{ "edges": [ { "to": "799a14d8-a681-4a49-b997-3bf6b6f03eb3", "from": "2e2440b7-a32f-40be-b549-90f3584766a5", "toPort": "0", "fromPort": "0" }, { "to": "35805598-6a09-4839-a23a-2fb8e615b838", "from": "d819b4fb-3089-4081-80f3-edf0584595ec", "toPort": "0", "fromPort": "0" }, { "to": "d819b4fb-3089-4081-80f3-edf0584595ec", "from": "3cc70a5e-ef2a-4c13-93e2-41903059b5d6", "toPort": "0", "fromPort": "0" }, { "to": "41ee46a2-b6bc-48fb-a830-367b94cf7c34", "from": "6ccc7849-44eb-461e-82e7-9b99ec88f1c6", "toPort": "0", "fromPort": "0" }, { "to": "2a324218-d202-44dd-afff-53429f354ad4", "from": "799a14d8-a681-4a49-b997-3bf6b6f03eb3", "toPort": "0", "fromPort": "0" }, { "to": "038437ba-a758-4e4e-a17b-982f799b12f2", "from": "2a324218-d202-44dd-afff-53429f354ad4", "toPort": "0", "fromPort": "0" }, { "to": "6e5b5549-352d-4d9a-b250-0dd302ad5e2c", "from": "038437ba-a758-4e4e-a17b-982f799b12f2", "toPort": "0", "fromPort": "0" }, { "to": "5d1cf672-85f0-407a-81a8-23c1f234f40b", "from": "6e5b5549-352d-4d9a-b250-0dd302ad5e2c", "toPort": "0", "fromPort": "0" }, { "to": "038437ba-a758-4e4e-a17b-982f799b12f2", "from": "87828b71-2826-45f3-8d7a-b68a63d35126", "toPort": "0", "fromPort": "ai_languageModel" }, { "to": "6ccc7849-44eb-461e-82e7-9b99ec88f1c6", "from": "5d1cf672-85f0-407a-81a8-23c1f234f40b", "toPort": "0", "fromPort": "0" }, { "to": "58e5cf05-d294-4155-8bf5-da80dd7dcb18", "from": "41ee46a2-b6bc-48fb-a830-367b94cf7c34", "toPort": "0", "fromPort": "0" }, { "to": "3cc70a5e-ef2a-4c13-93e2-41903059b5d6", "from": "58e5cf05-d294-4155-8bf5-da80dd7dcb18", "toPort": "0", "fromPort": "0" } ], "nodes": [ { "id": "87828b71-2826-45f3-8d7a-b68a63d35126", "name": "Google Gemini Chat Model", "type": "llm", "params": { "options": {}, "provider": "google" }, "position": [ 48, 928 ] }, { "id": "799a14d8-a681-4a49-b997-3bf6b6f03eb3", "name": "Catch Incoming Emails", "type": "integration", "params": { "limit": 1, "simple": false, "filters": {}, "options": {}, "service": "gmail", "operation": "getAll" }, "position": [ -592, 720 ] }, { "id": "2a324218-d202-44dd-afff-53429f354ad4", "name": "Strip Email Formatting", "type": "passthrough", "params": { "mode": "noOp", "options": {}, "operation": "extractHtmlContent", "dataPropertyName": "html", "extractionValues": { "values": [ { "key": "clean_body", "cssSelector": "body" } ] } }, "position": [ -368, 720 ] }, { "id": "038437ba-a758-4e4e-a17b-982f799b12f2", "name": "Analyze Compliance Risk", "type": "llm", "params": { "text": "=You are a multilingual compliance risk detection AI. \nAnalyze the following email text:\nSubject: {{ $('Catch Incoming Emails').item.json.subject }}\nBody: {{ $json.clean_body }}\n\nSTRICTLY return valid JSON only, translated into English for standard reporting:\n{\n \"risk_type\": \"Fraud/Data Leak/Phishing/None\",\n \"risk_level\": \"High/Medium/Low\",\n \"confidence\": 0-100,\n \"reason\": \"Brief explanation in Markdown format\"\n}", "prompt": "=You are a multilingual compliance risk detection AI. \nAnalyze the following email text:\nSubject: {{ $('Catch Incoming Emails').item.json.subject }}\nBody: {{ $json.clean_body }}\n\nSTRICTLY return valid JSON only, translated into English for standard reporting:\n{\n \"risk_type\": \"Fraud/Data Leak/Phishing/None\",\n \"risk_level\": \"High/Medium/Low\",\n \"confidence\": 0-100,\n \"reason\": \"Brief explanation in Markdown format\"\n}", "options": {}, "provider": "openai", "promptType": "define", "approximated": true }, "position": [ 48, 720 ] }, { "id": "6e5b5549-352d-4d9a-b250-0dd302ad5e2c", "name": "Clean & Parse AI Output", "type": "code", "params": { "jsCode": "for (const item of $input.all()) {\n let rawText = item.json.output || \"\";\n let cleanString = \"\";\n \n // Step 1: Hunt down the JSON inside the text (Ignore Markdown)\n const match = rawText.match(/\\{[\\s\\S]*\\}/);\n \n if (match) {\n cleanString = match[0];\n } else {\n // Fallback if there are no brackets found\n cleanString = rawText.replace(/```json/g, '').replace(/```/g, '').trim();\n }\n \n // Step 2: Safely attempt to parse the clean string into an object\n try {\n item.json.parsed_data = JSON.parse(cleanString);\n } catch (error) {\n // Safe fallback if the AI hallucinates completely invalid JSON\n item.json.parsed_data = {\n \"risk_type\": \"Parse Error\",\n \"risk_level\": \"Medium\",\n \"confidence\": 0,\n \"reason\": \"System Error: AI generated invalid JSON formatting. Manual review required.\"\n };\n }\n}\n\nreturn $input.all();" }, "position": [ 352, 720 ] }, { "id": "5d1cf672-85f0-407a-81a8-23c1f234f40b", "name": "Prep Variables for Routing", "type": "set", "params": { "options": {}, "assignments": { "assignments": [ { "id": "41ad59af-320d-413e-b6b8-291a10921a86", "name": "risk_type", "type": "string", "value": "={{ $json.parsed_data.risk_type }}" }, { "id": "e6185c80-0e41-4d64-882e-621f1dce48f9", "name": "risk_level", "type": "string", "value": "={{ $json.parsed_data.risk_level }}" }, { "id": "64a8001f-cfc4-450b-abf3-1d3328a2f932", "name": "confidence", "type": "number", "value": "={{ $json.parsed_data.confidence }}" }, { "id": "6bd158cc-0986-4913-bc7f-8693a5cc1068", "name": "reason", "type": "string", "value": "={{ $json.parsed_data.reason }}" } ] } }, "position": [ 544, 720 ] }, { "id": "6ccc7849-44eb-461e-82e7-9b99ec88f1c6", "name": "Route by Risk Level", "type": "switch", "params": { "rules": { "values": [ { "conditions": { "options": { "version": 3, "leftValue": "", "caseSensitive": true, "typeValidation": "strict" }, "combinator": "and", "conditions": [ { "id": "48242fa0-0f4f-479d-9b76-8455615a3cdc", "operator": { "type": "string", "operation": "equals" }, "leftValue": "={{ $json.risk_level }}", "rightValue": "High" } ] } }, { "conditions": { "options": { "version": 3, "leftValue": "", "caseSensitive": true, "typeValidation": "strict" }, "combinator": "and", "conditions": [ { "id": "f46b5ad4-c309-4328-8ad6-a43273954079", "operator": { "name": "filter.operator.equals", "type": "string", "operation": "equals" }, "leftValue": "={{ $json.risk_level }}", "rightValue": "Medium" } ] } }, { "conditions": { "options": { "version": 3, "leftValue": "", "caseSensitive": true, "typeValidation": "strict" }, "combinator": "and", "conditions": [ { "id": "5081e8b4-9797-4deb-8c4d-d4884f301c42", "operator": { "name": "filter.operator.equals", "type": "string", "operation": "equals" }, "leftValue": "={{ $json.risk_level }}", "rightValue": "Low" } ] } } ] }, "options": {} }, "position": [ 896, 704 ] }, { "id": "41ee46a2-b6bc-48fb-a830-367b94cf7c34", "name": "Block Low-Confidence Alerts", "type": "passthrough", "params": { "mode": "filter", "options": {}, "conditions": { "options": { "version": 3, "leftValue": "", "caseSensitive": true, "typeValidation": "strict" }, "combinator": "and", "conditions": [ { "id": "12364f6c-6c06-4572-adc9-44c698fd7b22", "operator": { "type": "number", "operation": "gt" }, "leftValue": "={{ $('Clean & Parse AI Output').item.json.parsed_data.confidence }}", "rightValue": 80 } ] } }, "position": [ 1152, 688 ] }, { "id": "58e5cf05-d294-4155-8bf5-da80dd7dcb18", "name": "Generate Secure Incident ID", "type": "integration", "params": { "type": "SHA256", "value": "={{ $('Catch Incoming Emails').item.json.replyTo.value[0].address }} + {{ $('Catch Incoming Emails').item.json.headers.date }}", "service": "crypto", "operation": "run", "__originalType": "n8n-nodes-base.crypto", "dataPropertyName": "incident_hash" }, "position": [ 1488, 688 ] }, { "id": "3cc70a5e-ef2a-4c13-93e2-41903059b5d6", "name": "Save to Audit Log", "type": "integration", "params": { "columns": { "value": { "Risk_Type": "={{ $('Clean & Parse AI Output').item.json.parsed_data.risk_type }}", "Incident_Hash": "={{ $json.incident_hash }}", "Incident_Time": "={{ $('Catch Incoming Emails').item.json.headers.date }}", "Risk_Confidence": "={{ $('Clean & Parse AI Output').item.json.parsed_data.confidence }}" }, "schema": [ { "id": "Incident_Time", "type": "string", "display": true, "required": false, "displayName": "Incident_Time", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Incident_Hash", "type": "string", "display": true, "required": false, "displayName": "Incident_Hash", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Risk_Type", "type": "string", "display": true, "required": false, "displayName": "Risk_Type", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Risk_Confidence", "type": "string", "display": true, "required": false, "displayName": "Risk_Confidence", "defaultMatch": false, "canBeUsedToMatch": true } ], "mappingMode": "defineBelow", "matchingColumns": [], "attemptToConvertTypes": false, "convertFieldsToString": false }, "options": {}, "service": "googleSheets", "operation": "append", "sheetName": { "__rl": true, "mode": "list", "value": "gid=0", "cachedResultUrl": "https://docs.google.com/spreadsheets/d/1VqX5i22NJ5NaKzxl9zyg6vBSvNt8dPa6qKAoqO-DbJc/edit#gid=0", "cachedResultName": "Sheet1" }, "documentId": { "__rl": true, "mode": "list", "value": "1VqX5i22NJ5NaKzxl9zyg6vBSvNt8dPa6qKAoqO-DbJc", "cachedResultUrl": "https://docs.google.com/spreadsheets/d/1VqX5i22NJ5NaKzxl9zyg6vBSvNt8dPa6qKAoqO-DbJc/edit?usp=drivesdk", "cachedResultName": "compliance_logs" } }, "position": [ 1664, 688 ] }, { "id": "d819b4fb-3089-4081-80f3-edf0584595ec", "name": "Format AI Report", "type": "passthrough", "params": { "html": "={{ $('Clean & Parse AI Output').item.json.parsed_data.reason }}", "mode": "noOp", "options": {} }, "position": [ 1840, 688 ] }, { "id": "35805598-6a09-4839-a23a-2fb8e615b838", "name": "Send Security Alert", "type": "integration", "params": { "sendTo": "REPLACE_WITH_YOUR_EMAIL", "message": "=

Compliance Risk Detected

Incident ID:	{{ $json.Incident_Hash }}
Timestamp:
Risk Type:	{{ $json.Risk_Type }}
AI Confidence:	{{ $json.Risk_Confidence }}%

AI Analysis & Reasoning:

", "options": {}, "service": "gmail", "subject": "=Alert!!! Incident Report: Risky Mail Found..", "operation": "read" }, "position": [ 2016, 688 ] }, { "id": "2e2440b7-a32f-40be-b549-90f3584766a5", "name": "Start", "type": "manualTrigger", "params": {}, "position": [ -832, 720 ] } ] }

Monitor Gmail for compliance risks with Google Gemini and Google Sheets