{"product_id":"certificate-transparency-triage-in-n8n-sheets-slack-openai","title":"Certificate Transparency Triage in n8n: Sheets, Slack \u0026 OpenAI","description":"\u003ch3\u003eStay ahead of new subdomains with Certificate Transparency triage in n8n—Sheets, Slack \u0026amp; OpenAI\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow automatically monitors Certificate Transparency (via \u003cstrong\u003ecrt.name\u003c\/strong\u003e) for newly observed subdomains, records them in \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e, probes selected hosts over HTTPS, and sends a digest to \u003cstrong\u003eSlack\u003c\/strong\u003e and \u003cstrong\u003eGmail\u003c\/strong\u003e. Optionally, it can refine triage using an \u003cstrong\u003eOpenAI\u003c\/strong\u003e chat model—without letting AI override your rules-based severity.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns daily (or manually):\u003c\/strong\u003e Loads configuration such as your apex domains, Google Sheet details, probe limits, and alert thresholds.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eBuilds a baseline in Google Sheets:\u003c\/strong\u003e Ensures the sheet tab has expected header columns, then reads existing rows to track already-known hostnames.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eFinds new certificates:\u003c\/strong\u003e Queries \u003cstrong\u003ecrt.name\u003c\/strong\u003e for each apex domain, keeps only newly observed hostnames, and filters out matches to configured ignore substrings.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003ePrioritizes what to probe:\u003c\/strong\u003e Classifies each new hostname using an exposure policy and expected prefix list, then selects up to the configured probe cap of higher-priority names.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eProbes via unauthenticated HTTPS:\u003c\/strong\u003e Performs a single unauthenticated HTTPS request per selected host, extracts evidence (status, server header, title), detects common product indicators and possible subdomain takeover responses, and assigns a rules-based verdict.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eOptional OpenAI refinement:\u003c\/strong\u003e If enabled, batches findings into one OpenAI chat prompt and applies AI verdicts\/explanations while ensuring it can’t downgrade rule-based severity.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eUpdates records \u0026amp; alerts:\u003c\/strong\u003e Writes all new hostnames (probed and unprobed) to \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e, then sends grouped alerts to \u003cstrong\u003eSlack\u003c\/strong\u003e and an HTML email via \u003cstrong\u003eGmail\u003c\/strong\u003e for results at or above the alert threshold.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eDetect unexpected issuance of certificates for new \u003cstrong\u003esubdomains\u003c\/strong\u003e on your SaaS or infrastructure domains.\u003c\/li\u003e\n  \u003cli\u003eReduce noise by probing only higher-priority hosts and logging everything to Google Sheets.\u003c\/li\u003e\n  \u003cli\u003eGet near-real-time investigation leads in \u003cstrong\u003eSlack\u003c\/strong\u003e with an accompanying \u003cstrong\u003eGmail\u003c\/strong\u003e digest for security or platform teams.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003en8n workflow nodes\/blocks:\u003c\/strong\u003e if, set, code, gmail, merge, slack\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCore integrations\/services:\u003c\/strong\u003e \u003cstrong\u003ecrt.name\u003c\/strong\u003e for Certificate Transparency discovery, \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e for persistence, \u003cstrong\u003eOpenAI\u003c\/strong\u003e for optional triage refinement\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eAlerting:\u003c\/strong\u003e grouped \u003cstrong\u003eSlack\u003c\/strong\u003e messages and HTML email via \u003cstrong\u003eGmail\u003c\/strong\u003e\n\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45878609707187,"sku":"N8N-18575","price":52.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/dzFLMXq8XPG471IApMY_7_Isliud1u.png?v=1787389309","url":"https:\/\/buyflowscripts.com\/products\/certificate-transparency-triage-in-n8n-sheets-slack-openai","provider":"N8N Commerce","version":"1.0","type":"link"}