n8n Workflow: Alert Slack Security on Real Phishing Reports

Alert your Slack security team the moment Fallax flags a real phishing report—before verdicts are decided

This n8n workflow polls Fallax for newly reported emails with an unknown verdict and immediately posts a clear Slack security alert to your chosen channel—complete with the reporter, subject, report source, and a link to the message.

What this workflow does

• Polls Fallax every minute for newly reported messages where the verdict is set to unknown.
• Creates a Slack message for each new report containing:
  • the reporter
  • the email subject
  • the report source
  • a link to the message
• Posts a visible :rotating_light: style alert into your selected Slack security channel (for example, #security).

Use cases

• Security operations: surface fresh phishing reports from Fallax instantly so your team can triage faster.
• SaaS operators: centralize “unknown verdict” phishing activity in Slack for consistent incident response.
• Automation engineers: monitor email threat intake workflows without manual checking or delayed review.

Technical details

• Fallax integration: uses a read-only API key created in Fallax (Settings → Integrations → n8n) and added as a Fallax API credential in n8n.
• Slack integration: uses a Slack OAuth/token credential in n8n with permission to post messages.
• Nodes / stack: n8n-nodes-fallaxfallax trigger (polling), plus Slack for posting alerts (and a sticky note step for workflow context).
• Configuration: set the target channel name or ID (e.g., #security) in the Slack message step.

Bring Fallax phishing intake and real-time Slack alerts into one automated n8n security workflow.