Auto-Triage Security Incidents in n8n with GPT-4o-mini and Gmail Alerts

Security Hub alert → Webhook ingestion → field normalization → LLM classification & severity → LLM remediation plan → Gmail HTML brief

Who

SOC or cloud ops staff who need to auto-grade AWS Security Hub-style alerts and notify owners

You get

An automated HTML email brief with incident type, severity (P0–P3), urgency, a 3-step remediation plan, and owner hint

You need

n8n · Gmail

Steps

1. Configure the Webhook trigger and test entrypoint

   Add a Webhook node in n8n, set HTTP Method to POST and Path to mini-triage. Save and copy the Webhook URL. Use the curl below to send a test payload and confirm the workflow triggers.

   Setup guidance · Source text。Sticky Note next to Webhook node; test entrypoint example

   Copy prompt

   📥 ENTRY 
   
   Send a POST to /mini-triage to get started!
   
   Example:
   
   curl -X POST "$YOUR_WEBHOOK_URL" \
     -H "Content-Type: application/json" \
     -d '{
       "detail": {
         "findings": [{
           "Title": "Multiple failed logins",
           "Description": "probable credential stuffing",
           "AwsAccountId": "111111111111",
           "Resources": [{ "Id": "user:[email protected]", "Type": "AwsIamUser" }]
         }]
       }
     }'

2. Normalize alert fields (Clean_Finding)

   Add an Edit Fields (Set) node named Clean_Finding. Map the following fields from body.detail.findings[0]: Title, Description, account_id (AwsAccountId), resource_id (Resources[0].Id), resource_type (Resources[0].Type), updated_at (UpdatedAt or current time). These fields feed the downstream LLM nodes.

3. LLM classification and severity (Classify)

   Add an OpenAI node named Classify, select model gpt-4o-mini, set temperature to 0.2, and enable JSON Output. Paste the following system prompt to enforce strict JSON output with incident_type, severity, urgency, short_title, and why.

   Execution prompt · Source text。Classify node System Message field

   Copy prompt

   You are the SOC Classifier. Output VALID JSON only with keys:
   {
     "incident_type": "creds|malware|network|data|cloud|other",
     "severity": "P0|P1|P2|P3",
     "urgency": "now|today|this_week",
     "short_title": "≤12 words",
     "why": "≤50 words"
   }
   Rules:
   - Prefer "cloud" if resource_type looks like cloud infra (e.g., AwsS3Bucket, SecurityGroup, IAM).
   - If title contains "public", "exposed", "leak" → data|cloud depending on resource.
   - If unclear, return "other" and P3, but try to use title/description before giving up.
   - Be conservative with P0.
   
   Examples:
   Input: {"title":"S3 bucket public READ","description":"ACL allows public READ","resource_type":"AwsS3Bucket"}
   Output: {"incident_type":"cloud","severity":"P2","urgency":"today","short_title":"Public S3 read","why":"Public READ on bucket risks data exposure."}
   
   Input: {"title":"Multiple failed logins","description":"probable credential stuffing"}
   Output: {"incident_type":"creds","severity":"P2","urgency":"today","short_title":"Credential stuffing suspected","why":"Repeated failures indicate attack; monitor & protect accounts."}

4. LLM remediation planning (Plan)

   Add a second OpenAI node named Plan, again using gpt-4o-mini with temperature 0.2 and JSON Output enabled. The System Message defines the remediation JSON schema; the User Message references Classify output and original Webhook data via n8n expressions.

   Execution prompt · Source text。Plan node System Message field

   Copy prompt

   You are the Remediation Planner. Based on the classifier output and original finding, return VALID JSON:
   {
     "next_actions": ["step 1", "step 2", "step 3"],
     "owner_hint": "who should act first (e.g., Cloud On-Call, IAM, EDR)",
     "success_criteria": "what proves it's resolved"
   }
   Keep it to 3 atomic steps max. No speculation.

   Execution prompt · Source text。Plan node User Message field; n8n expression evaluated at runtime

   Copy prompt

   =Classifier:
   ```json
   {{$node["Classify"].json}}
   {{$node["Webhook"].json}}

5. Send HTML email brief (Gmail)

   Add a Gmail node named Send a message. Set the recipient address. Use the following n8n expressions for Subject and Message to dynamically assemble classification results and the remediation plan. Select the pre-configured gmailOAuth2 credential.

   Execution prompt · Source text。Gmail node Message field (HTML email body)

   Copy prompt

   =<h3>
     {{ $('Classify').item.json.message.content.short_title }}
     ({{ $('Classify').item.json.message.content.severity }})
   </h3>
   
   <p>
     <b>Type:</b> {{ $('Classify').item.json.message.content.incident_type }}
     &nbsp;|&nbsp;
     <b>Resource Name:</b> {{ $('Clean_Finding').item.json.resource_id }}
   </p>
   
   <p>
     <b>Account:</b> {{ $('Clean_Finding').item.json.account_id }}
   </p>
   
   <p>
     <b>Urgency:</b> {{ $('Classify').item.json.message.content.urgency }}
   </p>
   
   <p>
     <b>Why:</b> {{ $('Classify').item.json.message.content.why }}
   </p>
   
   <p><b>Next Actions</b></p>
   <ol>
     <li>{{ $json.message.content.next_actions[0] }}</li>
     <li>{{ $json.message.content.next_actions[1] }}</li>
     <li>{{ $json.message.content.next_actions[2] }}</li>
   </ol>
   
   <p>
     <b>Owner:</b> {{ $json.message.content.owner_hint }} <br/>
     <b>Success:</b> {{ $json.message.content.success_criteria }}
   </p>

   Execution prompt · Source text。Gmail node Subject field

   Copy prompt

   ={{ $('Classify').item.json.message.content.short_title }}- {{ $('Clean_Finding').item.json.resource_id }} in {{ $('Clean_Finding').item.json.account_id }}

You are setting up n8n template 7785 for automated security incident triage. Confirm in order: 1) n8n is publicly reachable; 2) OpenAI and Gmail credentials are created; 3) import workflow.json or build nodes manually; 4) send a test curl to /mini-triage and verify outputs from Webhook, Classify, Plan, and Gmail before connecting real Security Hub traffic.