Quick overview This workflow receives offboarding events via webhook, checks the departing employee’s email in RelayShield for breach, infostealer, and OAuth exposure signals, then logs the outcome to Notion and, when risk is detected, alerts the security team in Slack and emails the employee’s manager via Gmail. How it works Receives an HTTP POST webhook from your HR system with the offboarded employee’s details (email, name, department, and manager email). Queries RelayShield for credential breach history, infostealer log matches, and OAuth watchlist exposure for the employee’s email address. Evaluates whether any of the RelayShield checks indicates risk (breaches found, infostealer detected, or OAuth exposure matched). If risk is found, creates a risk-flag entry in a Notion database with the findings and a “Pending Review” status. If risk is found, posts a structured alert with recommended actions to a designated Slack security channel. If risk is found, sends an HTML email to the employee’s manager via Gmail summarizing the findings and next steps. If no risk is found, creates a “Clean — No Action Required” entry in the same Notion database for auditability.
Tags
Gmail
NotionSlackRelated workflows
See all Gmail→
Upload invoices from Gmail to Google Drive
Upload invoices from Gmail to Google Drive daily
WSend labeled email to a Notion database
This workflow sends the contents of an email to a Notion database. The email must be labeled with a specific label for the workflow to trigger. The email subject will be the title of the Notion page, and a snippet of the email body will be the content of the Notion page. The email link will be added to the Notion page as a property. Prerequisites Notion account and Notion credentials. Google account and Google credentials. How it works On scheduled intervals, find all emails with a specific label. For each email, check if the email already exists in the Notion database. If it does not exist, create a new page in the Notion database, otherwise do nothing. When the task in the Notion database is checked off, the label will be removed from the email. Setup This workflow requires that you set up a Notion database or use an existing one with at least the following fields: Title (title) Thread ID (text) Email thread (URL) Additionally, create a label that will be used to trigger the workflow in Gmail. In this workflow, the label is called "Notion".
WURL and IP lookups through Greynoise and VirusTotal
This n8n workflow serves as a powerful cybersecurity and threat intelligence tool to look up URLs or IP addresses through industry standard threat intelligence vendors. It starts with either a form submission or a webhook trigger, allowing users to input data, URLs or IPs that require analysis. The workflow then splits into two paths depending on whether the input data is an IP or URL. If an IP was given, it sets the ip variable to the IP; however if a URL was given the workflow will perform a DNS lookup using Google Public DNS and sets the ip variable based on the results from Google. The workflow then checks the obtained IP addresses against GreyNoise services, with one branch utilizing GreyNoise RIOT IP Lookup to assess IP reputation and association with known benign services, and the other using GreyNoise IP Context to evaluate potential threats. The results from both GreyNoise services are merged to create a comprehensive analysis which includes the IP, classification (benign, malicious, or unknown), IP location, tags to identify activity or malware, category, and trust level. In parallel, a VirusTotal scan is initiated for the URL/IP to identify if it is malicious. A 5-second