Automation library · Lead generation

Automate SIEM alert enrichment with MITRE ATT and Qdrant

Started by someone opening a chat with it, and works across Google Drive, Qdrant and Zendesk. It puts OpenAI behind a retrieval step, so answers are drawn from documents you supply rather than from the model alone. 23 steps, 1 loop or waits: large, and worth reading before you trust it with anything live.

LargeCalls a model: OpenAIRetrieval

Download free
23 stepsLarge: read it before trusting it with anything live
0Branches: places the flow splits
1Loop or waits
3Services it connects to

The flow

Starts it 2Model 14Logic 3Service 4

The steps in the order they run, from what starts it.

  1. 1When chat message receivedChat triggerStarts it
  2. 2OpenAI Chat ModelLm Chat Open AiModel
  3. 3Embeddings OpenAI1Embeddings Open AiModel
  4. 4Token Splitter1Text Splitter Token SplitterModel
  5. 5Window Buffer MemoryMemory Buffer WindowModel
  6. 6Embeddings OpenAI2Embeddings Open AiModel
  7. 7When clicking ‘Test workflow’Manual triggerStarts it
  8. 8OpenAI Chat Model1Lm Chat Open AiModel
  9. 9Embeddings OpenAIEmbeddings Open AiModel
  10. 10Structured Output ParserOutput Parser StructuredModel
  11. 11Get all Zendesk TicketsZendeskService
  12. 12AI AgentAgentModel
  13. 13Embed JSON in Qdrant CollectionVector Store QdrantModel
  14. 14Default Data LoaderDocument Default Data LoaderModel
  15. 15Query Qdrant Vector StoreVector Store QdrantModel
  16. 16Pull Mitre Data From GdriveGoogle DriveService
  17. 17AI Agent1AgentModel
  18. 18Qdrant Vector Store queryVector Store QdrantModel
  19. 19Loop Over ItemsSplit In BatchesLogic
  20. 20Extract from FileExtract From FileService
  21. 21Update Zendesk with Mitre DataZendeskService
  22. 22Split OutSplit OutLogic
  23. 23Move on to next ticketNo OpLogic

How it's built

Starts on
Someone opening a chat with it
Steps
23, 1 loop or waits
Size
Large: read it before trusting it with anything live
Connects to
Google Drive, Qdrant, Zendesk
Model
OpenAI
Retrieval
Answers are drawn from documents you supply, not from the model alone

Questions

What does it need to run?

An n8n account, plus your own Google Drive, Qdrant and Zendesk accounts, and a key for OpenAI. You connect your own accounts after importing it; none are included.

What starts it?

It starts on someone opening a chat with it.

Does it use AI?

Yes. It calls OpenAI. Its answers draw on documents you give it, not on the model alone. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Take your time. At 23 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 23 steps before you point it at anything that matters.