The flow
Starts it 1Logic 8Service 4
The steps in the order they run, from what starts it.
- 1Manual Trigger (Run Now)Manual triggerStarts it
- 2Compute Time WindowFunctionLogic
- 3SET - Workflow ConfigSetLogic
- 4Zoho: List ModulesHttp RequestService
- 5Prepare Modules ListFunctionLogic
- 6Zoho: Search Module RecordsHttp RequestService
- 7Normalize Module RecordsFunctionLogic
- 8Analyze for Suspicious ActivityFunctionLogic
- 9Create Audit Attachment (JSON)FunctionLogic
- 10Log to Google Sheet (append/update)Google SheetsService
- 11Check Suspicious? (If)IfLogic
- 12Notify Security (Email)GmailService
- 13Update lastRun (staticData)FunctionLogic
How it's built
- Starts on
- An event in a connected app
- Steps
- 13, with 1 branch
- Size
- Medium: a working afternoon
- Connects to
- Gmail, Google Sheets
- Model
- None. This is plumbing, not judgement
Questions
What does it need to run?
An n8n account, plus your own Gmail and Google Sheets accounts. You connect your own accounts after importing it; none are included.
What starts it?
It starts on an event in a connected app.
Does it use AI?
No. Every step is fixed logic or a call to a service, so it does the same thing every time.
How long does it take to set up?
Plan an afternoon. 13 steps is enough that you should read each one before running it.
How do I import it?
Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.
Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 13 steps before you point it at anything that matters.