{ "edges": [ { "to": "cbb2d34e-3f83-43f4-9d91-de65f90b0c32", "from": "97f137c1-9f6e-49c0-a169-7e85e8f2bc39", "toPort": "0", "fromPort": "0" }, { "to": "c481ce0d-a3aa-4426-8f25-77829b5f841a", "from": "5ef1f081-7c24-4f08-a87b-f4532fd20d09", "toPort": "0", "fromPort": "0" }, { "to": "408d09ed-d78d-4021-88b8-de30f8dfa8e0", "from": "cbb2d34e-3f83-43f4-9d91-de65f90b0c32", "toPort": "0", "fromPort": "0" }, { "to": "97f137c1-9f6e-49c0-a169-7e85e8f2bc39", "from": "c481ce0d-a3aa-4426-8f25-77829b5f841a", "toPort": "0", "fromPort": "0" }, { "to": "95254954-ae02-4cb3-bc40-e84f8110dcbd", "from": "5684e67f-30f6-4de0-9f8e-3e9f0b84d563", "toPort": "0", "fromPort": "0" }, { "to": "97529820-0972-47a6-8c73-2a207949ccae", "from": "5684e67f-30f6-4de0-9f8e-3e9f0b84d563", "toPort": "0", "fromPort": "1" }, { "to": "97529820-0972-47a6-8c73-2a207949ccae", "from": "95254954-ae02-4cb3-bc40-e84f8110dcbd", "toPort": "0", "fromPort": "0" }, { "to": "5ef1f081-7c24-4f08-a87b-f4532fd20d09", "from": "007a26cb-e928-4ea5-adc0-dba5a2ad80f8", "toPort": "0", "fromPort": "0" }, { "to": "5bcb91fa-e14e-44b4-91f5-2c4611b51195", "from": "2692224b-d028-4242-bf9f-0b7697de695e", "toPort": "0", "fromPort": "0" }, { "to": "2692224b-d028-4242-bf9f-0b7697de695e", "from": "408d09ed-d78d-4021-88b8-de30f8dfa8e0", "toPort": "0", "fromPort": "0" }, { "to": "b5452522-ad2e-46f6-a826-e242e3f4e8c1", "from": "5bcb91fa-e14e-44b4-91f5-2c4611b51195", "toPort": "0", "fromPort": "0" }, { "to": "9a1f02c1-55d2-4812-8868-541eb5c52da1", "from": "5bcb91fa-e14e-44b4-91f5-2c4611b51195", "toPort": "0", "fromPort": "0" }, { "to": "5684e67f-30f6-4de0-9f8e-3e9f0b84d563", "from": "5bcb91fa-e14e-44b4-91f5-2c4611b51195", "toPort": "0", "fromPort": "0" } ], "nodes": [ { "id": "5ef1f081-7c24-4f08-a87b-f4532fd20d09", "name": "Compute Time Window", "type": "code", "params": { "functionCode": "// Compute from/to in local ISO8601 with timezone\nconst sd = this.getWorkflowStaticData('global');\nconst now = new Date();\nconst pollMinutes = 5; // adjust if you change cron\nlet fromDate;\nif (sd.lastRun) fromDate = new Date(sd.lastRun); else fromDate = new Date(now.getTime() - (pollMinutes + 1) * 60000);\n// helper to produce local ISO without ms +TZ\nfunction toLocalISO(date) {\n const off = -date.getTimezoneOffset();\n const sign = off >= 0 ? '+' : '-';\n const pad = n => String(Math.floor(Math.abs(n))).padStart(2, '0');\n const hrs = pad(off / 60);\n const mins = pad(off % 60);\n return date.toISOString().split('.')[0] + sign + hrs + ':' + mins;\n}\nconst from = toLocalISO(fromDate);\nconst to = toLocalISO(now);\n// don't update lastRun here — update after processing to avoid gaps\nreturn [{ json: { from, to } }];" }, "position": [ 304, 432 ] }, { "id": "c481ce0d-a3aa-4426-8f25-77829b5f841a", "name": "SET - Workflow Config", "type": "set", "params": { "values": { "number": [], "string": [ { "name": "pollMinutes", "value": "5" }, { "name": "requiredModules", "value": "Leads,Contacts,Accounts,Deals" }, { "name": "sheetId", "value": "1i_fwIeqtrTcqnFfWtnAYsrwPxG9eYi7q9T4O_K-vchY" }, { "name": "sheetName", "value": "Sheet1" }, { "name": "dryRun", "value": "true" }, { "name": "batchSize", "value": "100" }, { "name": "workflow_overview", "value": "How it works:\\nThis workflow polls Zoho CRM modules for recent changes, normalizes the returned records, analyzes them for suspicious patterns (deletions, owner/email/role changes, or many fields changed), generates an audit JSON attachment, logs events to a Google Sheet, and notifies the security team by email for suspicious events. Timing is tracked using 'lastRun' stored in workflow static data so only new changes are processed.\\n\\nSetup steps:\\n1) Add / verify the Zoho OAuth2 credentials and ensure API scopes include CRM read access.\\n2) Set Google Sheets and Gmail credentials and update the 'sheetId' in SET node.\\n3) Optionally change 'pollMinutes', 'requiredModules', or 'dryRun' in the SET node.\\n4) Run the workflow manually once to confirm permissions, then enable scheduled trigger (cron) as needed." }, { "name": "group_stickies", "value": "1) API & Module discovery: Lists modules and fetches modified records.\\n2) Processing & Logging: Normalizes items, analyzes suspicious patterns, creates audit file, logs to sheet & notifies." } ], "boolean": [] }, "options": {} }, "position": [ 528, 432 ] }, { "id": "97f137c1-9f6e-49c0-a169-7e85e8f2bc39", "name": "Zoho: List Modules", "type": "http", "params": { "url": "=https://www.zohoapis.in/crm/v8/settings/modules", "options": {}, "authentication": "oAuth2" }, "position": [ 752, 432 ] }, { "id": "cbb2d34e-3f83-43f4-9d91-de65f90b0c32", "name": "Prepare Modules List", "type": "code", "params": { "functionCode": "// Build one item per module from modules list response\nconst res = items[0] && items[0].json ? items[0].json : {};\nconst modulesRaw = Array.isArray(res.modules) ? res.modules : (res.modules || []);\n// Filter out system modules optionally (blacklist) - you can adjust this array if needed\nconst requiredModule = ['Leads','Contacts','Accounts','Deals'];\nconst modules = modulesRaw.map(m => m.api_name || m.module_name).filter(m => m && requiredModule.includes(m));\nconst from = $json.from || new Date().toISOString();\nreturn modules.map(m => ({ json: { module: m, from_local: from } }));" }, "position": [ 976, 432 ] }, { "id": "408d09ed-d78d-4021-88b8-de30f8dfa8e0", "name": "Zoho: Search Module Records", "type": "http", "params": { "url": "=https://www.zohoapis.in/crm/v8/{{$json[\"module\"]}}/search?criteria=(Modified_Time:less_equal:{{encodeURIComponent(new Date($json[\"from_local\"]).toISOString().split('.')[0] + \"+05:30\")}})", "options": {}, "authentication": "oAuth2" }, "position": [ 1200, 432 ] }, { "id": "2692224b-d028-4242-bf9f-0b7697de695e", "name": "Normalize Module Records", "type": "code", "params": { "functionCode": "// Expand responses into records and set module by index\nconst out = [];\nconst requiredModule = ['Leads','Contacts','Accounts','Deals'];\n\nfor (let i = 0; i < items.length; i++) {\n const item = items[i];\n const resp = item.json || {};\n const body = resp.body || resp;\n\n // module name: prefer requiredModule by index, else any module field in response, else Unknown\n const moduleName = requiredModule[i] || body.module || resp.module || item?.pairedItem?.json?.module || 'Unknown';\n\n // Get records array from body.data (Zoho response) or resp.data\n const records = Array.isArray(body.data) ? body.data : (Array.isArray(resp.data) ? resp.data : []);\n\n if (!records || records.length === 0) continue;\n\n for (const rec of records) {\n const r = { ...rec };\n r.module = moduleName;\n r.recordId = r.id || r.ID || r.record_id || r.recordId || '';\n r.timestamp = r.Modified_Time || r.Created_Time || new Date().toISOString();\n out.push({ json: r });\n }\n}\n\nreturn out;\n" }, "position": [ 1424, 432 ] }, { "id": "5bcb91fa-e14e-44b4-91f5-2c4611b51195", "name": "Analyze for Suspicious Activity", "type": "code", "params": { "functionCode": "// Detect unusual patterns (module-agnostic) - unchanged but robustified\nfor (const item of items) {\n const entry = item.json;\n const changed = (entry.changed_fields || entry.Changed_Fields || entry.changedFields || '').toString().toLowerCase();\n const event = (entry.event || entry.Action || '').toString().toLowerCase();\n let suspicious = false;\n const reasons = [];\n if (event.includes('delete')) { suspicious = true; reasons.push('deletion'); }\n if (changed.includes('owner') || changed.includes('assigned_to') || changed.includes('owner_id')) { suspicious = true; reasons.push('owner_changed'); }\n if (changed.includes('email') || changed.includes('contact_email')) { suspicious = true; reasons.push('email_changed'); }\n if (changed.includes('role') || changed.includes('is_admin') || changed.includes('profile')) { suspicious = true; reasons.push('role_or_privilege_change'); }\n const fieldsCount = changed ? changed.split(',').filter(f => f.trim()).length : 0;\n if (fieldsCount >= 10) { suspicious = true; reasons.push('many_fields_changed'); }\n entry.suspicious = suspicious;\n entry.suspicious_reasons = reasons.join(',');\n entry.fields_changed_count = fieldsCount;\n entry.module = entry.module || entry.Module || 'Unknown';\n entry.recordId = entry.recordId || entry.id || entry.ID || entry.record_id || '';\n entry.timestamp = entry.timestamp || entry.Modified_Time || entry.Created_Time || new Date().toISOString();\n}\nreturn items;" }, "position": [ 1648, 432 ] }, { "id": "b5452522-ad2e-46f6-a826-e242e3f4e8c1", "name": "Create Audit Attachment (JSON)", "type": "code", "params": { "functionCode": "// Create audit JSON file as binary attachment for each item\nfor (const item of items) {\n const data = JSON.stringify(item.json, null, 2);\n const b64 = Buffer.from(data).toString('base64');\n item.binary = { audit: { data: b64, fileName: 'audit-' + (item.json.timestamp || new Date().toISOString()).replace(/[:.]/g, '-') + '.json', mimeType: 'application/json' } };\n}\nreturn items;" }, "position": [ 1872, 240 ] }, { "id": "9a1f02c1-55d2-4812-8868-541eb5c52da1", "name": "Log to Google Sheet (append/update)", "type": "integration", "params": { "columns": { "value": { "Email": "= {{$json.Email || \"-\"}}", "Module": "= {{$json.module}}", "Record Id": "= {{$json.recordId}}", "Timestamp": "= {{$json.timestamp}}", "User Name": "= {{$json.Full_Name || $json.Contact_Name?.name || $json.Owner?.name}}", "Company Name": "= {{$json.Company || $json.Account_Name?.name || \"-\"}}", "Is Suspicious": "= {{$json.suspicious == false ? \"No\" : \"Yes\"}}", "Field Changes Count": "= {{$json.fields_changed_count}}" }, "schema": [ { "id": "Timestamp", "type": "string", "display": true, "required": false, "displayName": "Timestamp", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Module", "type": "string", "display": true, "required": false, "displayName": "Module", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Record Id", "type": "string", "display": true, "required": false, "displayName": "Record Id", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "User Name", "type": "string", "display": true, "required": false, "displayName": "User Name", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Company Name", "type": "string", "display": true, "required": false, "displayName": "Company Name", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Email", "type": "string", "display": true, "required": false, "displayName": "Email", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Field Changes Count", "type": "string", "display": true, "required": false, "displayName": "Field Changes Count", "defaultMatch": false, "canBeUsedToMatch": true }, { "id": "Is Suspicious", "type": "string", "display": true, "required": false, "displayName": "Is Suspicious", "defaultMatch": false, "canBeUsedToMatch": true } ], "mappingMode": "defineBelow", "matchingColumns": [ "Record Id" ], "attemptToConvertTypes": false, "convertFieldsToString": false }, "options": {}, "service": "googleSheets", "operation": "appendOrUpdate", "sheetName": { "__rl": true, "mode": "name", "value": "={{$node[\"SET - Workflow Config\"].json[\"sheetName\"] || \"Sheet1\"}}" }, "documentId": { "__rl": true, "mode": "id", "value": "={{$node[\"SET - Workflow Config\"].json[\"sheetId\"] || \"1i_fwIeqtrTcqnFfWtnAYsrwPxG9eYi7q9T4O_K-vchY\"}}" } }, "position": [ 1872, 432 ] }, { "id": "5684e67f-30f6-4de0-9f8e-3e9f0b84d563", "name": "Check Suspicious? (If)", "type": "if", "params": { "options": {}, "conditions": { "options": { "version": 2, "leftValue": "", "caseSensitive": true, "typeValidation": "strict" }, "combinator": "and", "conditions": [ { "id": "1d6b463f-40cd-4948-a1d5-189b1821ff74", "operator": { "type": "boolean", "operation": "true", "singleValue": true }, "leftValue": "={{ $json.suspicious }}" } ] } }, "position": [ 1872, 624 ] }, { "id": "95254954-ae02-4cb3-bc40-e84f8110dcbd", "name": "Notify Security (Email)", "type": "integration", "params": { "toList": [ "" ], "message": "=", "service": "gmail", "subject": "=Zoho CRM Suspicious activity: {{$json.module}} - {{$json.recordId}}", "resource": "message", "operation": "read", "htmlMessage": "=\n

🔔 Suspicious activity detected in Zoho CRM

Automatic alert from Zoho CRM Security Automation

\n\n

\n \n \n \n \n \n \n\n \n \n \n \n\n \n \n \n \n\n \n \n \n \n\n \n \n \n \n\n \n \n \n \n \n

Detected On	\n {{\n (() => {\n const ts = $json[\"timestamp\"] \|\| $json[\"Modified_Time\"] \|\| '';\n if (!ts) return '';\n const date = new Date(ts);\n const options = { hour12: true, hour: '2-digit', minute: '2-digit' };\n const time = date.toLocaleTimeString('en-IN', options);\n const formatted = `${date.getFullYear()}-${String(date.getMonth()+1).padStart(2,'0')}-${String(date.getDate()).padStart(2,'0')} ${time}`;\n return formatted;\n })()\n }}\n
Module	{{$json[\"module\"] \|\| $json[\"Module\"] \|\| ''}}
Record ID	{{$json[\"recordId\"] \|\| $json[\"id\"] \|\| ''}}
User	\n {{$json[\"User_Name\"] \|\| ($json[\"Owner\"] && $json[\"Owner\"].name) \|\| ''}}\n {{$json[\"User_Email\"] \|\| ($json[\"Owner\"] && $json[\"Owner\"].email) \|\| ''}} \n
Company / Name	{{$json[\"Company\"] \|\| $json[\"Full_Name\"] \|\| ''}}
Suspicious	\n {{$json[\"suspicious\"]===true ? 'Yes' : 'No'}}\n

\n\n

\n Recommended action\n

Review the record in Zoho immediately using the link above.
If changes are unauthorized — disable or suspend the user and reset credentials.
Check recent login and API activity for the user account.

\n\n

\n This alert was automatically generated by the Zoho CRM Security Workflow. If you believe this is a false positive, mark it as reviewed and add a short note.\n

\n\n

", "includeHtml": true, "additionalFields": {} }, "position": [ 2096, 560 ] }, { "id": "97529820-0972-47a6-8c73-2a207949ccae", "name": "Update lastRun (staticData)", "type": "code", "params": { "functionCode": "// Update lastRun after processing (use UTC ISO for storage)\nconst sd = this.getWorkflowStaticData('global');\nsd.lastRun = new Date().toISOString();\nreturn items;" }, "position": [ 2320, 624 ] }, { "id": "007a26cb-e928-4ea5-adc0-dba5a2ad80f8", "name": "Manual Trigger (Run Now)", "type": "manualTrigger", "params": {}, "position": [ 80, 432 ] } ] }

Monitor Zoho CRM changes & alert on suspicious activity with Google Sheets