{
  "openruna_format": "flow-graph-v1",
  "title": "Analyze_email_headers_for_IPs_and_spoofing__3",
  "slug": "analyze-email-headers-for-ips-and-spoofing-3",
  "source_filename": "0946_Code_Webhook_Send_Webhook.json",
  "nodes": [
    {
      "id": "Receive Headers",
      "name": "Receive Headers",
      "integration": "webhook",
      "kind": "trigger"
    },
    {
      "id": "Fraud Score",
      "name": "Fraud Score",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "Respond to Webhook",
      "name": "Respond to Webhook",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Explode Email Header",
      "name": "Explode Email Header",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "Split Out IPs",
      "name": "Split Out IPs",
      "integration": "itemLists",
      "kind": "logic"
    },
    {
      "id": "Extract IPs from \"received\"",
      "name": "Extract IPs from \"received\"",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "IP Quality Score",
      "name": "IP Quality Score",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "IP-API",
      "name": "IP-API",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Collect interesting data",
      "name": "Collect interesting data",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "SPF/DKIM/DMARC from \"authentication-results\"",
      "name": "SPF/DKIM/DMARC from \"authentication-results\"",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "SPF from \"received-spf\"",
      "name": "SPF from \"received-spf\"",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "DKIM from \"dkim-signature\"",
      "name": "DKIM from \"dkim-signature\"",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "DMARC from \"received-dmarc\"",
      "name": "DMARC from \"received-dmarc\"",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "DKIM",
      "name": "DKIM",
      "integration": "switch",
      "kind": "logic"
    },
    {
      "id": "Extract Email Header from webhook",
      "name": "Extract Email Header from webhook",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Received Headers Present?",
      "name": "Received Headers Present?",
      "integration": "if",
      "kind": "logic"
    },
    {
      "id": "Authentication Results Present?",
      "name": "Authentication Results Present?",
      "integration": "if",
      "kind": "logic"
    },
    {
      "id": "Aggregate Authentication Data",
      "name": "Aggregate Authentication Data",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "IP Data Merge",
      "name": "IP Data Merge",
      "integration": "merge",
      "kind": "logic"
    },
    {
      "id": "Merge Security Data",
      "name": "Merge Security Data",
      "integration": "merge",
      "kind": "logic"
    },
    {
      "id": "Join IP Analysis into one JSON object",
      "name": "Join IP Analysis into one JSON object",
      "integration": "itemLists",
      "kind": "logic"
    },
    {
      "id": "Join results into one JSON object",
      "name": "Join results into one JSON object",
      "integration": "itemLists",
      "kind": "logic"
    },
    {
      "id": "SPF Authentication Checker",
      "name": "SPF Authentication Checker",
      "integration": "switch",
      "kind": "logic"
    },
    {
      "id": "Set SPF Pass Status",
      "name": "Set SPF Pass Status",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Set SPF Fail Status",
      "name": "Set SPF Fail Status",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Set SPF Neutral Status",
      "name": "Set SPF Neutral Status",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Set SPF UnknownStatus",
      "name": "Set SPF UnknownStatus",
      "integration": "set",
      "kind": "logic"
    }
  ],
  "edges": [
    {
      "from": "IP-API",
      "to": "Fraud Score"
    },
    {
      "from": "Fraud Score",
      "to": "Collect interesting data"
    },
    {
      "from": "IP Data Merge",
      "to": "Join IP Analysis into one JSON object"
    },
    {
      "from": "Split Out IPs",
      "to": "IP Quality Score"
    },
    {
      "from": "Receive Headers",
      "to": "Extract Email Header from webhook"
    },
    {
      "from": "IP Quality Score",
      "to": "IP-API"
    },
    {
      "from": "Merge Security Data",
      "to": "Join results into one JSON object"
    },
    {
      "from": "Set SPF Fail Status",
      "to": "DKIM"
    },
    {
      "from": "Set SPF Pass Status",
      "to": "DKIM"
    },
    {
      "from": "Explode Email Header",
      "to": "Received Headers Present?"
    },
    {
      "from": "Explode Email Header",
      "to": "Authentication Results Present?"
    },
    {
      "from": "Set SPF UnknownStatus",
      "to": "DKIM"
    },
    {
      "from": "Set SPF Neutral Status",
      "to": "DKIM"
    },
    {
      "from": "SPF from \"received-spf\"",
      "to": "DKIM from \"dkim-signature\""
    },
    {
      "from": "Collect interesting data",
      "to": "IP Data Merge"
    },
    {
      "from": "Received Headers Present?",
      "to": "Extract IPs from \"received\""
    },
    {
      "from": "Received Headers Present?",
      "to": "IP Data Merge"
    },
    {
      "from": "DKIM from \"dkim-signature\"",
      "to": "DMARC from \"received-dmarc\""
    },
    {
      "from": "SPF Authentication Checker",
      "to": "Set SPF Pass Status",
      "label": "spf=pass"
    },
    {
      "from": "SPF Authentication Checker",
      "to": "Set SPF Fail Status",
      "label": "spf=fail"
    },
    {
      "from": "SPF Authentication Checker",
      "to": "Set SPF Neutral Status",
      "label": "spf=neutral"
    },
    {
      "from": "SPF Authentication Checker",
      "to": "Set SPF UnknownStatus"
    },
    {
      "from": "DMARC from \"received-dmarc\"",
      "to": "Aggregate Authentication Data"
    },
    {
      "from": "Extract IPs from \"received\"",
      "to": "Split Out IPs"
    },
    {
      "from": "Aggregate Authentication Data",
      "to": "Merge Security Data"
    },
    {
      "from": "Authentication Results Present?",
      "to": "SPF/DKIM/DMARC from \"authentication-results\""
    },
    {
      "from": "Authentication Results Present?",
      "to": "SPF Authentication Checker"
    },
    {
      "from": "Authentication Results Present?",
      "to": "SPF from \"received-spf\""
    },
    {
      "from": "Extract Email Header from webhook",
      "to": "Explode Email Header"
    },
    {
      "from": "Join results into one JSON object",
      "to": "Respond to Webhook"
    },
    {
      "from": "Join IP Analysis into one JSON object",
      "to": "Merge Security Data"
    },
    {
      "from": "SPF/DKIM/DMARC from \"authentication-results\"",
      "to": "Merge Security Data"
    }
  ]
}