Analyze Email Headers for IP Reputation and Spoofing Detection - Outlook

This n8n workflow automates the process of analyzing email headers for potential IP reputation and email spoofing indicators. It's designed to be triggered by new emails received in Microsoft Outlook, extract relevant header information, and then perform a lookup using an external API to assess the sender's IP reputation.

What it does

1. Triggers on New Outlook Emails: Listens for new email messages in a configured Microsoft Outlook mailbox.
2. Extracts Email Headers: Automatically pulls the full email headers from the incoming email.
3. Prepares Data for API Call: Uses a Code node to parse the raw headers, extract the Received header, and identify the originating IP address. It also prepares the API request body.
4. Checks IP Reputation: Sends an HTTP request to an external API (e.g., AbuseIPDB, IPQualityScore, etc., though the specific API is not defined in the JSON, it's a generic HTTP Request node) to query the reputation of the extracted IP address.
5. Processes API Response: Aggregates the API response.
6. Conditional Logic for Analysis: Uses an If node to check if the API call was successful and if the IP address was found.
7. Handles Successful IP Lookup: If the IP lookup is successful, it continues to process the results.
8. Handles Failed IP Lookup: If the IP lookup fails or the IP is not found, it handles this scenario (e.g., by doing nothing further, as shown by the "No Operation" node).
9. Responds to Webhook (Optional): Can be configured to respond to the initial webhook trigger, providing feedback on the analysis.
10. Limits Output (Optional): A "Limit" node is present, suggesting that the workflow might be designed to process a limited number of items or to ensure a single item output.

Prerequisites/Requirements

• n8n Instance: A running n8n instance.
• Microsoft Outlook Account: An Outlook account configured as a credential in n8n.
• External IP Reputation API: Access to an external API for IP reputation checking (e.g., AbuseIPDB, IPQualityScore). You will need an API key and the API endpoint URL.
• n8n Credentials for the API: Credentials configured in n8n for the chosen IP reputation API, if required (e.g., API Key).

Setup/Usage

1. Import the Workflow: Import the provided JSON into your n8n instance.
2. Configure Microsoft Outlook Trigger:
   • Select your Microsoft Outlook credential or create a new one.
   • Specify the mailbox to monitor for new emails.
3. Configure HTTP Request Node (IP Reputation API):
   • Edit the "HTTP Request" node (ID: 19).
   • Set the URL to your chosen IP reputation API endpoint.
   • Configure the Method (likely GET or POST).
   • Add any required Headers (e.g., x-api-key) and Query Parameters or Body data, using expressions to pass the extracted IP address from the previous "Code" node.
   • Select or create credentials for your API if it requires authentication.
4. Review Code Node: The "Code" node (ID: 834) is crucial for parsing email headers. Ensure the JavaScript logic correctly extracts the Received header and the IP address relevant to your needs. You might need to adjust it based on the specific format of headers you receive.
5. Activate the Workflow: Once configured, activate the workflow to start monitoring your Outlook mailbox for new emails.