The flow
Starts it 2Logic 7Service 7
The steps in the order they run, from what starts it.
- 1When clicking "Execute Workflow"Manual triggerStarts it
- 2Schedule TriggerSchedule triggerStarts it
- 3Get all unread messagesMicrosoft OutlookService
- 4Mark as readMicrosoft OutlookService
- 5Split In BatchesSplit In BatchesLogic
- 6Find indicators of compromiseCodeLogic
- 7Not empty?FilterLogic
- 8Has URL?IfLogic
- 9sends slack messageSlackService
- 10URLScan: Scan URLUrl Scan IoService
- 11VirusTotal: Scan URLHttp RequestService
- 12No error?IfLogic
- 13VirusTotal: Get reportHttp RequestService
- 14Merge ReportsMergeLogic
- 15Wait 1 MinuteWaitLogic
- 16URLScan: Get reportUrl Scan IoService
How it's built
- Starts on
- A clock
- Steps
- 16, with 2 branches, 2 loops or waits
- Size
- Medium: a working afternoon
- Connects to
- Outlook, Slack
- Model
- None. This is plumbing, not judgement
Questions
What does it need to run?
An n8n account, plus your own Outlook and Slack accounts. You connect your own accounts after importing it; none are included.
What starts it?
It starts on a clock.
Does it use AI?
No. Every step is fixed logic or a call to a service, so it does the same thing every time.
How long does it take to set up?
Plan an afternoon. 16 steps is enough that you should read each one before running it.
How do I import it?
Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.
Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 16 steps before you point it at anything that matters.