Summarize daily security logs with OpenAI and send briefings via WhatsApp and email

Description

Quick Overview
This workflow pulls the last 24 hours of aggregated security logs from a SIEM API, normalizes and deduplicates events, uses OpenAI to generate a daily risk briefing with optional escalation gating, and sends a short summary via WhatsApp and a detailed HTML report via email.

How it works
Runs every morning on a schedule (or manually for testing).
Queries your SIEM/log aggregator API for events from the configured systems over the last 24 hours.
Normalizes mixed log formats, categorizes events, collapses near-duplicates, scores severity, and trims to the most notable events.
Uses OpenAI to produce a JSON briefing with an executive summary, findings, recommended actions, overall risk level, and an escalationRequired flag.
Builds two outputs from the AI result: a short WhatsApp message and a detailed HTML email with category and top-IP breakdowns.
If escalation is required, waits for a security lead acknowledgment before proceeding.
Sends the daily briefing to the configured recipient via WhatsApp Business Cloud API and via SMTP email.

Setup
Provide an HTTP Header Auth credential for your SIEM/log aggregator API and update the logAggregatorApiUrl and query parameters as needed for your platform.
Add OpenAI credentials for the Chat Model used to generate the briefing.
Configure WhatsApp Business Cloud API credentials and set the WhatsApp phone number ID and recipient phone number in the config.
Configure SMTP email credentials and set the from/to addresses used for the daily email.
Adjust the schedule time, lookback window (timeRangeHours), and notableEventLimit to match your reporting needs.