工作流概述
这是一个包含15个节点的复杂工作流，主要用于自动化处理各种任务。
工作流源代码
{
"id": 4,
"name": "Email",
"nodes": [
{
"name": "IMAP Email",
"type": "n8n-nodes-base.emailReadImap",
"position": [
-300,
200
],
"parameters": {
"format": "resolved",
"options": {}
},
"credentials": {
"imap": {
"id": "5",
"name": "IMAP account"
}
},
"typeVersion": 1
},
{
"name": "TheHive",
"type": "n8n-nodes-base.theHive",
"position": [
-20,
200
],
"parameters": {
"tags": "Email",
"type": "Email",
"title": "={{$node[\"IMAP Email\"].binary.attachment_0.fileName}}",
"source": "Outlook",
"sourceRef": "={{$node[\"IMAP Email\"].json[\"messageId\"]}}",
"artifactUi": {
"artifactValues": [
{
"dataType": "file",
"binaryProperty": "attachment_0"
}
]
},
"description": "={{$node[\"IMAP Email\"].binary.attachment_0.fileName}}",
"additionalFields": {}
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1,
"alwaysOutputData": true
},
{
"name": "Create Case",
"type": "n8n-nodes-base.theHive",
"position": [
280,
200
],
"parameters": {
"id": "={{$node[\"TheHive\"].json[\"_id\"]}}",
"operation": "promote",
"additionalFields": {}
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1,
"alwaysOutputData": true
},
{
"name": "Case",
"type": "n8n-nodes-base.theHive",
"position": [
540,
200
],
"parameters": {
"id": "={{$node[\"Create Case\"].json[\"_id\"]}}",
"resource": "case",
"operation": "get"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1,
"alwaysOutputData": true
},
{
"name": "Observable",
"type": "n8n-nodes-base.theHive",
"position": [
1060,
200
],
"parameters": {
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
"options": {},
"resource": "observable",
"returnAll": true
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1,
"alwaysOutputData": true
},
{
"name": "Analyzer Email",
"type": "n8n-nodes-base.theHive",
"position": [
1340,
200
],
"parameters": {
"id": "={{$node[\"Observable\"].json[\"_id\"]}}",
"dataType": "file",
"resource": "observable",
"analyzers": [
"24a64a086a410e1c7d7ace74003c4480::CORTEX"
],
"operation": "executeAnalyzer"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"retryOnFail": true,
"typeVersion": 1,
"alwaysOutputData": true
},
{
"name": "Cortex",
"type": "n8n-nodes-base.cortex",
"position": [
1560,
200
],
"parameters": {
"jobId": "={{$node[\"Analyzer Email\"].json[\"cortexJobId\"]}}",
"resource": "job",
"operation": "report"
},
"credentials": {
"cortexApi": {
"id": "2",
"name": "Cortex account"
}
},
"typeVersion": 1
},
{
"name": "IF",
"type": "n8n-nodes-base.if",
"position": [
-20,
600
],
"parameters": {
"conditions": {
"number": [
{
"value1": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"domain\"].length}}",
"operation": "larger"
},
{
"value1": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"email\"].length}}",
"operation": "larger"
},
{
"value1": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"ip\"].length}}",
"operation": "larger"
}
]
},
"combineOperation": "any"
},
"typeVersion": 1
},
{
"name": "Update Case Domain",
"type": "n8n-nodes-base.theHive",
"position": [
420,
480
],
"parameters": {
"ioc": true,
"data": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"domain\"]}}",
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
"status": "Ok",
"message": "={{$node[\"Cortex\"].json[\"analyzerName\"]}}",
"options": {
"tags": "Domain"
},
"dataType": "domain",
"resource": "observable",
"operation": "create"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1
},
{
"name": "Update Case Email",
"type": "n8n-nodes-base.theHive",
"position": [
420,
620
],
"parameters": {
"ioc": true,
"data": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"email\"]}}",
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
"status": "Ok",
"message": "={{$node[\"Cortex\"].json[\"analyzerName\"]}}",
"options": {
"tags": "Domain"
},
"dataType": "mail",
"resource": "observable",
"operation": "create"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1
},
{
"name": "Update Case Ip",
"type": "n8n-nodes-base.theHive",
"position": [
420,
760
],
"parameters": {
"ioc": true,
"data": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"ip\"]}}",
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
"status": "Ok",
"message": "={{$node[\"Cortex\"].json[\"analyzerName\"]}}",
"options": {
"tags": "Domain"
},
"dataType": "ip",
"resource": "observable",
"operation": "create"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1
},
{
"name": "Wait",
"type": "n8n-nodes-base.wait",
"position": [
800,
200
],
"webhookId": "ecada1d5-a671-44fc-906e-c64c6f05e760",
"parameters": {
"unit": "seconds",
"amount": 5
},
"typeVersion": 1
},
{
"name": "Email Reputation",
"type": "n8n-nodes-base.theHive",
"position": [
640,
620
],
"parameters": {
"id": "={{$node[\"Update Case Email\"].json[\"id\"]}}",
"dataType": "mail",
"resource": "observable",
"analyzers": [
"9902b4e5c58015184b177de13f2151c7::CORTEX"
],
"operation": "executeAnalyzer"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1
},
{
"name": "OTX IP",
"type": "n8n-nodes-base.theHive",
"position": [
640,
760
],
"parameters": {
"id": "={{$node[\"Update Case Ip\"].json[\"id\"]}}",
"dataType": "ip",
"resource": "observable",
"analyzers": [
"b084bf78d1aea92966b6ef6a4f6193a5::CORTEX"
],
"operation": "executeAnalyzer"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1
},
{
"name": "OTX DOMAIN",
"type": "n8n-nodes-base.theHive",
"position": [
640,
480
],
"parameters": {
"id": "={{$node[\"Update Case Domain\"].json[\"id\"]}}",
"dataType": "domain",
"resource": "observable",
"analyzers": [
"b084bf78d1aea92966b6ef6a4f6193a5::CORTEX"
],
"operation": "executeAnalyzer"
},
"credentials": {
"theHiveApi": {
"id": "1",
"name": "The Hive account"
}
},
"typeVersion": 1
}
],
"active": true,
"settings": {},
"connections": {
"IF": {
"main": [
[
{
"node": "Update Case Domain",
"type": "main",
"index": 0
},
{
"node": "Update Case Email",
"type": "main",
"index": 0
},
{
"node": "Update Case Ip",
"type": "main",
"index": 0
}
]
]
},
"Case": {
"main": [
[
{
"node": "Wait",
"type": "main",
"index": 0
}
]
]
},
"Wait": {
"main": [
[
{
"node": "Observable",
"type": "main",
"index": 0
}
]
]
},
"Cortex": {
"main": [
[
{
"node": "IF",
"type": "main",
"index": 0
}
]
]
},
"TheHive": {
"main": [
[
{
"node": "Create Case",
"type": "main",
"index": 0
}
]
]
},
"IMAP Email": {
"main": [
[
{
"node": "TheHive",
"type": "main",
"index": 0
}
]
]
},
"Observable": {
"main": [
[
{
"node": "Analyzer Email",
"type": "main",
"index": 0
}
]
]
},
"Create Case": {
"main": [
[
{
"node": "Case",
"type": "main",
"index": 0
}
]
]
},
"Analyzer Email": {
"main": [
[
{
"node": "Cortex",
"type": "main",
"index": 0
}
]
]
},
"Update Case Ip": {
"main": [
[
{
"node": "OTX IP",
"type": "main",
"index": 0
}
]
]
},
"Update Case Email": {
"main": [
[
{
"node": "Email Reputation",
"type": "main",
"index": 0
}
]
]
},
"Update Case Domain": {
"main": [
[
{
"node": "OTX DOMAIN",
"type": "main",
"index": 0
}
]
]
}
}
}功能特点
- 自动检测新邮件
- AI智能内容分析
- 自定义分类规则
- 批量处理能力
- 详细的处理日志
技术分析
节点类型及作用
- Emailreadimap
- Thehive
- Cortex
- If
- Wait
复杂度评估
配置难度：
维护难度：
扩展性：
实施指南
前置条件
- 有效的Gmail账户
- n8n平台访问权限
- Google API凭证
- AI分类服务订阅
配置步骤
- 在n8n中导入工作流JSON文件
- 配置Gmail节点的认证信息
- 设置AI分类器的API密钥
- 自定义分类规则和标签映射
- 测试工作流执行
- 配置定时触发器（可选）
关键参数
| 参数名称 | 默认值 | 说明 |
|---|---|---|
| maxEmails | 50 | 单次处理的最大邮件数量 |
| confidenceThreshold | 0.8 | 分类置信度阈值 |
| autoLabel | true | 是否自动添加标签 |
最佳实践
优化建议
- 定期更新AI分类模型以提高准确性
- 根据邮件量调整处理批次大小
- 设置合理的分类置信度阈值
- 定期清理过期的分类规则
安全注意事项
- 妥善保管API密钥和认证信息
- 限制工作流的访问权限
- 定期审查处理日志
- 启用双因素认证保护Gmail账户
性能优化
- 使用增量处理减少重复工作
- 缓存频繁访问的数据
- 并行处理多个邮件分类任务
- 监控系统资源使用情况
故障排除
常见问题
邮件未被正确分类
检查AI分类器的置信度阈值设置，适当降低阈值或更新训练数据。
Gmail认证失败
确认Google API凭证有效且具有正确的权限范围，重新进行OAuth授权。
调试技巧
- 启用详细日志记录查看每个步骤的执行情况
- 使用测试邮件验证分类逻辑
- 检查网络连接和API服务状态
- 逐步执行工作流定位问题节点
错误处理
工作流包含以下错误处理机制：
- 网络超时自动重试（最多3次）
- API错误记录和告警
- 处理失败邮件的隔离机制
- 异常情况下的回滚操作