{ "name": "Phishing analysis - URLScan.io and VirusTotal", "nodes": [ { "id": "f170068a-4540-4fbd-bd17-00a6367989d1", "name": "When clicking \"Execute Workflow\"", "type": "n8n-nodes-base.manualTrigger", "position": [ -1760, 560 ] }, { "id": "5a1e0490-6971-4490-a806-46da5e226365", "name": "sends slack message", "type": "n8n-nodes-base.slack", "position": [ -360, 1280 ] }, { "id": "65e70f8a-7514-455e-97bf-b11514b4eec2", "name": "Split In Batches", "type": "n8n-nodes-base.splitInBatches", "position": [ -1020, 480 ] }, { "id": "35084825-f3b2-4a01-b953-712c099a6451", "name": "Mark as read", "type": "n8n-nodes-base.microsoftOutlook", "position": [ -1300, 560 ] }, { "id": "62098c94-5735-4eed-a712-3f9887e0400f", "name": "VirusTotal: Scan URL", "type": "n8n-nodes-base.httpRequest", "position": [ -220, 700 ] }, { "id": "55b7ce97-3609-4a16-b998-8bec77cffb59", "name": "VirusTotal: Get report", "type": "n8n-nodes-base.httpRequest", "position": [ 200, 700 ] }, { "id": "7bf3c7a0-94f9-410b-b0fe-e0d15d0ba895", "name": "Schedule Trigger", "type": "n8n-nodes-base.scheduleTrigger", "position": [ -1760, 380 ] }, { "id": "741f3221-bb73-4004-801e-e9c3030740f8", "name": "Find indicators of compromise", "type": "n8n-nodes-base.code", "position": [ -780, 440 ] }, { "id": "bf8ba285-e824-4104-82e0-fa2dba80f301", "name": "URLScan: Get report", "type": "n8n-nodes-base.urlScanIo", "position": [ 640, 60 ] }, { "id": "eb3b06e8-ffe3-4472-a70c-08fb2555e0fb", "name": "URLScan: Scan URL", "type": "n8n-nodes-base.urlScanIo", "position": [ -100, 120 ] }, { "id": "34157694-635a-481b-b7d2-dcd4628b26fe", "name": "Has URL?", "type": "n8n-nodes-base.if", "position": [ -520, 440 ] }, { "id": "33cad369-0598-433e-90f8-0e7333ec5e92", "name": "No error?", "type": "n8n-nodes-base.if", "position": [ 240, 120 ] }, { "id": "cba20d52-a56c-4ac0-99f2-d9b54adb342e", "name": "Not empty?", "type": "n8n-nodes-base.filter", "position": [ -640, 1280 ] }, { "id": "449c31e3-e098-43ec-a31b-1e383c6add57", "name": "Sticky Note", "type": "n8n-nodes-base.stickyNote", "position": [ -2051.228008430503, -251.94391274976795 ], "parameters": { "width": 474.5187061049208, "height": 1008.8561536646063, "content": "![Scheduled](https://i.imgur.com/PcOuvAL.png)\n## Workflow Overview\n\nThis n8n workflow is engineered to enhance cybersecurity measures by analyzing potential phishing URLs using URLScan.io and VirusTot" } }, { "id": "a8921212-aec4-422d-9f04-f402d7591475", "name": "Sticky Note1", "type": "n8n-nodes-base.stickyNote", "position": [ -1560, 107 ], "parameters": { "width": 397.3953488372091, "height": 647.1076277970203, "content": "![Outlook](https://i.imgur.com/R3Bhd8I.png)\n## Email Processing for Phishing Analysis\nThis segment of the workflow interfaces with Microsoft Outlook to retrieve and process `all messages marked as unr" } }, { "id": "fbad734e-4502-4d1b-8890-b05c486a1f70", "name": "Sticky Note2", "type": "n8n-nodes-base.stickyNote", "position": [ -1140, 15.062288067451163 ], "parameters": { "width": 859.9418604651164, "height": 836.8098049558043, "content": "![python](https://i.imgur.com/S2TZ3u6.png)\n## Indicator of Compromise Detection Loop\nThis workflow section leverages n8n's `Split In Batches` node, a powerful feature for iterative processing. It is s" } }, { "id": "8603fe5b-ad6b-4980-a28b-01531c6629f3", "name": "Sticky Note3", "type": "n8n-nodes-base.stickyNote", "position": [ -260, -313.5039999999999 ], "parameters": { "width": 1099.116279069767, "height": 618.8295813953489, "content": "![urlscan](https://i.imgur.com/RjaMt6c.png)\n## URL Scanning and Verification\nThis portion of the workflow engages with URLScan.io, a tool for scanning and analyzing websites for potential security thr" } }, { "id": "33299274-9f02-4ea0-af60-5dee53db2c34", "name": "Wait 1 Minute", "type": "n8n-nodes-base.wait", "position": [ 480, 60 ] }, { "id": "757ad81d-ae24-4b26-98ba-a571670be2a3", "name": "Sticky Note4", "type": "n8n-nodes-base.stickyNote", "position": [ -260, 318.64011851851865 ], "parameters": { "width": 1435.7278194659766, "height": 540.6919228251508, "content": "" } }, { "id": "8e2cbf69-6c9e-4a98-ba5e-29b93eb2742f", "name": "Sticky Note5", "type": "n8n-nodes-base.stickyNote", "position": [ -680, 880 ], "parameters": { "width": 1213.8313506082789, "height": 575.5779026440933, "content": "![Slack](https://i.imgur.com/iKyMV0N.png)\n## Final Reporting on Phishing Analysis\nIn the concluding phase of the workflow, we consolidate the analysis into actionable intelligence and report through S" } }, { "id": "a2a0dc81-b1f0-4d7b-b818-71bae58512a9", "name": "Get all unread messages", "type": "n8n-nodes-base.microsoftOutlook", "position": [ -1520, 560 ] }, { "id": "a5793014-9575-4e05-b467-f295a09f0945", "name": "Sticky Note6", "type": "n8n-nodes-base.stickyNote", "position": [ -260, 320 ], "parameters": { "width": 615.527819465977, "height": 540.6919228251508, "content": "![VirusTotal](https://upload.wikimedia.org/wikipedia/commons/thumb/b/b7/VirusTotal_logo.svg/320px-VirusTotal_logo.svg.png)\n## Phishing URL Analysis with VirusTotal\nThis segment of the workflow deploys" } }, { "id": "c8d5c248-77ba-4a7f-ab21-19ff8d60ed55", "name": "Merge Reports", "type": "n8n-nodes-base.merge", "position": [ 1040, 680 ] } ], "connections": { "Has URL?": { "main": [ [ { "node": "URLScan: Scan URL", "type": "main", "index": 0 }, { "node": "VirusTotal: Scan URL", "type": "main", "index": 0 } ], [ { "node": "Split In Batches", "type": "main", "index": 0 } ] ] }, "No error?": { "main": [ [ { "node": "Merge Reports", "type": "main", "index": 0 } ], [ { "node": "Wait 1 Minute", "type": "main", "index": 0 } ] ] }, "Not empty?": { "main": [ [ { "node": "sends slack message", "type": "main", "index": 0 } ] ] }, "Mark as read": { "main": [ [ { "node": "Split In Batches", "type": "main", "index": 0 } ] ] }, "Merge Reports": { "main": [ [ { "node": "Split In Batches", "type": "main", "index": 0 } ] ] }, "Wait 1 Minute": { "main": [ [ { "node": "URLScan: Get report", "type": "main", "index": 0 } ] ] }, "Schedule Trigger": { "main": [ [ { "node": "Get all unread messages", "type": "main", "index": 0 } ] ] }, "Split In Batches": { "main": [ [ { "node": "Find indicators of compromise", "type": "main", "index": 0 } ], [ { "node": "Not empty?", "type": "main", "index": 0 } ] ] }, "URLScan: Scan URL": { "main": [ [ { "node": "No error?", "type": "main", "index": 0 } ] ] }, "URLScan: Get report": { "main": [ [ { "node": "Merge Reports", "type": "main", "index": 0 } ] ] }, "VirusTotal: Scan URL": { "main": [ [ { "node": "VirusTotal: Get report", "type": "main", "index": 0 } ] ] }, "VirusTotal: Get report": { "main": [ [ { "node": "Merge Reports", "type": "main", "index": 1 } ] ] }, "Get all unread messages": { "main": [ [ { "node": "Mark as read", "type": "main", "index": 0 } ] ] }, "Find indicators of compromise": { "main": [ [ { "node": "Has URL?", "type": "main", "index": 0 } ] ] }, "When clicking \"Execute Workflow\"": { "main": [ [ { "node": "Get all unread messages", "type": "main", "index": 0 } ] ] } } }