{
  "name": "Analyze emails with S1EM",
  "nodes": [
    {
      "id": null,
      "name": "IMAP Email",
      "type": "n8n-nodes-base.emailReadImap",
      "position": [
        -300,
        200
      ]
    },
    {
      "id": null,
      "name": "TheHive",
      "type": "n8n-nodes-base.theHive",
      "position": [
        -20,
        200
      ]
    },
    {
      "id": null,
      "name": "Create Case",
      "type": "n8n-nodes-base.theHive",
      "position": [
        280,
        200
      ]
    },
    {
      "id": null,
      "name": "Case",
      "type": "n8n-nodes-base.theHive",
      "position": [
        540,
        200
      ]
    },
    {
      "id": null,
      "name": "Observable",
      "type": "n8n-nodes-base.theHive",
      "position": [
        1060,
        200
      ]
    },
    {
      "id": null,
      "name": "Analyzer Email",
      "type": "n8n-nodes-base.theHive",
      "position": [
        1340,
        200
      ]
    },
    {
      "id": null,
      "name": "Cortex",
      "type": "n8n-nodes-base.cortex",
      "position": [
        1560,
        200
      ]
    },
    {
      "id": null,
      "name": "IF",
      "type": "n8n-nodes-base.if",
      "position": [
        -20,
        600
      ]
    },
    {
      "id": null,
      "name": "Update Case Domain",
      "type": "n8n-nodes-base.theHive",
      "position": [
        420,
        480
      ]
    },
    {
      "id": null,
      "name": "Update Case Email",
      "type": "n8n-nodes-base.theHive",
      "position": [
        420,
        620
      ]
    },
    {
      "id": null,
      "name": "Update Case Ip",
      "type": "n8n-nodes-base.theHive",
      "position": [
        420,
        760
      ]
    },
    {
      "id": null,
      "name": "Wait",
      "type": "n8n-nodes-base.wait",
      "position": [
        800,
        200
      ]
    },
    {
      "id": null,
      "name": "Email Reputation",
      "type": "n8n-nodes-base.theHive",
      "position": [
        640,
        620
      ]
    },
    {
      "id": null,
      "name": "OTX IP",
      "type": "n8n-nodes-base.theHive",
      "position": [
        640,
        760
      ]
    },
    {
      "id": null,
      "name": "OTX DOMAIN",
      "type": "n8n-nodes-base.theHive",
      "position": [
        640,
        480
      ]
    }
  ],
  "connections": {
    "IF": {
      "main": [
        [
          {
            "node": "Update Case Domain",
            "type": "main",
            "index": 0
          },
          {
            "node": "Update Case Email",
            "type": "main",
            "index": 0
          },
          {
            "node": "Update Case Ip",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Case": {
      "main": [
        [
          {
            "node": "Wait",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait": {
      "main": [
        [
          {
            "node": "Observable",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Cortex": {
      "main": [
        [
          {
            "node": "IF",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive": {
      "main": [
        [
          {
            "node": "Create Case",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IMAP Email": {
      "main": [
        [
          {
            "node": "TheHive",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Observable": {
      "main": [
        [
          {
            "node": "Analyzer Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Create Case": {
      "main": [
        [
          {
            "node": "Case",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Analyzer Email": {
      "main": [
        [
          {
            "node": "Cortex",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Update Case Ip": {
      "main": [
        [
          {
            "node": "OTX IP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Update Case Email": {
      "main": [
        [
          {
            "node": "Email Reputation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Update Case Domain": {
      "main": [
        [
          {
            "node": "OTX DOMAIN",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}