{"id":"84KL1bsi9OvbAapn","meta":{"instanceId":"workflow-8346a76f","versionId":"1.0.0","createdAt":"2025-09-29T07:07:43.040636","updatedAt":"2025-09-29T07:07:43.041006","owner":"n8n-user","license":"MIT","category":"automation","status":"active","priority":"high","environment":"production"},"name":"Receive_and_analyze_emails_with_rules_in_Sublime_Security","nodes":[{"id":"b1ad1c9a-ba5d-46d6-9ce1-b3bb9346c766","name":"Email Trigger (IMAP)","type":"n8n-nodes-base.emailReadImap","position":[720,1120],"parameters":{"format":"resolved","options":{}},"credentials":{"imap":{"id":"BDCrQbPFgl8k3ArL","name":"Matti Outlook email"}},"typeVersion":2,"notes":"This emailReadImap node performs automated tasks as part of the workflow."},{"id":"e43b0257-0d83-4f7e-8824-3ca1d4cf6110","name":"Move Binary Data","type":"n8n-nodes-base.moveBinaryData","position":[1240,740],"parameters":{"options":{"encoding":"base64"},"sourceKey":"YOUR_CREDENTIAL_HERE","setAllData":false},"typeVersion":1,"alwaysOutputData":true,"notes":"This moveBinaryData node performs automated tasks as part of the workflow."},{"id":"97359abc-7ca9-4599-9112-4416618d0c36","name":"IF email has attachment","type":"n8n-nodes-base.if","position":[1020,900],"parameters":{"conditions":{"string":[{"value1":"={{ $binary.attachment_0 }}","operation":"isNotEmpty"},{"value1":"={{ $binary.attachment_0.mimeType }}","value2":"message/rfc822"}]}},"typeVersion":1,"notes":"This if node performs automated tasks as part of the workflow."},{"id":"046f87e0-8759-4952-85be-78bf36a70994","name":"Split to matched and unmatched","type":"n8n-nodes-base.code","position":[1760,740],"parameters":{"jsCode":"// Loop over input items and add a new field\n// called 'myNewField' to the JSON of each one\nmatched = []\nunmatched = []  \n\nfor (const item of $input.first().json.rule_results) {\n  if (item.matched) {\n    matched.push(item)\n  } else {\n    unmatched.push(item)    \n  }\n}\n\nreturn {\n  json: {\n    matched,\n    unmatched\n  }\n}"},"typeVersion":1,"notes":"This code node performs automated tasks as part of the workflow."},{"id":"f88b852d-f2a4-4d78-aaef-40050c0efef8","name":"When clicking \"Execute Workflow\"","type":"n8n-nodes-base.manualTrigger","position":[720,920],"parameters":{},"typeVersion":1,"notes":"This manualTrigger node performs automated tasks as part of the workflow."},{"id":"ce7288d4-61ec-4222-a29e-8a72ed2ee32e","name":"Slack","type":"n8n-nodes-base.slack","position":[2260,740],"parameters":{"text":"={{ $json.message }}","select":"channel","channelId":{"__rl":true,"mode":"name","value":"#test-matti-tomi"},"otherOptions":{}},"credentials":{"slackApi":{"id":"{{ $credentials.slackApi.id }}","name":"Awesom-O"}},"typeVersion":2.1,"notes":"This slack node performs automated tasks as part of the workflow."},{"id":"70c76c01-50ef-47a4-b552-bc6fea5079ed","name":"Format the message","type":"n8n-nodes-base.set","position":[2040,740],"parameters":{"values":{"string":[{"name":"message","value":"=No. of rules that matched {{ $json[\"matched\"].length }} / {{ $json[\"matched\"].length + $json[\"unmatched\"].length }}\n\nMatched rules:\n{{ $json[\"matched\"].pluck(\"rule\").pluck(\"name\").join('\\n') }}\n"}]},"options":{},"keepOnlySet":true},"typeVersion":2,"notes":"This set node performs automated tasks as part of the workflow."},{"id":"52af4700-0dc5-4f5f-8664-97d2aacdab76","name":"Notify about missing attachment","type":"n8n-nodes-base.slack","position":[2260,920],"parameters":{"text":"No attachment found in an email\n","select":"channel","channelId":{"__rl":true,"mode":"name","value":"#test-matti-tomi"},"otherOptions":{}},"credentials":{"slackApi":{"id":"{{ $credentials.slackApi.id }}","name":"Awesom-O"}},"typeVersion":2.1,"notes":"This slack node performs automated tasks as part of the workflow."},{"id":"19be16c9-3908-4a2d-87e4-f721c33dc124","name":"Analyze email with Sublime Security","type":"n8n-nodes-base.httpRequest","position":[1500,740],"parameters":{"url":"{{ $env.API_BASE_URL }}","method":"POST","options":{},"jsonBody":"={\n  \"raw_message\": \"{{ $json.data }}\",\n  \"run_active_detection_rules\": true,\n  \"run_all_detection_rules\": false\n}","sendBody":true,"sendHeaders":true,"specifyBody":"json","authentication":"{{ $credentials.genericCredentialType }}","genericAuthType":"httpHeaderAuth","headerParameters":{"parameters":[{"name":"content-type","value":"application/json"}]}},"credentials":{"httpHeaderAuth":{"id":"buIfmuHDZZQ2MyYz","name":"Sublime Security bearer token"}},"typeVersion":3,"notes":"This httpRequest node performs automated tasks as part of the workflow."},{"id":"a39d52d6-26e0-485e-8d32-984e26f71f9b","name":"Sticky Note1","type":"n8n-nodes-base.stickyNote","position":[240,298.6458865911087],"parameters":{"width":618.0312276650722,"height":963.8594737915395,"content":"![imap]({{ $env.WEBHOOK_URL }}\n# Workflow Overview\nLeverage n8n's IMAP node to `seamlessly ingest emails as .eml attachments`, streamlining your security protocols and response strategies. \n\nThis setup is crucial for organizations utilizing platforms like Outlook, which offers a specialized security feature that designates specific inboxes for phishing attempts. \n\nWhen a phishing email is flagged through Outlook's interface, the system is designed to convert it into an .eml file and direct it to a dedicated phishing inbox. This process not only centralizes your phishing threat management but also ensures that each potential threat is queued for immediate and thorough analysis. \n\nBy integrating with n8n, you can automate the capture of these emails, transforming user-reported incidents into actionable data without manual intervention, enhancing your cybersecurity response and preserving your workflow's integrity.\n\n## Ingest emails as attachments as .eml file. \nSet your phishing email inbox here via your imap credentials. You can also replace this with any other node that retrieves emails as .eml attachments. "},"typeVersion":1,"notes":"This stickyNote node performs automated tasks as part of the workflow."},{"id":"3cb757ce-2083-44de-8508-89039c6bca9d","name":"Sticky Note2","type":"n8n-nodes-base.stickyNote","position":[1444,361],"parameters":{"width":503.7209302325584,"height":710.138909846923,"content":"![Sublime Security]({{ $env.WEBHOOK_URL }}\n## Analyze Attachment and format output\nIf an attachment is detected, n8n facilitates its secure transfer to Sublime Security for detailed analysis. This automated process not only speeds up the threat detection mechanism but also formats the output for compatibility with other systems, such as Slack, ensuring a smooth and efficient workflow. \n\nThrough this automation, you're not just analyzing emails; you're fortifying your defense against cyber threats and enhancing operational efficiency with minimal user involvement."},"typeVersion":1,"notes":"This stickyNote node performs automated tasks as part of the workflow."},{"id":"83756b95-a3a8-4145-9d10-fc7e3b2121f8","name":"Sticky Note3","type":"n8n-nodes-base.stickyNote","position":[1980,354.9999999999999],"parameters":{"width":476.0465116279074,"height":777.0757733319455,"content":"![Slack]({{ $env.WEBHOOK_URL }}\n## Prep output for Slack Report\nn8n completes the cycle of threat analysis and communication by preparing and delivering comprehensive reports directly to your Slack channels. \n\nThis ensures that all stakeholders are immediately informed about potential threats, fostering a culture of transparency and prompt action. \n\nIn instances where no attachment is found, n8n proactively dispatches a notification to Slack, signaling your team to investigate further. "},"typeVersion":1,"notes":"This stickyNote node performs automated tasks as part of the workflow."},{"id":"a443e91b-6b0b-4fb8-b9d5-6f1d236da053","name":"Sticky Note4","type":"n8n-nodes-base.stickyNote","position":[880,360.90897077923785],"parameters":{"width":541.1627906976748,"height":715.8304363872012,"content":"![n8n]({{ $env.WEBHOOK_URL }}\n## Check for attachments and send to sublime if any found \nUpon receiving an email via the IMAP node, n8n executes a meticulous inspection to detect the presence of attachments. This is more than a mere check; it's an essential layer of your security posture to identify and handle potentially malicious content proactively. \n\nIf an attachment is found, the binary file is converted to JSON for further analysis. "},"typeVersion":1,"notes":"This stickyNote node performs automated tasks as part of the workflow."}],"active":false,"settings":{"executionOrder":"v1","saveManualExecutions":true,"callerPolicy":"workflowsFromSameOwner","errorWorkflow":null,"timezone":"UTC","executionTimeout":3600,"maxExecutions":1000,"retryOnFail":true,"retryCount":3,"retryDelay":1000},"versionId":"25aa0ca5-6e3c-44ed-98f9-37f62a78ed76","connections":{"Analyze email with Sublime Security":{"main":[[],[],[],[],[],[],[],[],[]]},"Email Trigger (IMAP)":{"main":[[],[],[],[],[],[],[],[]]},"Slack":{"main":[[]]},"Notify about missing attachment":{"main":[[]]}},"description":"Automated workflow: Receive_and_analyze_emails_with_rules_in_Sublime_Security. This workflow integrates 10 different services: stickyNote, httpRequest, code, set, stopAndError. It contains 18 nodes and follows best practices for error handling and security.","notes":"Excellent quality workflow: Receive_and_analyze_emails_with_rules_in_Sublime_Security. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."}