Triage software risk using NVD, EPSS, CISA KEV, GitHub and Claude

by AI Solutions ✓ · 7 views · created 2026-08-18 · SecOps, AI Summarization

What this workflow does

This AI workflow has 26 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Anthropic and Microsoft Outlook. It also calls services.nvd.nist.gov, api.first.org and news.google.com over HTTP.

How it runs

Trigger: When an HTTP POST request hits its webhook URL.

1. Normalize Request Data (Code): runs custom JavaScript code
2. Send Initial Response (Respond to Webhook): sends the response back to the webhook caller
3. Fetch NVD CVEs (HTTP Request): calls services.nvd.nist.gov
4. Extract CVE Details (Code): runs custom JavaScript code
5. Check for CVEs (If): checks a condition and branches into true / false
6. Fetch EPSS Data (HTTP Request): calls api.first.org
7. Combine EPSS Data (Merge): merges the data from its input branches
8. Fetch CISA KEV Data (HTTP Request): calls services.nvd.nist.gov
9. Analyze KEV Data (Code): runs custom JavaScript code
10. Search Breach News (HTTP Request): calls news.google.com

…plus 15 more steps. See the full node list below.

Services it uses

AnthropicMicrosoft Outlook

HTTP calls to: services.nvd.nist.gov, api.first.org, news.google.com, efts.sec.gov, api.osv.dev

Before you upgrade to n8n 3.0

Nodes used (9)

• Webhookn8n-nodes-base.webhook
• Coden8n-nodes-base.code
• Respond to Webhookn8n-nodes-base.respondToWebhook
• HTTP Requestn8n-nodes-base.httpRequest
• Ifn8n-nodes-base.if
• Mergen8n-nodes-base.merge
• Anthropic@n8n/n8n-nodes-langchain.anthropic
• Microsoft Outlookn8n-nodes-base.microsoftOutlook
• Data tablen8n-nodes-base.dataTable

From the author

Quick Overview This workflow receives software vetting requests via a webhook, gathers vulnerability and supply-chain evidence from NVD, EPSS, CISA KEV (via NVD), Google News RSS, SEC EDGAR, GitHub, OpenSSF Scorecard, OSV, and deps.dev, then uses Anthropic…

View the original on n8n.io → Check your own copy