# Automate security incident triage with OpenAI and Gmail: n8n workflow

> Started by another system calling it, and works across Gmail. It hands the judgement calls to OpenAI.

Source: https://millionrounds.com/workflow/automate-security-incident-triage-with-openai-and-gmail (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Alerts and monitoring](https://millionrounds.com/workflows?category=Alerts+and+monitoring#library)

# Automate security incident triage with OpenAI and Gmail

Started by another system calling it, and works across Gmail. It hands the judgement calls to OpenAI. 5 steps: small enough to read in one sitting and change without fear.

Small Calls a model: OpenAI

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fautomate-security-incident-triage-with-openai-and-gmail)

**5 steps** Small: readable in one sitting

**0** Branches: places the flow splits

**0** Loops or waits

**1** Service it connects to

## The flow

Starts it 1 Model 2 Logic 1 Service 1

The steps in the order they run, from what starts it.

- 1 **Webhook** Webhook *Starts it*
- 2 **Clean_Finding** Set *Logic*
- 3 **Classify** Open Ai *Model*
- 4 **Plan** Open Ai *Model*
- 5 **Send a message** Gmail *Service*

## How it's built

- **Starts on:** Another system calling it
- **Steps:** 5
- **Size:** Small: readable in one sitting
- **Connects to:** Gmail
- **Model:** OpenAI

## Questions

What does it need to run?

An n8n account, plus your own Gmail account, and a key for OpenAI. You connect your own accounts after importing it; none are included.

What starts it?

It starts on another system calling it.

Does it use AI?

Yes. It calls OpenAI. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Not long. At 5 steps it can be read in one sitting and changed without fear.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 5 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fautomate-security-incident-triage-with-openai-and-gmail)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Gmail](https://millionrounds.com/workflows?service=Gmail#library)

## Workflows like it

Also alerts and monitoring, with the same services where possible, closest in size first.

- [**Automate client project onboarding with Google Drive and Gmail** 5 steps · Gmail, Google Drive](https://millionrounds.com/workflow/automate-client-project-onboarding-with-google-drive-and-gma)
- [**Automated PETR4 stock price monitoring with RapidAPI and Gmail** 5 steps · Gmail](https://millionrounds.com/workflow/automated-petr4-stock-price-monitoring-with-rapidapi-and-gma)
- [**Capture URL screenshots from Google Sheets with ScreenshotOne** 5 steps · Gmail, Google Drive](https://millionrounds.com/workflow/capture-url-screenshots-from-google-sheets-with-screenshoton)
- [**Google sheet cleaner & notifier with Gmail and Google Sheets** 5 steps · Gmail, Google Sheets](https://millionrounds.com/workflow/google-sheet-cleaner-and-notifier-with-gmail-and-google-shee)
- [**Log API product checks to Google Sheets and notify with Gmail** 5 steps · Gmail, Google Sheets](https://millionrounds.com/workflow/log-api-product-checks-to-google-sheets-and-notify-with-gmai)
- [**Monitor flight price drops and send email alerts with SerpAPI** 5 steps · Gmail](https://millionrounds.com/workflow/monitor-flight-price-drops-and-send-email-alerts-with-serpap)