The flow
Starts it 1Model 1Logic 6Service 5
The steps in the order they run, from what starts it.
- 1Poll Gmail for New AttachmentsGmail triggerStarts it
- 2Set ConfigurationSetLogic
- 3Extract Attachments from EmailCodeLogic
- 4Compute SHA256 Hash of AttachmentCodeLogic
- 5Wait 15s for VirusTotal Rate LimitWaitLogic
- 6Look Up Hash in VirusTotalHttp RequestService
- 7Classify Phishing Risk with OpenAIOpen AiModel
- 8Calculate Combined Risk LevelCodeLogic
- 9Route by Threat LevelSwitchLogic
- 10Apply Quarantine Label on GmailGmailService
- 11Log to Review Queue on Google SheetsGoogle SheetsService
- 12Save Attachment to Safe Drive FolderGoogle DriveService
- 13Send Security Alert to SlackSlackService
How it's built
- Starts on
- An arriving email
- Steps
- 13, with 1 branch, 1 loop or waits
- Size
- Medium: a working afternoon
- Connects to
- Gmail, Google Drive, Google Sheets, Slack
- Model
- OpenAI
Questions
What does it need to run?
An n8n account, plus your own Gmail, Google Drive, Google Sheets and Slack accounts, and a key for OpenAI. You connect your own accounts after importing it; none are included.
What starts it?
It starts on an arriving email.
Does it use AI?
Yes. It calls OpenAI. Model calls are billed by the provider, not by n8n.
How long does it take to set up?
Plan an afternoon. 13 steps is enough that you should read each one before running it.
How do I import it?
Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.
Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 13 steps before you point it at anything that matters.