AI & Automation Architecture

// System prompt sent with every intake form submission

You are an intake classifier for a cybersecurity incident response firm
that helps scam victims. Analyze the following form submission and
extract structured data.

CLASSIFICATION TAXONOMY (use exactly these categories):
- rug_pull: Token/project disappeared with funds (DeFi, NFT)
- phishing: Signed malicious transaction, gave seed phrase, wallet drain
- romance_scam: Social engineering via dating/social media
- pig_butchering: Fake trading platform, locked withdrawals
- impersonation: Fake support agent, exchange rep, government official
- investment_fraud: Ponzi, fake yield, unlicensed broker
- recovery_scam: Scammer posing as recovery service (re-victimization)
- other: Doesn't match — flag for manual review

URGENCY RULES:
- Amount > $50K → high
- Incident within 72 hours → high (funds may be recoverable)
- Active threat indicators → critical
- Emotional distress markers (suicidal ideation, desperation) → critical + flag
- Recovery scam indicators → critical
- Everything else → assess from context

RETURN FORMAT (strict JSON):
{
  "scam_type": "category_from_taxonomy",
  "amount_lost": "extracted amount or 'not specified'",
  "currency": "USD/BTC/ETH/etc",
  "urgency": "low | medium | high | critical",
  "urgency_reason": "one-line explanation",
  "contact": {
    "name": "",
    "email": "",
    "phone": ""
  },
  "summary": "2-3 sentence summary of the incident",
  "key_entities": ["wallet addresses, domains, names mentioned"],
  "needs_manual_review": false,
  "draft_email": "professional, empathetic first response (3-4 paragraphs)"
}

// Triggered when WordPress form webhook fires
// Input: form_data (Map) from webhook payload

// 1. Call Claude API for classification
headers = Map();
headers.put("x-api-key", zoho.encryption.getDecryptedValue("claude_api_key"));
headers.put("anthropic-version", "2023-06-01");
headers.put("content-type", "application/json");

payload = Map();
payload.put("model", "claude-sonnet-4-20250514");
payload.put("max_tokens", 2048);
payload.put("system", system_prompt);  // prompt from above
payload.put("messages", {
  {"role": "user", "content": form_data.get("message")}
});

response = invokeurl[
  url: "https://api.anthropic.com/v1/messages"
  type: POST
  headers: headers
  parameters: payload.toString()
];

// 2. Parse AI response
ai_data = response.get("content").get(0).get("text");
parsed = ai_data.toJSON();

// 3. Create Zoho CRM Lead
lead = Map();
lead.put("Last_Name", parsed.get("contact").get("name"));
lead.put("Email", parsed.get("contact").get("email"));
lead.put("Phone", parsed.get("contact").get("phone"));
lead.put("Scam_Type", parsed.get("scam_type"));
lead.put("Amount_Lost", parsed.get("amount_lost"));
lead.put("Urgency", parsed.get("urgency"));
lead.put("AI_Summary", parsed.get("summary"));
lead.put("Email_Draft", parsed.get("draft_email"));
lead.put("Raw_Submission", form_data.get("message"));
lead.put("Lead_Source", "Website Form");

crm_response = zoho.crm.createRecord("Leads", lead);
lead_id = crm_response.get("id");

// 4. Send Slack notification
slack_msg = "*New Lead — " + parsed.get("scam_type") + " — " + parsed.get("urgency").toUpperCase() + "*\n";
slack_msg = slack_msg + "Amount: " + parsed.get("amount_lost") + "\n";
slack_msg = slack_msg + parsed.get("summary");
// Slack webhook call here...

// 5. Create follow-up task
task = Map();
task.put("Subject", "Follow-up call: " + parsed.get("contact").get("name"));
task.put("Due_Date", zoho.currentdate.addDay(2));
zoho.crm.createRecord("Tasks", task);

// Key nodes from the n8n workflow
{
  "nodes": [
    {
      "name": "Webhook Trigger",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "investigate",
        "method": "POST"
      }
    },
    {
      "name": "Route by Target Type",
      "type": "n8n-nodes-base.switch",
      "parameters": {
        "rules": [
          { "value": "wallet", "output": 0 },
          { "value": "domain", "output": 1 },
          { "value": "company", "output": 2 }
        ]
      }
    },
    {
      "name": "Etherscan Lookup",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://api.etherscan.io/api",
        "qs": {
          "module": "account",
          "action": "txlist",
          "address": "={{ $json.target }}"
        }
      }
    },
    {
      "name": "WHOIS Lookup",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://www.whoisxmlapi.com/whoisserver/WhoisService",
        "qs": {
          "domainName": "={{ $json.target }}",
          "outputFormat": "JSON"
        }
      }
    },
    {
      "name": "Merge All Sources",
      "type": "n8n-nodes-base.merge",
      "parameters": { "mode": "append" }
    },
    {
      "name": "Claude Analysis",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://api.anthropic.com/v1/messages",
        "method": "POST",
        "body": {
          "model": "claude-sonnet-4-20250514",
          "system": "You are an investigation analyst...",
          "messages": [{ "role": "user", "content": "={{ JSON.stringify($json) }}" }]
        }
      }
    },
    {
      "name": "Save to Supabase",
      "type": "n8n-nodes-base.supabase",
      "parameters": {
        "operation": "create",
        "table": "investigations"
      }
    }
  ]
}

-- Investigation data from Task 2 pipeline
CREATE TABLE investigations (
  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  crm_lead_id   text,          -- links back to Zoho CRM record
  target        text NOT NULL, -- domain, wallet, company name
  target_type   text NOT NULL, -- 'wallet' | 'domain' | 'company' | 'person'
  raw_data      jsonb,         -- full API responses with source URLs
  ai_analysis   jsonb,         -- Claude output, clearly separated
  threat_level  text,          -- 'low' | 'medium' | 'high' | 'critical'
  status        text DEFAULT 'completed',
  created_at    timestamptz DEFAULT now()
);

-- Ad attribution: which campaigns bring real clients
CREATE TABLE ad_attribution (
  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  crm_lead_id   text,
  utm_source    text,          -- google, meta, organic
  utm_campaign  text,          -- campaign name
  utm_medium    text,
  gclid         text,          -- Google Click ID
  fbclid        text,          -- Meta Click ID
  landing_page  text,
  converted     boolean DEFAULT false,
  conversion_value numeric,    -- actual case value (for ROAS)
  created_at    timestamptz DEFAULT now()
);

-- Audit log: every action in the system
CREATE TABLE audit_log (
  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  event_type    text NOT NULL, -- 'intake' | 'investigation' | 'email_sent' | 'status_change'
  actor         text,          -- 'system' | rep email | 'ai'
  crm_lead_id   text,
  payload       jsonb,         -- full event data
  created_at    timestamptz DEFAULT now()
);

-- Known scam entities: grows with every investigation
CREATE TABLE known_entities (
  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  entity        text NOT NULL, -- wallet, domain, or name
  entity_type   text NOT NULL,
  threat_level  text,
  first_seen    timestamptz,
  investigation_ids uuid[],   -- linked investigations
  notes         text,
  created_at    timestamptz DEFAULT now()
);

-- Row-level security: reps see only their cases
ALTER TABLE investigations ENABLE ROW LEVEL SECURITY;
CREATE POLICY "reps_own_cases" ON investigations
  USING (auth.uid() = assigned_rep_id OR auth.jwt() ->> 'role' = 'admin');