Monitor zero-day threats with Anthropic Claude, Airtable, Slack and Jira
Needs changesWhat this workflow does
This AI workflow has 25 nodes and runs when an HTTP POST request hits its webhook URL (plus 1 other trigger). Along the way it connects Airtable, Anthropic Chat Model and Google Sheets. It also calls services.nvd.nist.gov, cisa.gov and api.github.com over HTTP.
How it runs
Trigger: When an HTTP POST request hits its webhook URL (plus 1 other trigger).
- Load Asset & Software Inventory (Airtable): search
- Build Scan Context & Search Terms (Code): runs custom JavaScript code
- Query NVD CVE Database (HTTP Request): calls services.nvd.nist.gov
- Fetch CISA Known Exploited Vulns (HTTP Request): calls cisa.gov
- Query GitHub Security Advisories (HTTP Request): calls api.github.com
- Fetch AlienVault OTX Pulses (HTTP Request): calls otx.alienvault.com
- Fetch EPSS Exploit Probability Scores (HTTP Request): calls api.first.org
- Merge: merges the data from its input branches
- Normalise, Deduplicate & Correlate (Code): runs custom JavaScript code
- AI Threat Assessment & Prioritisation (AI Agent): runs an AI agent, with model: Claude AI Model
…plus 12 more steps. See the full node list below.
Services it uses
HTTP calls to: services.nvd.nist.gov, cisa.gov, api.github.com, otx.alienvault.com, api.first.org, slack.com
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- AI Agent v1 (old agent modes) in AI Threat Assessment & Prioritisation (v1.6): replace with Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent.
Rather not rewrite it? Many of these flows can be rebuilt in Make (free plan).
| Removed in 3.0 | Replace with |
|---|---|
| AI Agent v1 (old agent modes) AI Threat Assessment & Prioritisation (v1.6) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Nodes used (14)
- Webhook
n8n-nodes-base.webhook - Schedule Trigger
n8n-nodes-base.scheduleTrigger - Airtable
n8n-nodes-base.airtable - Code
n8n-nodes-base.code - HTTP Request
n8n-nodes-base.httpRequest - Merge
n8n-nodes-base.merge - AI Agent
@n8n/n8n-nodes-langchain.agent - Anthropic Chat Model
@n8n/n8n-nodes-langchain.lmChatAnthropic - Filter
n8n-nodes-base.filter - Switch
n8n-nodes-base.switch - Send Email
n8n-nodes-base.emailSend - Google Sheets
n8n-nodes-base.googleSheets - Respond to Webhook
n8n-nodes-base.respondToWebhook - Wait
n8n-nodes-base.wait
From the author
This workflow continuously monitors CVE databases, threat intelligence feeds, and public security advisories to surface emerging zero-day threats, correlates them against your registered infrastructure assets and software inventory, and uses Claude AI to…