Gmail phishing check by screenshot with one Jira ticket

Gmail phishing check by screenshot with one Jira ticket

An n8n workflow for a reporting inbox. Each new Gmail message is drawn as a screenshot, and a vision model from OpenAI
looks at that picture, together with the message headers, to judge whether it looks like phishing. The workflow then
opens one Jira ticket with the analysis and attaches the screenshot.

How it differs from the verdict workflow

Mindket lists a cousin, Gmail phishing check that files a Jira ticket per verdict. That one sends the HTML text and the
headers to the model, gets a yes or no flag back, and opens either a malicious or a benign ticket. This one shows the
model the picture, writes free text and opens a single kind of ticket with the plain text of the email in its
description. Pick this one to let the model see the email as a person would, and the other for a flag that sorts tickets.

What is inside

• workflow.json: the workflow as n8n exports it, 13 nodes and 5 sticky notes. It holds no credential.
• README.md: these notes.

What we changed from the original copy

• ChatGPT Analysis used chatgpt-4o-latest. OpenAI's deprecations page, read on 12 November 2026, lists it as shut down
  on 17 February 2026. Its listed replacement, gpt-5.1-chat-latest, was shut down on 23 July 2026 and points to
  gpt-5.6-sol. The step now uses gpt-5.6-sol, which takes images.
• The reply cap was 1500 tokens. It is now 4000, because a reasoning model counts its thinking tokens against the same cap
  and could otherwise return no visible answer.
• Create Jira Ticket held the project and issue type ids of its author's own site. They now read
  <YOUR_JIRA_PROJECT_ID> and <YOUR_JIRA_ISSUE_TYPE_ID>.
• Screenshot HTML sent an empty query parameter row. We removed the row.
• The five sticky notes were long and showed pictures hosted on the template site. They are now short notes with no
  pictures.

Before you start

• An n8n instance, on n8n Cloud or your own server.
• A Gmail account that receives the suspicious emails, with a Gmail credential in n8n.
• An HTML/CSS to Image account (hcti.io), which gives you an API ID and an API key.
• An OpenAI API key.
• A Jira Cloud site with a Jira credential in n8n, and the numeric ids of the project and issue type for the tickets.

Set it up

1. In n8n, create a workflow, open its menu, choose Import from File and pick workflow.json.
2. Add a Gmail credential to Gmail Trigger.
3. Create one HTTP Basic Auth credential from your hcti.io API ID (as the user) and API key (as the password). Select it
   in Screenshot HTML and Retrieve Screenshot.
4. Add an OpenAI credential to ChatGPT Analysis.
5. Add a Jira credential to both Jira nodes. In Create Jira Ticket, replace <YOUR_JIRA_PROJECT_ID> and
   <YOUR_JIRA_ISSUE_TYPE_ID> with the ids from your Jira site.
6. Save the workflow, switch it on and send a test email to the Gmail account.

How a run goes

1. Gmail Trigger checks the account every minute with Simplify turned off, so it receives the full message.
   Set Gmail Variables keeps the HTML, the plain text, the headers, the subject and the recipient.
2. Set Email Variables passes those fields on to Screenshot HTML.
3. Screenshot HTML posts the HTML to hcti.io, which draws it as an image. Retrieve Screenshot downloads that image.
4. ChatGPT Analysis sends the image to gpt-5.6-sol with a prompt that adds the headers and asks whether the email could
   be phishing, in Jira's wiki markup. The image goes in as base64 from the data property.
5. Create Jira Ticket opens one ticket. Its summary is the subject with a phishing report label. Its description names
   the recipient, quotes the subject and the plain text, and ends with the analysis from content.
6. Rename Screenshot names the image emailScreenshot.png, and Upload Screenshot of Email to Jira attaches it to the
   ticket.

A Microsoft Outlook Trigger branch sits switched off beside the Gmail one. It fetches headers through the Microsoft
Graph API and feeds the same steps.

Change the look

• What the model looks for, and how it writes: the prompt in ChatGPT Analysis.
• Ticket wording: the summary and description fields of Create Jira Ticket.
• The model and the reply cap: ChatGPT Analysis.
• Outlook instead of Gmail: switch on Microsoft Outlook Trigger and switch off Gmail Trigger. The Outlook branch needs
  its own Microsoft credential.
• Which emails are checked: the filters of Gmail Trigger.

Good to know

• The facts below come from pages and n8n source read on 12 November 2026.
• Gmail Trigger has no filter, so every new email in that account is analyzed and ticketed. Use a mailbox that people
  forward suspicious messages to, or add a label filter.
• The email's HTML goes to hcti.io, and hcti.io's documentation says the returned image address stays valid as long as the
  account is active. A DELETE request to that address removes the image. This workflow never sends one, so every
  screenshot stays on their servers until you delete it.
• The image and the headers also go to OpenAI, and the screenshot and the plain text go to your Jira site. Suspicious mail
  can hold private details, so decide whether you may share them.
• The model sees a picture and the headers, not the links behind the buttons. A link whose text differs from its target
  is invisible to it. The verdict is an opinion and can be wrong.
• There is no yes or no flag. Every email gets a ticket of the same kind, and a person reads the analysis to sort them.
• An email with no HTML part leaves hcti.io nothing to draw, so that run may stop at Screenshot HTML.
• gpt-5.6-sol costs 4 dollars per million input tokens and 20 per million output tokens on OpenAI's page. gpt-5.6-terra
  and gpt-6-luna take images too and cost less, so try them if the price matters.
• Billing: OpenAI bills each analysis, hcti.io has its own plan and limits, and Jira gains a ticket for every email.
• Credentials: the JSON holds none.