Scan incoming Gmail attachments for threats with VirusTotal and GPT-4o-mini
Email & inbox workflow for n8n with 13 active steps. Starts with Gmail Trigger. Uses OpenAI. Integrations include Gmail, OpenAI, Slack, Google Sheets, Google Drive.
What it does
13 active nodes · Starts with Gmail Trigger.
Steps in the template include:
- Poll Gmail for New Attachments (Gmail Trigger)
- Set Configuration (Edit Fields (Set))
- Extract Attachments from Email (Code)
- Compute SHA256 Hash of Attachment (Code)
Nodes and integrations
- Gmail Trigger
- Edit Fields (Set)
- Code ×3
- HTTP Request
- OpenAI
- Switch
- Gmail
- Slack
- Google Sheets
- Google Drive
- Wait
See the author’s step names
- Poll Gmail for New Attachments (Gmail Trigger)
- Set Configuration (Edit Fields (Set))
- Extract Attachments from Email (Code)
- Compute SHA256 Hash of Attachment (Code)
- Look Up Hash in VirusTotal (HTTP Request)
- Classify Phishing Risk with OpenAI (OpenAI)
- Calculate Combined Risk Level (Code)
- Route by Threat Level (Switch)
- Apply Quarantine Label on Gmail (Gmail) — addLabels
- Send Security Alert to Slack (Slack)
- Log to Review Queue on Google Sheets (Google Sheets) — append
- Save Attachment to Safe Drive Folder (Google Drive)
- Wait 15s for VirusTotal Rate Limit (Wait)
Accounts and credentials
- Gmail
- OpenAI access
- Slack
- Google Sheets
- Google Drive
Check the HTTP request steps for any additional service accounts or API keys.
AI models and swaps
OpenAI · Model or API operation
gpt-4o-mini in Classify Phishing Risk with OpenAI. Provider-specific step. A different provider requires edits and testing.
Inputs and setup options
- Setup field: review_sheet_id
- Setup field: review_sheet_name
- Setup field: security_slack_channel
- Setup field: quarantine_label
- Setup field: safe_drive_folder_id
Resource information
- Credit basis
- Author listed by n8n
- Pricing
- Template access shown on n8n
- License
- Not specified
- Last record update
- Nov 5, 2026