Detect and route gameplay security anomalies with GPT-4o, Slack and Sheets

by Cheng Siong Chin ✓ · 82 views · created 2026-02-12 · SecOps, AI Summarization

What this workflow does

This AI workflow has 26 nodes and runs on a schedule (every 15 minutes). Along the way it connects OpenAI Chat Model, Slack and Google Sheets.

How it runs

Trigger: On a schedule (every 15 minutes).

1. Workflow Configuration (Edit Fields (Set)): sets 7 fields: criticalSeverityThreshold, highSeverityThreshold, mediumSeverityThreshold…
2. Generate Gameplay Anomaly Data (Code): runs custom JavaScript code
3. Behavior Validation Agent (AI Agent): runs an AI agent, with model: OpenAI Model - Behavior Validation; output parser: Structured Output Parser
4. Route by Severity (Switch): routes items into 3 branches
5. Governance Agent (AI Agent): runs an AI agent, with model: OpenAI Model - Governance; 3 tools (Slack Tool, Google Sheets Tool, Historical Pattern Analysis Tool); output parser: Structured Output Parser
6. Prepare Low Severity Data (Edit Fields (Set)): sets 3 fields: actionStatus, loggedAt, requiresAction
7. Route by Action Type (Switch): routes items into 3 branches
8. Log Low Severity to Sheets (Google Sheets): append or update
9. Prepare Human Review Data (Edit Fields (Set)): sets 3 fields: reviewStatus, reviewRequestedAt, reviewType
10. Prepare Auto-Action Data (Edit Fields (Set)): sets 3 fields: actionStatus, executedAt, actionType

…plus 8 more steps. See the full node list below.

Services it uses

OpenAI Chat ModelSlackGoogle Sheets

Before you upgrade to n8n 3.0

Nodes used (15)

• Schedule Triggern8n-nodes-base.scheduleTrigger
• Edit Fields (Set)n8n-nodes-base.set
• Coden8n-nodes-base.code
• OpenAI Chat Model@n8n/n8n-nodes-langchain.lmChatOpenAi
• Structured Output Parser@n8n/n8n-nodes-langchain.outputParserStructured
• AI Agent@n8n/n8n-nodes-langchain.agent
• Switchn8n-nodes-base.switch
• Slack Tooln8n-nodes-base.slackTool
• Google Sheets Tooln8n-nodes-base.googleSheetsTool
• Code Tool@n8n/n8n-nodes-langchain.toolCode
• Waitn8n-nodes-base.wait
• Slackn8n-nodes-base.slack
• Send Emailn8n-nodes-base.emailSend
• Mergen8n-nodes-base.merge
• Google Sheetsn8n-nodes-base.googleSheets

From the author

How It Works This workflow automates cybersecurity incident detection and response for security operations centers (SOCs) managing constant threat landscapes. Designed for security analysts, IT operations teams, and CISOs, it solves the challenge of manually…

View the original on n8n.io → Check your own copy