Phishing Simulation and Security Awareness Logging - n8n Workflow

Security Operations Center (SOC) teams running red team or security awareness exercises.
IT managers responsible for tracking employee security training progress.
Automation specialists looking for advanced n8n templates involving flow control and external data logging.
Users who need reliable data sourcing and logging using a Google Sheets n8n node.

This advanced n8n workflow, labeled as a 'RedOps Module 5,' is designed for security professionals needing an automated way to simulate credential harvesting or phishing traps against a target list. Instead of requiring manual setup for each simulation event, this n8n template uses Google Sheets as the central database for both target lists and simulation logs. The core value of this n8n workflow is providing a safe, controlled environment to test security posture and employee responsiveness, leveraging the power of an n8n node structure for consistent logging and reporting. This allows security teams to efficiently run recurring simulations and gather auditable data without complex infrastructure, making the overall operation smoother and more reliable.

This powerful n8n workflow executes a streamlined six-step process to manage security simulations and log results:

1. Initiation: The process initiates via a Manual n8n trigger, labeled ⚡ Trigger TrapSim, allowing the user to start the simulation campaign on demand.


2. Target Acquisition: The 📄 Get Trap Targets n8n node connects directly to a configured Google Sheet to retrieve the dynamic list of users or target emails for the simulation campaign.


3. Flow Control: The 🧹 Filter Valid Targets n8n node (an IF node) processes the retrieved list, ensuring that only actively selected or valid targets proceed to the next stage of the n8n workflow, maintaining list hygiene.


4. Data Generation: The 🎯 Generate Trap Link n8n node prepares the unique simulation data, such as a dummy tracking URL or identifier, which represents the simulated malicious link click.


5. Event Simulation: The 🪤 Simulate Credential Submission n8n node finalizes the data package, adding time stamps and simulation specifics, mimicking the victim's interaction and preparing the log entry.


6. Logging: Finally, the 📄 Append Trap Log n8n node writes all collected simulation data (target, tracking ID, time, result) back to a designated Google Sheets log, completing the n8n workflow cycle and providing instant, verifiable reporting capabilities.

To deploy this n8n workflow, follow these steps:

1. Import: Copy the provided JSON code and paste it into your n8n instance using the 'New' menu > 'Import from JSON'.


2. Google Sheets Setup: You will need two primary Google Sheets: one containing the list of targets and one for logging the results.


3. Credential Setup: Configure the necessary Google Sheets credentials for the 📄 Get Trap Targets and 📄 Append Trap Log n8n node instances. Ensure the n8n instance has read/write access to your designated sheets.


4. Node Configuration: Adjust the spreadsheet IDs and sheet names within both Google Sheets n8n node parameters to match your setup.


5. Filter Logic: Review the conditional logic in the 🧹 Filter Valid Targets n8n node to ensure it correctly identifies active targets based on the column headers in your input sheet.


6. Activation: Save the n8n workflow. It is designed to run using the Manual n8n trigger, so click 'Execute Workflow' to start the simulation run.

Manual Trigger (⚡ Trigger TrapSim)
Function: Acts as the starting point, manually activating the n8n workflow execution. It is the primary n8n trigger for this simulation module.
Key Configuration: Simple manual execution.
Google Sheets (📄 Get Trap Targets)
Function: Retrieves the list of simulation targets (e.g., employee emails and their current status) from a specified Google Sheet.
Key Configuration: Action is typically set to 'Get Many' or 'Get All Rows'.
IF (🧹 Filter Valid Targets)
Function: Controls the data flow, ensuring only targets meeting specific criteria (e.g., marked 'Active' for simulation) continue down the successful path of the n8n workflow.
Key Configuration: Uses conditional expressions based on input sheet data.
Set (🎯 Generate Trap Link)
Function: Dynamically generates necessary data points like unique simulation IDs or simulated trap links for tracking purposes.
Key Configuration: Adds custom fields containing tracking information.
Set (🪤 Simulate Credential Submission)
Function: Prepares the final log payload, simulating the details of a user interaction (like time and outcome) before logging.
Key Configuration: Creates final data fields like 'simulated outcome' and 'timestamp'.
Google Sheets (📄 Append Trap Log)
Function: Logs the detailed results of the simulated interaction back into a designated Google Sheet for audit and analysis.
Key Configuration: Action is set to 'Append Row' or a similar write operation to ensure continuous logging.