Automated Email Threat Analysis with Sublime Security

This n8n workflow automates the processing of incoming emails with .eml attachments using IMAP to trigger on new messages. It checks for attachments, extracts binary data, converts it to JSON, and submits it to Sublime Security for threat analysis, splitting results into matched threats and safe items.

The workflow enhances organizational security by proactively scanning email attachments for malware and other risks without manual intervention. It integrates seamlessly with Outlook-like systems and ensures compatibility with notification tools like Slack, enabling rapid response to potential threats.

Benefits include reduced response times to cyber threats, minimized human error, and improved transparency through automated Slack reports for both threats and clean scans. Ideal for IT security teams in enterprises handling high email volumes.

Use cases: Security operations centers (SOCs), compliance monitoring in finance/HR, and proactive defense in remote work environments where phishing via attachments is common.