Automation library · Research and reporting

Automate cybersecurity threat analysis with OpenAI and CVSS

Started by an event in a connected app. It calls services over plain HTTP rather than through connectors. It hands the judgement calls to OpenAI. 16 steps, 1 branch: a working afternoon to understand properly.

MediumCalls a model: OpenAI

Download free
16 stepsMedium: a working afternoon
1Branch: places the flow splits
0Loops or waits
0Services by connector: it calls them over plain HTTP

The flow

Starts it 1Model 10Logic 4Service 1

The steps in the order they run, from what starts it.

  1. 1Start Threat AnalysisManual triggerStarts it
  2. 2Orchestrator Chat ModelLm Chat Open AiModel
  3. 3Structured Threat Report ParserOutput Parser StructuredModel
  4. 4Threat Intelligence Chat ModelLm Chat Open AiModel
  5. 5Fetch Security Logs ToolHttp Request ToolService
  6. 6Risk Score CalculatorTool CalculatorModel
  7. 7Attack Surface Chat ModelLm Chat Open AiModel
  8. 8STRIDE Analysis ToolTool CodeModel
  9. 9CVSS Scoring ToolTool CodeModel
  10. 10Cybersecurity Orchestrator AgentAgentModel
  11. 11Threat Intelligence AgentAgent ToolModel
  12. 12Attack Surface Mapping AgentAgent ToolModel
  13. 13Route by Risk SeveritySwitchLogic
  14. 14Format SOC AlertSetLogic
  15. 15Format Executive ReportSetLogic
  16. 16Format Standard ReportSetLogic

How it's built

Starts on
An event in a connected app
Steps
16, with 1 branch
Size
Medium: a working afternoon
Connects to
Nothing by connector; it calls services over plain HTTP
Model
OpenAI

Questions

What does it need to run?

An n8n account, and a key for OpenAI. You connect your own accounts after importing it; none are included.

What starts it?

It starts on an event in a connected app.

Does it use AI?

Yes. It calls OpenAI. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Plan an afternoon. 16 steps is enough that you should read each one before running it.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 16 steps before you point it at anything that matters.