{"name": "Security Incident Response Bot", "nodes": [{"id": "n1", "name": "Incident Alert Webhook", "type": "n8n-nodes-base.webhook", "typeVersion": 2.1, "position": [0, 0], "parameters": {"httpMethod": "POST", "path": "security-incident", "responseMode": "responseNode"}}, {"id": "n2", "name": "Analyze & Respond to Incident", "type": "n8n-nodes-base.httpRequest", "typeVersion": 4.4, "position": [224, 0], "parameters": {"method": "POST", "url": "https://api.anthropic.com/v1/messages", "sendHeaders": true, "headerParameters": {"parameters": [{"name": "x-api-key", "value": "YOUR_ANTHROPIC_API_KEY"}, {"name": "anthropic-version", "value": "2023-06-01"}, {"name": "content-type", "value": "application/json"}]}, "sendBody": true, "bodyParameters": {"parameters": [{"name": "model", "value": "claude-sonnet-4-6"}, {"name": "max_tokens", "value": "800"}, {"name": "messages", "value": "=[{\"role\":\"user\",\"content\":\"Return ONLY JSON {severity:'critical/high/medium/low', incident_type:string, immediate_actions:string[], containment_steps:string[], notify_team:string[], estimated_impact:string, post_incident_review:string[]}. Incident details: {{ JSON.stringify($json.body) }}\"}]"}]}}}, {"id": "n3", "name": "Alert Security Team", "type": "n8n-nodes-base.gmail", "typeVersion": 2.2, "position": [448, 0], "parameters": {"resource": "message", "operation": "send", "sendTo": "YOUR_SECURITY_TEAM@company.com", "subject": "=[SECURITY INCIDENT] {{ JSON.parse($json.content[0].text).severity.toUpperCase() }}: {{ $json.body.title }}", "emailType": "html", "message": "={{ JSON.parse($json.content[0].text).immediate_actions.join('<br>') }}", "options": {}}, "credentials": {"gmailOAuth2": {"id": "YOUR_GMAIL_CREDENTIAL_ID", "name": "Gmail account"}}}, {"id": "n4", "name": "Respond", "type": "n8n-nodes-base.respondToWebhook", "typeVersion": 1.1, "position": [672, 0], "parameters": {"respondWith": "json", "responseBody": "={\"ok\":true,\"result\":\"{{ $json.content[0].text }}\"}"}}], "connections": {"Incident Alert Webhook": {"main": [[{"node": "Analyze & Respond to Incident", "type": "main", "index": 0}]]}, "Analyze & Respond to Incident": {"main": [[{"node": "Alert Security Team", "type": "main", "index": 0}]]}, "Alert Security Team": {"main": [[{"node": "Respond", "type": "main", "index": 0}]]}}, "settings": {"executionOrder": "v1"}}