Quick Overview
Quick Overview This workflow pulls the last 24 hours of aggregated security logs from a SIEM API, normalizes and deduplicates events, uses OpenAI to generate a daily risk briefing with optional escalation gating, and sends a short summary via WhatsApp and a detailed HTML report via email. How it works Runs every morning on a schedule (or manually for testing). Queries your SIEM/log aggregator API for events from the configured systems over the last 24 hours. Normalizes mixed log formats, categorizes events, collapses near-duplicates, scores severity, and trims to the most notable events. Uses OpenAI to produce a JSON briefing with an executive summary, findings, recommended actions, overall risk level, and an escalationRequired flag. Builds two outputs from the AI result: a short WhatsApp message and a detailed HTML email with category and top-IP breakdowns. If escalation is required, waits for a security lead acknowledgment before proceeding. Sends the daily briefing to the configured recipient via WhatsApp Business Cloud API and via SMTP email. Setup Provide an HTTP Header Auth credential for your SIEM/log aggregator API and update the logAggregatorApiUrl and query parameters as needed for your platform. Add OpenAI credentials for the Chat Model used to generate the briefing. Configure WhatsApp Business Cloud API credentials and set the WhatsApp phone number ID and recipient phone number in the config. Configure SMTP email credentials and set the from/to addresses used for the daily email. Adjust the schedule time, lookback window (timeRangeHours), and notableEventLimit to match your reporting needs. An n8n automation workflow template by Oneclick AI Squad.
Oneclick AI Squad
web
free
Others in the same category, ranked by how often they are opened.
