{"id":4,"name":"Email","nodes":[{"id":"trigger-858025f9","name":"Manual Trigger","type":"n8n-nodes-base.manualTrigger","typeVersion":1,"position":[100,100],"parameters":{}},{"name":"IMAP Email","type":"n8n-nodes-base.emailReadImap","position":[-300,200],"parameters":{"format":"resolved","options":{}},"credentials":{"imap":{"id":"{{ $credentials.imap.id }}","name":"IMAP account"}},"typeVersion":1,"id":"a1b8f208-fd19-4b4e-b3b1-840b77c28440","notes":"This emailReadImap node performs automated tasks as part of the workflow."},{"name":"TheHive","type":"n8n-nodes-base.theHive","position":[-20,200],"parameters":{"tags":"Email","type":"Email","title":"={{$node[\"IMAP Email\"].binary.attachment_0.fileName}}","source":"Outlook","sourceRef":"={{$node[\"IMAP Email\"].json[\"messageId\"]}}","artifactUi":{"artifactValues":[{"dataType":"file","binaryProperty":"attachment_0"}]},"description":"={{$node[\"IMAP Email\"].binary.attachment_0.fileName}}","additionalFields":{}},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"alwaysOutputData":true,"id":"43335984-0ba1-42ad-846b-074e81149726","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Create Case","type":"n8n-nodes-base.theHive","position":[280,200],"parameters":{"id":"={{$node[\"TheHive\"].json[\"_id\"]}}","operation":"promote","additionalFields":{}},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"alwaysOutputData":true,"id":"b3d166f1-1226-429c-b4ef-eaf5995c30e1","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Case","type":"n8n-nodes-base.theHive","position":[540,200],"parameters":{"id":"={{$node[\"Create Case\"].json[\"_id\"]}}","resource":"case","operation":"get"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"alwaysOutputData":true,"id":"ee95042c-bc9d-4793-90e6-1ce07b388758","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Observable","type":"n8n-nodes-base.theHive","position":[1060,200],"parameters":{"caseId":"={{$node[\"Case\"].json[\"_id\"]}}","options":{},"resource":"observable","returnAll":true},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"alwaysOutputData":true,"id":"680ec364-ec72-4e11-8c69-c7806868d5ea","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Analyzer Email","type":"n8n-nodes-base.theHive","position":[1340,200],"parameters":{"id":"={{$node[\"Observable\"].json[\"_id\"]}}","dataType":"file","resource":"observable","analyzers":["24a64a086a410e1c7d7ace74003c4480::CORTEX"],"operation":"executeAnalyzer"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"retryOnFail":true,"typeVersion":1,"alwaysOutputData":true,"id":"9c85db6d-13ee-45bf-ab3b-f9f0f599a22b","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Cortex","type":"n8n-nodes-base.cortex","position":[1560,200],"parameters":{"jobId":"={{$node[\"Analyzer Email\"].json[\"cortexJobId\"]}}","resource":"job","operation":"report"},"credentials":{"cortexApi":{"id":"{{ $credentials.cortexApi.id }}","name":"Cortex account"}},"typeVersion":1,"id":"2e3a73ed-1036-444f-a29c-c8b377730572","notes":"This cortex node performs automated tasks as part of the workflow."},{"name":"If Node","type":"n8n-nodes-base.if","position":[-20,600],"parameters":{"conditions":{"number":[{"value1":"={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"domain\"].length}}","operation":"larger"},{"value1":"={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"email\"].length}}","operation":"larger"},{"value1":"={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"ip\"].length}}","operation":"larger"}]},"combineOperation":"any"},"typeVersion":1,"id":"930341df-2538-4c90-954d-f7fe84d326cc","notes":"This if node performs automated tasks as part of the workflow."},{"name":"Update Case Domain","type":"n8n-nodes-base.theHive","position":[420,480],"parameters":{"ioc":true,"data":"={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"domain\"]}}","caseId":"={{$node[\"Case\"].json[\"_id\"]}}","status":"Ok","message":"={{$node[\"Cortex\"].json[\"analyzerName\"]}}","options":{"tags":"Domain"},"dataType":"domain","resource":"observable","operation":"create"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"8273aac7-7450-4861-a197-e093314867c4","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Update Case Email","type":"n8n-nodes-base.theHive","position":[420,620],"parameters":{"ioc":true,"data":"={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"email\"]}}","caseId":"={{$node[\"Case\"].json[\"_id\"]}}","status":"Ok","message":"={{$node[\"Cortex\"].json[\"analyzerName\"]}}","options":{"tags":"Domain"},"dataType":"mail","resource":"observable","operation":"create"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"1fccb4dc-4790-4d8a-9289-6c509f2dfa7d","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Update Case Ip","type":"n8n-nodes-base.theHive","position":[420,760],"parameters":{"ioc":true,"data":"={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"ip\"]}}","caseId":"={{$node[\"Case\"].json[\"_id\"]}}","status":"Ok","message":"={{$node[\"Cortex\"].json[\"analyzerName\"]}}","options":{"tags":"Domain"},"dataType":"ip","resource":"observable","operation":"create"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"08f3d70c-f840-4593-bcc3-fb73e08591e0","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"Wait","type":"n8n-nodes-base.wait","position":[800,200],"webhookId":"ecada1d5-a671-44fc-906e-c64c6f05e760","parameters":{"unit":"seconds","amount":5},"typeVersion":1,"id":"81b7df75-f221-4ba9-821a-4084244d3996","notes":"This wait node performs automated tasks as part of the workflow."},{"name":"Email Reputation","type":"n8n-nodes-base.theHive","position":[640,620],"parameters":{"id":"={{$node[\"Update Case Email\"].json[\"id\"]}}","dataType":"mail","resource":"observable","analyzers":["9902b4e5c58015184b177de13f2151c7::CORTEX"],"operation":"executeAnalyzer"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"9defe9d1-dfb6-4254-ba9a-00a15a997d87","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"OTX IP","type":"n8n-nodes-base.theHive","position":[640,760],"parameters":{"id":"={{$node[\"Update Case Ip\"].json[\"id\"]}}","dataType":"ip","resource":"observable","analyzers":["b084bf78d1aea92966b6ef6a4f6193a5::CORTEX"],"operation":"executeAnalyzer"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"99e71a36-3970-4e85-90d4-1087c0839b57","notes":"This theHive node performs automated tasks as part of the workflow."},{"name":"OTX DOMAIN","type":"n8n-nodes-base.theHive","position":[640,480],"parameters":{"id":"={{$node[\"Update Case Domain\"].json[\"id\"]}}","dataType":"domain","resource":"observable","analyzers":["b084bf78d1aea92966b6ef6a4f6193a5::CORTEX"],"operation":"executeAnalyzer"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"86b74c34-478f-48f1-ac79-9eade8ea9c3b","notes":"This theHive node performs automated tasks as part of the workflow."}],"active":true,"settings":{"executionOrder":"v1","saveManualExecutions":true,"callerPolicy":"workflowsFromSameOwner","errorWorkflow":null,"timezone":"UTC","executionTimeout":3600,"maxExecutions":1000,"retryOnFail":true,"retryCount":3,"retryDelay":1000},"connections":{"IMAP Email":{"main":[[],[],[],[],[],[],[],[]]}},"description":"Automated workflow: Email. This workflow processes data and performs automated tasks.","meta":{"instanceId":"workflow-3f0e1c05","versionId":"1.0.0","createdAt":"2025-09-29T07:07:44.013470","updatedAt":"2025-09-29T07:07:44.013480","owner":"n8n-user","license":"MIT","category":"automation","status":"active","priority":"high","environment":"production"},"notes":"Excellent quality workflow: Email. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."}