Slack Alerts & Jira Tickets for Quarantined Malicious Emails

This n8n workflow automates security incident response for emails flagged by Sublime Security. It starts with a Webhook trigger receiving POST alerts from Sublime, followed by an HTTP Request to fetch detailed message info using the messageId. The flow then branches into two parallel paths: one looks up the recipient in Slack by email and sends a notification with email subject, sender, and quarantine details; the other checks the 'read_at' timestamp to detect if the email was opened.

If opened, it compiles a summary table of flagged rules and creates a Jira Software issue with comprehensive details including subject, sender, recipient, and rules. This ensures quick user awareness and escalates threats for investigation without manual intervention.

Benefits include reduced response times, minimized phishing risks, and centralized tracking in Jira. Ideal for IT/security teams in organizations using Slack, Jira, and Sublime Security, saving hours on routine alerts and enabling proactive threat hunting. Setup requires API credentials for Slack, Jira, and Sublime; test with sample alerts to validate.