Triage new certificate transparency subdomains with Google Sheets, Slack, Gmail and OpenAI
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 26 nodes and runs on a schedule (every day at 07:00) (plus 1 other trigger). Along the way it connects Google Sheets, OpenAI Chat Model, Slack and Gmail.
How it runs
Trigger: On a schedule (every day at 07:00) (plus 1 other trigger).
- Configuration (Edit Fields (Set)): sets 11 fields: apexDomains, sheetId, sheetTabName…
- Ensure Sheet Headers (HTTP Request): calls an HTTP API (PUT)
- Read Known Subdomains (Google Sheets): uses Google Sheets
- Split Apex Domains (Code): runs custom JavaScript code
- Fetch CT Subdomain Index (HTTP Request): calls an HTTP API
- Diff Against Sheet Baseline (Code): runs custom JavaScript code
- Apply Exposure Policy (Code): runs custom JavaScript code
- Rank and Flag Probe Queue (Code): runs custom JavaScript code
- Probe This Host? (If): checks a condition and branches into true / false
- Probe Host over HTTPS (HTTP Request): calls an HTTP API
…plus 12 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (14)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Manual Trigger
n8n-nodes-base.manualTrigger - Edit Fields (Set)
n8n-nodes-base.set - HTTP Request
n8n-nodes-base.httpRequest - Google Sheets
n8n-nodes-base.googleSheets - Code
n8n-nodes-base.code - If
n8n-nodes-base.if - Basic LLM Chain
@n8n/n8n-nodes-langchain.chainLlm - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - Structured Output Parser
@n8n/n8n-nodes-langchain.outputParserStructured - Merge
n8n-nodes-base.merge - Filter
n8n-nodes-base.filter - Slack
n8n-nodes-base.slack - Gmail
n8n-nodes-base.gmail
From the author
Quick overview This workflow monitors certificate transparency for new subdomains on your apex domains via crt.name, records them in Google Sheets, probes a capped set over HTTPS, optionally refines triage with an OpenAI chat model, and sends an alert digest…