{
  "name": "Security — Detect Phishing & Analyze Threats",
  "nodes": [
    {
      "parameters": {},
      "name": "Start",
      "type": "n8n-nodes-base.manualTrigger",
      "typeVersion": 1,
      "position": [
        240,
        300
      ],
      "id": "9a23a464-4dc0-4abc-985e-b72b6b237c5b"
    },
    {
      "parameters": {
        "resource": "security",
        "method": "security.analyze_threats",
        "params": "{ \"message\": \"Your account will be suspended. Verify here: bit.ly/secure123\", \"brand\": \"mycompany\", \"trustedDomains\": [\"mycompany.com\"] }",
        "product": "mediaapi"
      },
      "name": "Analyze for Phishing",
      "type": "n8n-nodes-mediavox.mediavox",
      "typeVersion": 2,
      "position": [
        480,
        300
      ],
      "credentials": {
        "mediavoxApi": {
          "name": "Mediavox API"
        }
      },
      "notes": "Set brand + trustedDomains to YOUR company. The AI uses them to detect impersonation.",
      "id": "7944835e-418e-40f7-9c12-c5184ef5df4a"
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": ""
          },
          "conditions": [
            {
              "id": "1",
              "leftValue": "={{ $json.data.verdict }}",
              "rightValue": "fraudulent",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ],
          "combinator": "and"
        }
      },
      "name": "Is Fraudulent?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        700,
        300
      ],
      "notes": "Routes by verdict. Possible values: fraudulent, suspicious, legitimate.",
      "id": "31482280-780a-41b4-b317-20d3600d2676"
    },
    {
      "parameters": {
        "channel": "#security-alerts",
        "text": "=:rotating_light: Phishing detected!\nSender: {{ $json.data.sender }}\nVerdict: {{ $json.data.verdict }}\nURLs: {{ $json.data.urls }}"
      },
      "name": "Alert (Slack/Email)",
      "type": "n8n-nodes-base.noOp",
      "typeVersion": 1,
      "position": [
        920,
        200
      ],
      "notes": "Replace with Slack, Email, or Teams node to alert your security team",
      "id": "f662ffe2-5f92-493e-9b3c-f1c8d1bd61a3"
    },
    {
      "parameters": {},
      "name": "Safe - No Action",
      "type": "n8n-nodes-base.noOp",
      "typeVersion": 1,
      "position": [
        920,
        400
      ],
      "notes": "Message is legitimate. Log or pass through.",
      "id": "fa3320bd-44da-402e-bec9-a7ec14156524"
    }
  ],
  "connections": {
    "Analyze for Phishing": {
      "main": [
        [
          {
            "node": "Is Fraudulent?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Is Fraudulent?": {
      "main": [
        [
          {
            "node": "Alert (Slack/Email)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Safe - No Action",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Start": {
      "main": [
        [
          {
            "node": "Analyze for Phishing",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {
    "saveDataSuccessExecution": "all",
    "executionOrder": "v1",
    "binaryMode": "separate"
  },
  "tags": [
    "Security",
    "Phishing",
    "Automation"
  ],
  "pinData": {},
  "active": false,
  "versionId": "6d23a1aa-6828-4257-b5fc-ba61e94f020f",
  "meta": {
    "templateCredsSetupCompleted": true
  }
}