{
  "name": "Detect and route gameplay security anomalies with GPT-4o, Slack and Sheets",
  "nodes": [
    {
      "id": "99faa284-7663-4909-a697-9c15c1321a54",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        -16,
        144
      ]
    },
    {
      "id": "e32e8ce7-aaf2-45b0-bb33-6b89a46e7975",
      "name": "Workflow Configuration",
      "type": "n8n-nodes-base.set",
      "position": [
        208,
        144
      ]
    },
    {
      "id": "1916f024-1ea1-4cfa-8a7a-42096b27793c",
      "name": "Generate Gameplay Anomaly Data",
      "type": "n8n-nodes-base.code",
      "position": [
        432,
        144
      ]
    },
    {
      "id": "a8e9c726-113d-4a8b-8ce8-7ebc75467455",
      "name": "OpenAI Model - Behavior Validation",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        672,
        368
      ]
    },
    {
      "id": "df569ad9-9d25-4ff2-9cb9-ddf0918db633",
      "name": "Structured Output Parser - Behavior Validation",
      "type": "@n8n/n8n-nodes-langchain.outputParserStructured",
      "position": [
        800,
        368
      ]
    },
    {
      "id": "d57780e2-3de5-4fd6-aee9-50a0a6705f48",
      "name": "Behavior Validation Agent",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        656,
        144
      ]
    },
    {
      "id": "84ee3d15-d21a-4eb9-aaa6-e7ee25deb454",
      "name": "Route by Severity",
      "type": "n8n-nodes-base.switch",
      "position": [
        1024,
        308
      ]
    },
    {
      "id": "65366f95-f6b5-4611-ac6f-aa164437e1ac",
      "name": "OpenAI Model - Governance",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        1248,
        260
      ]
    },
    {
      "id": "59adf837-81ec-4b1a-8fd0-a28a5b5d5740",
      "name": "Structured Output Parser - Governance",
      "type": "@n8n/n8n-nodes-langchain.outputParserStructured",
      "position": [
        1376,
        260
      ]
    },
    {
      "id": "f472fdca-fd3d-4e8e-b75e-179b94b6538a",
      "name": "Slack Tool",
      "type": "n8n-nodes-base.slackTool",
      "position": [
        1504,
        260
      ]
    },
    {
      "id": "51b0d7c2-a22b-4a6e-b31f-1a592d7eebc6",
      "name": "Google Sheets Tool",
      "type": "n8n-nodes-base.googleSheetsTool",
      "position": [
        1632,
        260
      ]
    },
    {
      "id": "c1160312-d3d7-479a-bd6a-42c51949ca2e",
      "name": "Historical Pattern Analysis Tool",
      "type": "@n8n/n8n-nodes-langchain.toolCode",
      "position": [
        1760,
        260
      ]
    },
    {
      "id": "4b121fc8-f4e9-47cb-81aa-b5cc5a8cd124",
      "name": "Governance Agent",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        1432,
        36
      ]
    },
    {
      "id": "acbd944c-04a3-4d65-b1d4-6ebaebabe006",
      "name": "Route by Action Type",
      "type": "n8n-nodes-base.switch",
      "position": [
        2016,
        240
      ]
    },
    {
      "id": "0cda0716-14eb-4726-af9f-600f1c8e4dad",
      "name": "Wait for Human Review",
      "type": "n8n-nodes-base.wait",
      "position": [
        2464,
        128
      ]
    },
    {
      "id": "9bc27284-ce3f-4a8f-ad7e-229af141a868",
      "name": "Prepare Human Review Data",
      "type": "n8n-nodes-base.set",
      "position": [
        2240,
        128
      ]
    },
    {
      "id": "c2ed4750-dfd7-47c5-a44b-b56979eb379e",
      "name": "Send to Slack - Human Review",
      "type": "n8n-nodes-base.slack",
      "position": [
        2688,
        128
      ]
    },
    {
      "id": "d7623eb3-86fd-4f14-97fa-a900756c6331",
      "name": "Prepare Auto-Action Data",
      "type": "n8n-nodes-base.set",
      "position": [
        2464,
        320
      ]
    },
    {
      "id": "61593cc2-152c-439e-bde1-c63dc2f018cd",
      "name": "Send to Slack - Auto-Action",
      "type": "n8n-nodes-base.slack",
      "position": [
        2688,
        320
      ]
    },
    {
      "id": "de3dfb2e-c63d-45d0-abea-f22db8332386",
      "name": "Prepare Escalation Data",
      "type": "n8n-nodes-base.set",
      "position": [
        2240,
        512
      ]
    },
    {
      "id": "90c80d2e-5154-4954-8bef-bf421d9eedd0",
      "name": "Send Escalation Email",
      "type": "n8n-nodes-base.emailSend",
      "position": [
        2464,
        512
      ]
    },
    {
      "id": "420d621c-6dee-4ad8-9a55-01af73efabd3",
      "name": "Send to Slack - Escalation",
      "type": "n8n-nodes-base.slack",
      "position": [
        2688,
        512
      ]
    },
    {
      "id": "09b48124-614b-4c41-a2e6-9aaa4fdf8e99",
      "name": "Merge All Actions",
      "type": "n8n-nodes-base.merge",
      "position": [
        2912,
        256
      ]
    },
    {
      "id": "e092e206-11fc-4077-bb22-77ae2ef93290",
      "name": "Log to Google Sheets",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        3136,
        272
      ]
    },
    {
      "id": "e1418718-db57-4880-8917-cd5829d7a52b",
      "name": "Prepare Low Severity Data",
      "type": "n8n-nodes-base.set",
      "position": [
        1496,
        436
      ]
    },
    {
      "id": "9ecec52b-1012-4cdc-aa96-a1dc7ce3cbe5",
      "name": "Log Low Severity to Sheets",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        2016,
        560
      ]
    },
    {
      "id": "774e2c7f-46cc-4c85-beae-4264d7caafde",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1408,
        -448
      ],
      "parameters": {
        "width": 608,
        "height": 320,
        "content": "## Prerequisites\nSIEM or security monitoring platform access, OpenAI API account\n## Use Cases\nIntrusion detection response, malware outbreak containment\n## Customization\nModify AI prompts for organiza"
      }
    },
    {
      "id": "01927c55-79ed-441a-ab0c-32d66d2754df",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        736,
        -368
      ],
      "parameters": {
        "width": 630,
        "height": 224,
        "content": "## Setup Steps\n1. Connect **Schedule Trigger** for continuous monitoring \n2. Configure **SIEM/security data sources** \n3. Add **OpenAI API keys** to Behavior Validator and Governance Agent nodes\n4. De"
      }
    },
    {
      "id": "d9e0384a-d120-4ab1-91fa-fc622952f552",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        0,
        -416
      ],
      "parameters": {
        "width": 704,
        "height": 304,
        "content": "## How It Works\nThis workflow automates cybersecurity incident detection and response for security operations centers (SOCs) managing constant threat landscapes. Designed for security analysts, IT ope"
      }
    },
    {
      "id": "5c8afa41-3fc4-4426-af79-f55604da2c16",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1952,
        -96
      ],
      "parameters": {
        "width": 1344,
        "height": 1008,
        "content": "## Coordinated Response\n**What**: Executes action plans via Slack alerts, Google Sheets logging, automated remediation scripts  \n**Why**: Multi-channel orchestration ensures stakeholder notification, "
      }
    },
    {
      "id": "842b07fd-4f8e-4679-a96f-720494ef0dcd",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        992,
        -80
      ],
      "parameters": {
        "width": 944,
        "height": 960,
        "content": "## Intelligent Routing\n**What**: Routes incidents by severity—critical triggers human review/escalation, low enables auto-remediation  \n**Why**: Priority-based workflows ensure urgent threats receive "
      }
    },
    {
      "id": "817fe50d-abc2-46bb-a312-be9e6ce2e1ab",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -48,
        -64
      ],
      "parameters": {
        "width": 992,
        "height": 720,
        "content": "\n## Continuous Monitoring & AI Threat Validation\n**What**: Behavior Validator confirms suspicious patterns; Governance Agent assesses incident severity  \n**Why**: Dual-layer analysis reduces false pos"
      }
    }
  ],
  "connections": {
    "Slack Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Governance Agent": {
      "main": [
        [
          {
            "node": "Route by Action Type",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "Workflow Configuration",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge All Actions": {
      "main": [
        [
          {
            "node": "Log to Google Sheets",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route by Severity": {
      "main": [
        [
          {
            "node": "Governance Agent",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Governance Agent",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Prepare Low Severity Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Google Sheets Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Route by Action Type": {
      "main": [
        [
          {
            "node": "Prepare Human Review Data",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Prepare Auto-Action Data",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Prepare Escalation Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Send Escalation Email": {
      "main": [
        [
          {
            "node": "Send to Slack - Escalation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait for Human Review": {
      "main": [
        [
          {
            "node": "Send to Slack - Human Review",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Workflow Configuration": {
      "main": [
        [
          {
            "node": "Generate Gameplay Anomaly Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Escalation Data": {
      "main": [
        [
          {
            "node": "Send Escalation Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Auto-Action Data": {
      "main": [
        [
          {
            "node": "Send to Slack - Auto-Action",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Behavior Validation Agent": {
      "main": [
        [
          {
            "node": "Route by Severity",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Model - Governance": {
      "ai_languageModel": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Human Review Data": {
      "main": [
        [
          {
            "node": "Wait for Human Review",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Low Severity Data": {
      "main": [
        [
          {
            "node": "Log Low Severity to Sheets",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Send to Slack - Escalation": {
      "main": [
        [
          {
            "node": "Merge All Actions",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Send to Slack - Auto-Action": {
      "main": [
        [
          {
            "node": "Merge All Actions",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Send to Slack - Human Review": {
      "main": [
        [
          {
            "node": "Merge All Actions",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Generate Gameplay Anomaly Data": {
      "main": [
        [
          {
            "node": "Behavior Validation Agent",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Historical Pattern Analysis Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Model - Behavior Validation": {
      "ai_languageModel": [
        [
          {
            "node": "Behavior Validation Agent",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Structured Output Parser - Governance": {
      "ai_outputParser": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_outputParser",
            "index": 0
          }
        ]
      ]
    },
    "Structured Output Parser - Behavior Validation": {
      "ai_outputParser": [
        [
          {
            "node": "Behavior Validation Agent",
            "type": "ai_outputParser",
            "index": 0
          }
        ]
      ]
    }
  }
}