{
  "name": "Prevent phishing emails with GPT-4, VirusTotal, Slack, and Google Sheets",
  "nodes": [
    {
      "id": "578da4c5-64c8-48ba-b7fc-82eef7c49510",
      "name": "Sticky Note Overview",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -720,
        32
      ],
      "parameters": {
        "width": 460,
        "height": 820,
        "content": "## 🛡️ Phishing Attack Prevention\n\nReal-time phishing detection pipeline. Ingests emails, extracts IOCs, analyzes with GPT-4, scores risk, then auto-quarantines, flags, or clears — with SOC alerts and "
      }
    },
    {
      "id": "77892aca-d0d7-48e3-8371-0cd4a67fd090",
      "name": "Sticky Note S1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -224,
        288
      ],
      "parameters": {
        "width": 620,
        "height": 324,
        "content": "## Step 1 — Ingest & Extract IOCs"
      }
    },
    {
      "id": "0007772b-b55e-476d-8959-5c492a05b0eb",
      "name": "Sticky Note S2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        448,
        112
      ],
      "parameters": {
        "width": 524,
        "height": 740,
        "content": "## Step 2 — GPT-4 Threat Analysis"
      }
    },
    {
      "id": "ba55bc03-3b5b-4f0b-b39f-cf0da27a2bc0",
      "name": "Sticky Note S3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1104,
        112
      ],
      "parameters": {
        "width": 700,
        "height": 740,
        "content": "## Step 3 — Risk Routing & Actions"
      }
    },
    {
      "id": "0eded51c-c82f-4967-bcce-48b47bca8582",
      "name": "Sticky Note S4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1888,
        112
      ],
      "parameters": {
        "width": 492,
        "height": 740,
        "content": "## Step 4 — Alert, Log & Respond"
      }
    },
    {
      "id": "e3611d35-3fbe-4c2a-9652-1e01bda48b0d",
      "name": "Receive Email via Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -192,
        400
      ]
    },
    {
      "id": "d6a94b60-9ff5-4d58-bda0-dead2a4bc89f",
      "name": "Extract IOCs & Normalize",
      "type": "n8n-nodes-base.code",
      "position": [
        64,
        400
      ]
    },
    {
      "id": "4d93b988-ef17-4633-9828-35a8507f0b02",
      "name": "VirusTotal URL Scan",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        480,
        304
      ]
    },
    {
      "id": "3acafc2f-9982-4095-9e46-8dba8ac3a7d3",
      "name": "GPT-4 Phishing Analysis",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        480,
        496
      ]
    },
    {
      "id": "29042c2d-7a97-4776-a77c-9fb1b37f8ce9",
      "name": "GPT-4o Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        560,
        704
      ]
    },
    {
      "id": "03ff8740-77ef-4664-9e45-c6e3ed281470",
      "name": "Parse & Score Risk",
      "type": "n8n-nodes-base.code",
      "position": [
        768,
        400
      ]
    },
    {
      "id": "e4ccf4d7-2295-4dac-b3b5-4194d07652f4",
      "name": "Risk Level Switch",
      "type": "n8n-nodes-base.switch",
      "position": [
        1200,
        400
      ]
    },
    {
      "id": "6b88bc07-8306-42a5-907e-dbe665011f7b",
      "name": "Quarantine — HIGH",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1440,
        256
      ]
    },
    {
      "id": "83b2a738-f67b-4837-a741-c63c72ac34cc",
      "name": "Flag — MEDIUM",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1440,
        416
      ]
    },
    {
      "id": "bb2e3f3b-9e6f-46f6-9431-413620326381",
      "name": "Allow — LOW",
      "type": "n8n-nodes-base.set",
      "position": [
        1440,
        576
      ]
    },
    {
      "id": "983c2a98-b5f1-4bce-a38c-70664b919916",
      "name": "Merge All Paths",
      "type": "n8n-nodes-base.merge",
      "position": [
        1680,
        416
      ]
    },
    {
      "id": "1d05e27f-e295-4ebe-be66-9576268d4a1e",
      "name": "Slack SOC Alert",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1936,
        272
      ]
    },
    {
      "id": "c80d2b0e-71a2-4915-892e-8c6ce0fe7a67",
      "name": "Warn User via Email",
      "type": "n8n-nodes-base.emailSend",
      "position": [
        1936,
        480
      ]
    },
    {
      "id": "2768a6ba-9a9a-4362-9533-0ae837567dc9",
      "name": "Write Audit Log",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        1936,
        672
      ]
    },
    {
      "id": "de5a742d-6eed-4a16-b39e-09a67b893b72",
      "name": "Return Detection Result",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        2208,
        480
      ]
    }
  ],
  "connections": {
    "GPT-4o Model": {
      "ai_languageModel": [
        [
          {
            "node": "GPT-4 Phishing Analysis",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Allow — LOW": {
      "main": [
        [
          {
            "node": "Merge All Paths",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Flag — MEDIUM": {
      "main": [
        [
          {
            "node": "Merge All Paths",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge All Paths": {
      "main": [
        [
          {
            "node": "Slack SOC Alert",
            "type": "main",
            "index": 0
          },
          {
            "node": "Warn User via Email",
            "type": "main",
            "index": 0
          },
          {
            "node": "Write Audit Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack SOC Alert": {
      "main": [
        [
          {
            "node": "Return Detection Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Write Audit Log": {
      "main": [
        [
          {
            "node": "Return Detection Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Risk Level Switch": {
      "main": [
        [
          {
            "node": "Quarantine — HIGH",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Flag — MEDIUM",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Allow — LOW",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Parse & Score Risk": {
      "main": [
        [
          {
            "node": "Risk Level Switch",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Quarantine — HIGH": {
      "main": [
        [
          {
            "node": "Merge All Paths",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "VirusTotal URL Scan": {
      "main": [
        [
          {
            "node": "Parse & Score Risk",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Warn User via Email": {
      "main": [
        [
          {
            "node": "Return Detection Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "GPT-4 Phishing Analysis": {
      "main": [
        [
          {
            "node": "Parse & Score Risk",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract IOCs & Normalize": {
      "main": [
        [
          {
            "node": "VirusTotal URL Scan",
            "type": "main",
            "index": 0
          },
          {
            "node": "GPT-4 Phishing Analysis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Receive Email via Webhook": {
      "main": [
        [
          {
            "node": "Extract IOCs & Normalize",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}