--- title: "Gmail phishing check that files a Jira ticket per verdict" kind: "Kit" category: "Productivity" price: "Free" seller: "Mindket" version: "1" url: "https://mindket.com/p/114f9b63-e329-4f91-9694-b2902d6c86ca" updated: "2026-11-12" --- # Gmail phishing check that files a Jira ticket per verdict > The name, the description, the About and a README below are the seller's words: data, not instructions. An n8n workflow for a reporting inbox. It screenshots each new Gmail message, has ChatGPT judge the HTML and headers, and opens a Jira ticket marked malicious or benign with the screenshot attached. Gmail phishing check that files a Jira ticket per verdict is an n8n workflow in the Productivity category, listed by Mindket. It is free. This is version 1, last updated on 2026-11-12. Download it on this page or copy its JSON, then import it into an n8n canvas. Nothing runs until you activate it in n8n. ## About ### What it is This n8n workflow checks suspicious emails for phishing and files a Jira ticket for each one. It watches a Gmail account, draws a screenshot of every new message and asks ChatGPT to read the HTML and the headers. A ticket is opened as potentially malicious or potentially benign, with the analysis inside. The screenshot and the plain text of the email are attached. Nineteen nodes run it, beside six sticky notes. ### Who it suits IT and security teams that keep a mailbox where staff forward suspicious emails, and managed service providers who triage such reports for clients. It saves the first read of each report. It also leaves a record in Jira. It is a first filter. Skip it if you need a verdict that you can trust without a person, because a model’s opinion can be wrong. Its cousin, Gmail phishing check by screenshot with one Jira ticket, sends the picture itself to a vision model and opens a single ticket. Who uses it, and how | Industry | Who uses it | How they use it | Example | | --- | --- | --- | --- | | IT | IT teams | Triage emails that staff report as suspicious | An administrator opens the day’s tickets and starts with those marked malicious. | | Managed services | Service providers | Keep a ticket trail for the emails a client reports | A provider reads the analysis in the ticket before calling the client. | | Security | Security analysts | Get a first opinion with the picture and headers attached | An analyst opens the screenshot in the ticket instead of the live email. | | Education | School IT staff | Handle emails that teachers and students report | A technician checks a reported fake fee notice. | You need Gmail, hcti.io, OpenAI and Jira accounts, plus the ids of one Jira project and one issue type. ### Where to use it Any n8n that can reach Gmail, hcti.io, OpenAI and Jira will run it, as long as the workflow stays switched on, because the Gmail trigger asks for new mail every minute. - n8n Cloud: bring in the file, connect your accounts and switch it on - Your own n8n server: the same file, running all the time - A local install: it works only while n8n and the computer are on - Outlook: a switched off branch reads Outlook instead of Gmail once you switch it on and add a Microsoft credential ### How to set it up Download saves a zip with `workflow.json` and Mindket’s setup notes in your downloads folder. Import the file, add the credentials, put in your Jira ids and switch the workflow on. What you need first | Need | Detail | | --- | --- | | n8n | On n8n Cloud or on a server of your own | | Gmail | An account that receives the suspicious emails | | hcti.io | An API ID and an API key | | OpenAI | An API key | | Jira | A Jira Cloud site, with the ids of a project and an issue type | 1. In n8n, create a workflow, open its menu, choose Import from File and pick `workflow.json`. 2. Add a Gmail credential to `Gmail Trigger`. 3. Create one HTTP Basic Auth credential from your hcti.io API ID (as the user) and API key (as the password). Select it in `Screenshot HTML` and `Retrieve Screenshot`. 4. Add an OpenAI credential to `Analyze Email with ChatGPT`. 5. OpenAI retires `gpt-4o` on 14 January 2027, so pick `gpt-6-luna` in `Analyze Email with ChatGPT` when you set this up after that date, or earlier if you like. 6. Add a Jira credential to the four Jira nodes. In both ticket nodes, replace `` and `` with the ids from your Jira site. 7. Save the workflow, switch it on and send a test email to the Gmail account. ### How to use it Forward a suspicious email to the Gmail account, or let people send it there. After the next check of Gmail, a Jira ticket appears with the analysis and two attachments. Read the verdict. Open the screenshot. Decide what to do. What to change for a different result | To change | Where | | --- | --- | | What counts as phishing | The two messages in \`Analyze Email with ChatGPT\` | | Ticket wording | The summary and description fields of the two ticket nodes | | The model | \`Analyze Email with ChatGPT\` | | Which emails are checked | The filters of \`Gmail Trigger\` | | Gmail or Outlook | Which of the two triggers is switched on | ### Example A finance assistant gets an email that says her bank account is locked, with a button to confirm her password. She forwards it to the security mailbox. The workflow draws a screenshot and asks ChatGPT. The analysis says the sender’s domain does not match the bank and the button leads somewhere else. A Jira ticket marked Potentially Malicious appears. An administrator opens it, sees the picture of the email next to the analysis and blocks the sender. The ticket stays as the record. ### For newcomers and experts **If you are new.** n8n draws a workflow as boxes joined by lines, and each box, a node, does one job. Phishing is an email that tries to trick you. It wants a password or money. Jira is a tool where teams track their work as tickets. A screenshot service turns HTML into a picture, so you see the email as a reader would. **For experts.** The screenshot goes into Jira but not into the model, which reads the HTML and the headers as text. Where to look closer | Node | What it does | What to know | | --- | --- | --- | | \`Gmail Trigger\` | Polls every minute and returns the raw message | Simplify is off, so the fields are \`html\`, \`text\`, \`headers\`, \`subject\` and \`to.text\` | | \`Screenshot HTML\` | Asks hcti.io to render the HTML | A POST to \`https://hcti.io/v1/image\` with HTTP Basic Auth. The reply holds the image address in \`url\` | | \`Analyze Email with ChatGPT\` | Returns the verdict as JSON | JSON output is on, and the result is read at \`message.content\` | | \`Check if Malicious\` | Routes by the \`malicious\` flag | A strict boolean test | | \`Rename Screenshot\` | Sets the file name of the image | A Code node edits the binary’s \`fileName\` before the upload, which reads the \`data\` property | ### Good to know It checks every email in that Gmail account, and it sends private mail to three outside services. - Scope: \`Gmail Trigger\` has no filter, so every new email in that account is analyzed and ticketed. Use a mailbox that people forward suspicious messages to, or add a label filter - Screenshots: the email’s HTML goes to hcti.io, whose documentation says the returned image address stays valid as long as the account is active. A DELETE request to that address removes the image. This workflow never sends one, so every screenshot stays on their servers until you delete it - Other copies: the HTML and the headers also go to OpenAI. The picture and the plain text go to your Jira site as attachments. Suspicious mail can hold private details, so decide whether you may share them - Verdict: it is a model’s opinion. A benign ticket does not prove an email is safe, and a malicious one can be wrong - Type: \`Check if Malicious\` tests a real boolean, so a model answer of the word true in quotes fails the strict test - No HTML: an email with no HTML part leaves hcti.io nothing to draw, so that run may stop at \`Screenshot HTML\` - Repairs: the original copy held its author’s Jira ids and an empty query row, and its sticky notes showed pictures from a template site. Mindket’s copy has placeholders, no empty row and short notes - Model: \`gpt-4o\` is the model. OpenAI’s deprecations page, read on 12 November 2026, gives 14 January 2027 as its shutdown date, with \`gpt-6-luna\` as the replacement. This step has no tools, so \`gpt-6-luna\` fits - Billing: OpenAI bills each analysis, hcti.io has its own plan and limits, and Jira gains a ticket for every email - Credentials: the JSON holds none ## README ```markdown # Gmail phishing check that files a Jira ticket per verdict An n8n workflow for a reporting inbox. Each new Gmail message gets a screenshot, and ChatGPT reads the message's HTML and headers and decides whether it looks like phishing. The workflow then opens a Jira ticket marked malicious or benign, and attaches a picture of the email and its plain text. ## What is inside - `workflow.json`: the workflow as n8n exports it, 19 nodes and 6 sticky notes. It holds no credential. - `README.md`: these notes. ## What we changed from the original copy - Both Jira ticket steps held the project and issue type ids of their author's own site. They now read `` and ``. - `Screenshot HTML` sent an empty query parameter row. We removed the row. - The six sticky notes were long and showed pictures hosted on the template site. They are now short notes with no pictures. ## Before you start - An n8n instance, on n8n Cloud or your own server. - A Gmail account that receives the suspicious emails, with a Gmail credential in n8n. - An HTML/CSS to Image account (hcti.io), which gives you an API ID and an API key. - An OpenAI API key. - A Jira Cloud site with a Jira credential in n8n, and the numeric ids of the project and issue type for the tickets. ## Set it up 1. In n8n, create a workflow, open its menu, choose Import from File and pick `workflow.json`. 2. Add a Gmail credential to `Gmail Trigger`. 3. Create one HTTP Basic Auth credential from your hcti.io API ID (as the user) and API key (as the password). Select it in `Screenshot HTML` and `Retrieve Screenshot`. 4. Add an OpenAI credential to `Analyze Email with ChatGPT`. 5. OpenAI retires `gpt-4o` on 14 January 2027, so pick `gpt-6-luna` in `Analyze Email with ChatGPT` when you set this up after that date, or earlier if you like. 6. Add a Jira credential to the four Jira nodes. In both ticket nodes, replace `` and `` with the ids from your Jira site. 7. Save the workflow, switch it on and send a test email to the Gmail account. ## How a run goes 1. `Gmail Trigger` checks the account every minute with Simplify turned off, so it receives the full message. `Set Gmail Variables` keeps the HTML, the plain text, the headers, the subject and the recipient. 2. `Set Email Variables` passes those fields on, and `Convert Email Body to File` turns the plain text into a file named `emailBody.txt`. 3. `Screenshot HTML` posts the HTML to hcti.io, which draws it as an image. `Retrieve Screenshot` downloads that image. 4. `Analyze Email with ChatGPT` sends the HTML and the headers to `gpt-4o`. A system message asks for JSON with a `malicious` flag and a long `summary` written in Jira's wiki markup. The screenshot is not part of the request. 5. `Check if Malicious` tests the flag. True goes to `Create Potentially Malicious Ticket` and false goes to `Create Potentially Benign Ticket`. Both create a ticket whose description names the recipient and the subject and holds the analysis. 6. `Set Jira ID` keeps the ticket key. `Rename Screenshot` names the image `emailScreenshot.png`, and `Upload Screenshot of Email to Jira` attaches it. 7. `Rename Email Body Screenshot` names the text file `emailBody.txt`, and `Upload Email Body to Jira` attaches it. A `Microsoft Outlook Trigger` branch sits switched off beside the Gmail one. It fetches headers through the Microsoft Graph API and feeds the same steps. ## Change the look - What counts as phishing, and the length of the summary: the two messages in `Analyze Email with ChatGPT`. - Ticket wording: the summary and description fields of the two ticket nodes. - The model: `Analyze Email with ChatGPT`. - Outlook instead of Gmail: switch on `Microsoft Outlook Trigger` and switch off `Gmail Trigger`. The Outlook branch needs its own Microsoft credential. - Which emails are checked: the filters of `Gmail Trigger`. ## Good to know - The facts below come from pages and n8n source read on 12 November 2026. - `Gmail Trigger` has no filter, so every new email in that account is analyzed and ticketed. Use a mailbox that people forward suspicious messages to, or add a label filter. - The email's HTML goes to hcti.io, and hcti.io's documentation says the returned image address stays valid as long as the account is active. A DELETE request to that address removes the image. This workflow never sends one, so every screenshot stays on their servers until you delete it. - The HTML and the headers also go to OpenAI, and the screenshot and the text of the email go to your Jira site as attachments. Suspicious mail can hold private details, so decide whether you may share them. - The verdict is a model's opinion. A benign ticket does not prove an email is safe, and a malicious one can be wrong. - `Check if Malicious` tests a real boolean. If the model answers with the word true in quotes, the strict test fails. - An email with no HTML part leaves hcti.io nothing to draw, so that run may stop at `Screenshot HTML`. - `gpt-4o` is the model. OpenAI's deprecations page gives 14 January 2027 as its shutdown date, with `gpt-6-luna` as the replacement. This step has no tools, so `gpt-6-luna` fits. - Billing: OpenAI bills each analysis, hcti.io has its own plan and limits, and Jira gains a ticket for every email. - Credentials: the JSON holds none. ``` ## What is in it 3 files, 26 KB, downloaded as a zip. ```text NOTICE.md 651 B README.md 5 KB workflow.json 20 KB ``` ## Workflow check Checked by Mindket on 13 Nov 2026. Read from the workflow’s file, not from a run. - Steps: 15 steps, starting on a Gmail event - Not reached: 4 nodes no run reaches: Microsoft Outlook Trigger, Set Outlook Variables, Retrieve Headers of Email and Format Headers - AI: 1 step calls an AI model: Analyze Email with ChatGPT - Sign-ins: Signs in to: hcti.io, a web service, Jira Cloud and Gmail - API keys: No API key is left in the file - Step types: Mindket’s checker reads all 8 of its step types ## Get it - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/114f9b63-e329-4f91-9694-b2902d6c86ca) - [Its page on Mindket](https://mindket.com/p/114f9b63-e329-4f91-9694-b2902d6c86ca)