Phishing Email Detection with AI Analysis and Jira Ticket Creation

High-Level Summary

This workflow automatically detects potential phishing emails by monitoring your Gmail (and optionally Outlook) inbox, capturing a screenshot of the email's HTML content, analyzing it with OpenAI's ChatGPT-4, and creating a detailed Jira ticket with the analysis and screenshot. It is designed for security teams or IT support who want to streamline phishing reporting and ensure no suspicious email goes uninvestigated.

By combining email triggers, HTML-to-image conversion, AI-powered analysis, and ticketing, this workflow reduces manual effort and provides a consistent, documented process for handling phishing threats.

Node-by-Node Walkthrough

1. Email Triggers (Two Branches)

• Gmail Trigger (OAuth2) — Polls your Gmail inbox every minute for new emails. When a new email arrives, it outputs the email data (subject, body, headers, etc.).
• Microsoft Outlook Trigger (OAuth2) — Disabled by default. Polls your Outlook inbox every minute. If enabled, it outputs email fields like body, subject, and recipients.

2. Data Extraction and Variable Setting

• Set Gmail Variables (No auth) — Extracts key fields from the Gmail trigger output: htmlBody, headers, subject, recipient, and textBody. These are stored as workflow variables for later use.
• Retrieve Headers of Email (OAuth2 – Microsoft Outlook) — For the Outlook branch, this HTTP request fetches the full internet message headers and plain-text body from Microsoft Graph API using the email ID.
• Format Headers (No auth) — A Code node that transforms the raw headers array into a clean object (e.g., { "Received": [...], "From": [...] }) for easier reading.
• Set Outlook Variables (No auth) — Similar to the Gmail branch, it assigns htmlBody, headers, subject, recipient, and textBody from the Outlook data.

3. HTML Screenshot Generation

• Set Email Variables (No auth) — Merges the variables from either the Gmail or Outlook branch into a single set of fields (including htmlBody). It also preserves all other fields from the incoming data.
• Screenshot HTML (HTTP Basic Auth – hcti.io) — Sends the email's HTML body to the hcti.io API via a POST request. The API generates a screenshot of the HTML and returns a URL to the image.
• Retrieve Screenshot (HTTP Basic Auth – hcti.io) — Fetches the actual image binary from the URL returned by the previous node. The image is stored as binary data for attachment.

4. AI Analysis with ChatGPT

• ChatGPT Analysis (API Key – OpenAI) — Sends the email screenshot (as base64) and the headers to OpenAI's ChatGPT-4 model with a prompt to describe the image and determine if it could be a phishing email. The response is formatted for Jira's wiki-style renderer (no code blocks).

5. Jira Ticket Creation and Attachment

• Create Jira Ticket (OAuth2 or Basic Auth – Jira) — Creates a new issue in the specified Jira project (e.g., "Support") with a summary like "Phishing Email Reported: "[subject]"". The description includes the recipient, subject, body text, and the ChatGPT analysis.
• Rename Screenshot (No auth) — A Code node that renames the binary file to emailScreenshot.png for clarity.
• Upload Screenshot of Email to Jira (OAuth2 or Basic Auth – Jira) — Attaches the renamed screenshot to the newly created Jira ticket, providing visual evidence of the email.

Setup Instructions

To use this workflow, you need the following accounts and credentials:

• Gmail – Enable the Gmail API in Google Cloud Console and create OAuth2 credentials. Authorize the n8n Gmail Trigger node with those credentials.
• Microsoft Outlook (optional) – Register an app in Azure AD, grant the Mail.Read permission, and set up OAuth2 credentials for the Microsoft Outlook Trigger and HTTP Request nodes.
• hcti.io – Sign up at htmlcsstoimage.com to get an API key and user ID. Use these as HTTP Basic Auth credentials in the Screenshot HTML and Retrieve Screenshot nodes.
• OpenAI – Create an API key from your OpenAI account. Use it in the ChatGPT Analysis node.
• Jira – Obtain a Jira API token (or use OAuth2) and configure the Jira nodes with your instance URL, project key, and issue type IDs.

All credentials are managed in n8n's Credentials section. The workflow uses the following credential types:

• Gmail OAuth2
• Microsoft Outlook OAuth2
• HTTP Basic Auth (for hcti.io)
• OpenAI API
• Jira API (Basic Auth or OAuth2)

Use Cases and Variations

• Security Operations – Automate phishing reporting for SOC teams. The workflow can be extended to send alerts to Slack or email.
• Compliance – Keep a record of all reported phishing attempts with screenshots and AI analysis for audit trails.
• Multi-Email Integration – The Outlook branch is disabled but can be enabled to monitor both Gmail and Outlook simultaneously.
• Custom Analysis – Modify the ChatGPT prompt to ask for specific indicators (e.g., spoofed domains, urgency language).
• Alternative Screenshot Service – If you self-host n8n, replace hcti.io with a local Puppeteer or Playwright node to avoid sending email content to a third party.
• Different Ticketing Systems – Replace Jira nodes with ServiceNow, Zendesk, or a custom webhook.

Note: The Outlook trigger and related nodes are disabled by default. To use them, enable the nodes and configure the Microsoft Outlook OAuth2 credentials.

{
  "meta": {
    "instanceId": "03e9d14e9196363fe7191ce21dc0bb17387a6e755dcc9acc4f5904752919dca8"
  },
  "nodes": [
    {
      "id": "1bad6bfc-9ec9-48a5-b8f7-73c4de3d08cf",
      "name": "Gmail Trigger",
      "type": "n8n-nodes-base.gmailTrigger",
      "position": [
        1480,
        160
      ],
      "parameters": {
        "simple": false,
        "filters": {},
        "options": {},
        "pollTimes": {
          "item": [
            {
              "mode": "everyMinute"
            }
          ]
        }
      },
      "credentials": {
        "gmailOAuth2": {
          "id": "kkhNhqKpZt6IUZd0",
          "name": " Gmail"
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "9ac747a1-4fd8-46ba-b4c1-75fd17aab2ed",
      "name": "Microsoft Outlook Trigger",
      "type": "n8n-nodes-base.microsoftOutlookTrigger",
      "disabled": true,
      "position": [
        1480,
        720
      ],
      "parameters": {
        "fields": [
          "body",
          "toRecipients",
          "subject",
          "bodyPreview"
        ],
        "output": "fields",
// ... truncated (copy to see full JSON)