Automate cybersecurity threat analysis with GPT-4o, CVSS scoring and risk routing
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 16 nodes and runs manually, when you click “Execute workflow”. Along the way it connects OpenAI Chat Model and HTTP Request.
How it runs
Trigger: Manually, when you click “Execute workflow”.
- Cybersecurity Orchestrator Agent (AI Agent): runs an AI agent, with model: Orchestrator Chat Model; 2 tools (Threat Intelligence Agent, Attack Surface Mapping Agent); output parser: Structured Threat Report Parser
- Route by Risk Severity (Switch): routes items into 3 branches
- Format SOC Alert (Edit Fields (Set)): sets 8 fields: alert_type, timestamp, risk_rating…
- Format Executive Report (Edit Fields (Set)): sets 8 fields: report_type, timestamp, risk_rating…
- Format Standard Report (Edit Fields (Set)): sets 7 fields: report_type, timestamp, risk_rating…
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (10)
- Manual Trigger
n8n-nodes-base.manualTrigger - AI Agent
@n8n/n8n-nodes-langchain.agent - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - Structured Output Parser
@n8n/n8n-nodes-langchain.outputParserStructured - AI Agent Tool
@n8n/n8n-nodes-langchain.agentTool - Http Request Tool
n8n-nodes-base.httpRequestTool - Calculator
@n8n/n8n-nodes-langchain.toolCalculator - Code Tool
@n8n/n8n-nodes-langchain.toolCode - Switch
n8n-nodes-base.switch - Edit Fields (Set)
n8n-nodes-base.set
From the author
How It Works This workflow automates end-to-end cybersecurity threat analysis using a multi-agent AI architecture, targeting Security Operations Centre (SOC) analysts, security engineers, and IT risk teams responsible for continuous threat monitoring and…