Gmail phishing check that files a Jira ticket per verdict

What it is

This n8n workflow checks suspicious emails for phishing and files a Jira ticket for each one. It watches a Gmail account, draws a screenshot of every new message and asks ChatGPT to read the HTML and the headers. A ticket is opened as potentially malicious or potentially benign, with the analysis inside. The screenshot and the plain text of the email are attached. Nineteen nodes run it, beside six sticky notes.

Who it suits

IT and security teams that keep a mailbox where staff forward suspicious emails, and managed service providers who triage such reports for clients. It saves the first read of each report. It also leaves a record in Jira. It is a first filter. Skip it if you need a verdict that you can trust without a person, because a model’s opinion can be wrong. Its cousin, Gmail phishing check by screenshot with one Jira ticket, sends the picture itself to a vision model and opens a single ticket.

You need Gmail, hcti.io, OpenAI and Jira accounts, plus the ids of one Jira project and one issue type.

Where to use it

Any n8n that can reach Gmail, hcti.io, OpenAI and Jira will run it, as long as the workflow stays switched on, because the Gmail trigger asks for new mail every minute.

• n8n Cloud: bring in the file, connect your accounts and switch it on
• Your own n8n server: the same file, running all the time
• A local install: it works only while n8n and the computer are on
• Outlook: a switched off branch reads Outlook instead of Gmail once you switch it on and add a Microsoft credential

Setup

Download saves a zip with workflow.json and Mindket’s setup notes in your downloads folder. Import the file, add the credentials, put in your Jira ids and switch the workflow on.

1. In n8n, create a workflow, open its menu, choose Import from File and pick workflow.json.
2. Add a Gmail credential to Gmail Trigger.
3. Create one HTTP Basic Auth credential from your hcti.io API ID (as the user) and API key (as the password). Select it in Screenshot HTML and Retrieve Screenshot.
4. Add an OpenAI credential to Analyze Email with ChatGPT.
5. OpenAI retires gpt-4o on 14 January 2027, so pick gpt-6-luna in Analyze Email with ChatGPT when you set this up after that date, or earlier if you like.
6. Add a Jira credential to the four Jira nodes. In both ticket nodes, replace <YOUR_JIRA_PROJECT_ID> and <YOUR_JIRA_ISSUE_TYPE_ID> with the ids from your Jira site.
7. Save the workflow, switch it on and send a test email to the Gmail account.

How to use it

Forward a suspicious email to the Gmail account, or let people send it there. After the next check of Gmail, a Jira ticket appears with the analysis and two attachments. Read the verdict. Open the screenshot. Decide what to do.

Example

A finance assistant gets an email that says her bank account is locked, with a button to confirm her password. She forwards it to the security mailbox.

The workflow draws a screenshot and asks ChatGPT. The analysis says the sender’s domain does not match the bank and the button leads somewhere else. A Jira ticket marked Potentially Malicious appears. An administrator opens it, sees the picture of the email next to the analysis and blocks the sender. The ticket stays as the record.

For newcomers and experts

If you are new. n8n draws a workflow as boxes joined by lines, and each box, a node, does one job. Phishing is an email that tries to trick you. It wants a password or money. Jira is a tool where teams track their work as tickets. A screenshot service turns HTML into a picture, so you see the email as a reader would.

For experts. The screenshot goes into Jira but not into the model, which reads the HTML and the headers as text.

Good to know

It checks every email in that Gmail account, and it sends private mail to three outside services.

• Scope: Gmail Trigger has no filter, so every new email in that account is analyzed and ticketed. Use a mailbox that people forward suspicious messages to, or add a label filter
• Screenshots: the email’s HTML goes to hcti.io, whose documentation says the returned image address stays valid as long as the account is active. A DELETE request to that address removes the image. This workflow never sends one, so every screenshot stays on their servers until you delete it
• Other copies: the HTML and the headers also go to OpenAI. The picture and the plain text go to your Jira site as attachments. Suspicious mail can hold private details, so decide whether you may share them
• Verdict: it is a model’s opinion. A benign ticket does not prove an email is safe, and a malicious one can be wrong
• Type: Check if Malicious tests a real boolean, so a model answer of the word true in quotes fails the strict test
• No HTML: an email with no HTML part leaves hcti.io nothing to draw, so that run may stop at Screenshot HTML
• Repairs: the original copy held its author’s Jira ids and an empty query row, and its sticky notes showed pictures from a template site. Mindket’s copy has placeholders, no empty row and short notes
• Model: gpt-4o is the model. OpenAI’s deprecations page, read on 12 November 2026, gives 14 January 2027 as its shutdown date, with gpt-6-luna as the replacement. This step has no tools, so gpt-6-luna fits
• Billing: OpenAI bills each analysis, hcti.io has its own plan and limits, and Jira gains a ticket for every email
• Credentials: the JSON holds none