built

- **Starts on:** A clock
- **Steps:** 5
- **Size:** Small: readable in one sitting
- **Connects to:** Google Sheets
- **Model:** None. This is plumbing, not judgement

## Questions

What does it need to run?

An n8n account, plus your own Google Sheets account. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Not long. At 5 steps it can be read in one sitting and changed without fear.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 5 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fauto-classify-security-incidents-with-google-sheets)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Google Sheets](https://millionrounds.com/workflows?service=Google+Sheets#library)

## Workflows like it

Also data collection, with the same services where possible, closest in size first.

- [**Add product ideas to Google Sheets with Slack** 5 steps · Google Sheets](https://millionrounds.com/workflow/add-product-ideas-to-google-sheets-with-slack)
- [**Append GPT JSON rows to Google Sheets** 5 steps · Google Sheets](https://millionrounds.com/workflow/append-gpt-json-rows-to-google-sheets)
- [**Audit inventory prices between a website scraper** 5 steps · Google Sheets](https://millionrounds.com/workflow/audit-inventory-prices-between-a-website-scraper)
- [**Auto feedback funnel – fix & nurture with Gmail** 5 steps · Gmail, Google Sheets](https://millionrounds.com/workflow/auto-feedback-funnel-fix-and-nurture-with-gmail)
- [**Auto-fetch product images with Google Sheets** 5 steps · Google Sheets](https://millionrounds.com/workflow/auto-fetch-product-images-with-google-sheets)
- [**Auto-stop email sequences based on replies with IMAP** 5 steps · Email, Google Sheets](https://millionrounds.com/workflow/auto-stop-email-sequences-based-on-replies-with-imap)