Auto-Classify Security Incidents with GPT-4 & Google Sheets for SOC

This workflow reads recent endpoint alerts from Google Sheets, including hostname, IP, and risk scores. It sends this data to OpenAI's GPT-4 model via a structured prompt, which analyzes and returns JSON output with a severity tag and recommended action. The classified incidents are then logged to a centralized sheet for tracking and prioritization.

Ideal for Blue Team leads, SOC analysts, and IT responders, it integrates with existing threat scoring tools like CyberScan or BlueOps. Benefits include rapid triage, reduced manual effort, consistent classification using AI logic, and scalability for high-volume alerts. It supports playbooks for Monitor/Investigate/Isolate/Escalate, saving hours daily on incident prioritization.

Setup requires an OpenAI API key, Google Sheets OAuth credentials, and optional Cron/Webhook triggers. Customize by swapping LLMs (Claude/Gemini), databases (Supabase/Airtable), or adding notifications/EDR integrations. Production-grade with safe placeholders for easy deployment.