Notify user in Slack of quarantined email and create Jira ticket if opened
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 10 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Jira Software and Slack. It also calls slack.com over HTTP.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Get message details in Sublime Security (HTTP Request): calls an HTTP API
- has email been opened? (If): checks a condition and branches into true / false
- lookup slack user by email (HTTP Request): calls slack.com
- Yes, prep flaggedRules table (Code): runs custom JavaScript code
- user found? (If): checks a condition and branches into true / false
- Jira Software: uses Jira Software
- Found, notify user (Slack): uses Slack
Services it uses
HTTP calls to: slack.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (7)
- If
n8n-nodes-base.if - Webhook
n8n-nodes-base.webhook - HTTP Request
n8n-nodes-base.httpRequest - Jira Software
n8n-nodes-base.jira - Slack
n8n-nodes-base.slack - No Operation, do nothing
n8n-nodes-base.noOp - Code
n8n-nodes-base.code
From the author
This n8n workflow serves as an incident response and notification system for handling potentially malicious emails flagged by Sublime Security. It begins with a Webhook trigger that Sublime Security uses to initiate the workflow by POSTing an alert. The…