Automate Security Incident Triage with GPT-4o-mini & Gmail

This n8n workflow automates the triage of inbound security incidents, such as those from AWS Security Hub via EventBridge and SNS to a webhook. It normalizes incoming JSON data (title, description, account, resource details), uses GPT-4o-mini to classify incidents by type, severity (P0-P3), urgency, and rationale, then generates a concise 3-step remediation plan with owner hints and success criteria.

The workflow streamlines incident response for security teams by reducing manual analysis time from hours to seconds. It produces a professional HTML email with a dynamic subject line and structured body including type, urgency, why it matters, next actions, owner, and criteria—perfect for alerting on-call engineers or managers.

Ideal use cases include cloud security monitoring in AWS environments, SIEM integrations, or any JSON-based alert source. Swap Gmail for Slack/Teams, or OpenAI for other LLMs. Setup takes 10-15 minutes with n8n CE, OpenAI creds, and Gmail OAuth—mostly free, low-cost on API usage. Enhances MTTR (mean time to respond) in SecOps pipelines.