Daily Security Log Briefing with OpenAI + WhatsApp & Email

Get a daily security risk briefing—automatically—sent to you on WhatsApp and by email

This n8n workflow pulls the last 24 hours of security logs from your SIEM/log aggregator, uses OpenAI to generate a clear executive risk briefing, and delivers a short WhatsApp summary plus a detailed HTML email report. If an escalation is needed, it pauses for a security lead acknowledgment before continuing.

What this workflow does

• Schedules daily runs (or supports manual testing).
• Queries your SIEM/log aggregator API for events from the configured systems covering the previous 24 hours.
• Normalizes and deduplicates mixed log formats, categorizes events, scores severity, collapses near-duplicates, and keeps only the most notable items.
• Uses OpenAI to produce a JSON briefing including an executive summary, findings, recommended actions, overall risk level, and an escalationRequired flag.
• Generates two outputs: a concise WhatsApp message and a detailed HTML email report (with category and top-IP breakdowns).
• Escalation gating: when escalationRequired is true, it waits for security lead acknowledgment before sending/continuing.
• Sends the briefing via WhatsApp Business Cloud API (WhatsApp) and SMTP (email).

Use cases

• SaaS security teams who want an automated daily security log briefing without manual triage.
• Automation engineers building an n8n-based SIEM-to-alert reporting flow with OpenAI summarization.
• Operators who need escalation control to ensure high-risk events get acknowledged before action.

Technical details

• Nodes/logic: if, set, code, wait, WhatsApp, email send
• SIEM/log aggregator integration: HTTP Header Auth; configure logAggregatorApiUrl and query parameters for your platform
• OpenAI integration: Chat Model to generate the JSON briefing and the escalationRequired flag
• Messaging: WhatsApp Business Cloud API (phone number ID + recipient phone number)
• Email delivery: SMTP with a detailed HTML report