Automate security incident response with Google Sheets, email alerts and EDR isolation
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 7 nodes and runs on a schedule (every day). Along the way it connects Google Sheets.
How it runs
Trigger: On a schedule (every day).
- 📄 Read Threat Data (Google Sheets): uses Google Sheets
- Classify Critical Alerts (If): checks a condition and branches into true / false
- Aggregate: combines items into one
- Send Email: sends an email over SMTP
- Google Sheets: uses Google Sheets
- HTTP Request: calls an HTTP API
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (6)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Send Email
n8n-nodes-base.emailSend - HTTP Request
n8n-nodes-base.httpRequest - Google Sheets
n8n-nodes-base.googleSheets - If
n8n-nodes-base.if - Aggregate
n8n-nodes-base.aggregate
From the author
👤 Who it’s for SOC teams, incident responders, or solo defenders who need to automatically act on critical threats without manual triage. Ideal for BlueOps users who’ve already classified alerts via GPT (Module 4) and want to auto-execute response steps like…