Automated IP Log Collection and Email Notification

This n8n workflow automates the process of collecting and deduplicating sign-in IP addresses from multiple SaaS services within a specified timeframe (last 24 hours), and then emailing the compiled report as a CSV attachment. The workflow begins with a webhook form where users input their details and trigger the process. It then fetches login events from various services such as a custom API, OAuth, and Office365 through HTTP requests, aggregating these authentication events. The data is processed to filter relevant fields, combined, and duplicates based on IP addresses are removed to ensure clean results. The cleaned data is converted into CSV format, encoded in Base64, and attached to an email sent via SMTP2Go. This workflow is useful for security teams or system administrators monitoring login activity across different platforms, helping identify unusual IP addresses or suspicious activity efficiently.