# Automate SIEM alert enrichment with MITRE ATT and Qdrant: n8n workflow

> Started by someone opening a chat with it, and works across Google Drive, Qdrant and Zendesk.

Source: https://millionrounds.com/workflow/automate-siem-alert-enrichment-with-mitre-att-and-qdrant (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Lead generation](https://millionrounds.com/workflows?category=Lead+generation#library)

# Automate SIEM alert enrichment with MITRE ATT and Qdrant

Started by someone opening a chat with it, and works across Google Drive, Qdrant and Zendesk. It puts OpenAI behind a retrieval step, so answers are drawn from documents you supply rather than from the model alone. 23 steps, 1 loop or waits: large, and worth reading before you trust it with anything live.

Large Calls a model: OpenAI Retrieval

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fautomate-siem-alert-enrichment-with-mitre-att-and-qdrant)

**23 steps** Large: read it before trusting it with anything live

**0** Branches: places the flow splits

**1** Loop or waits

**3** Services it connects to

## The flow

Starts it 2 Model 14 Logic 3 Service 4

The steps in the order they run, from what starts it.

- 1 **When chat message received** Chat trigger *Starts it*
- 2 **OpenAI Chat Model** Lm Chat Open Ai *Model*
- 3 **Embeddings OpenAI1** Embeddings Open Ai *Model*
- 4 **Token Splitter1** Text Splitter Token Splitter *Model*
- 5 **Window Buffer Memory** Memory Buffer Window *Model*
- 6 **Embeddings OpenAI2** Embeddings Open Ai *Model*
- 7 **When clicking ‘Test workflow’** Manual trigger *Starts it*
- 8 **OpenAI Chat Model1** Lm Chat Open Ai *Model*
- 9 **Embeddings OpenAI** Embeddings Open Ai *Model*
- 10 **Structured Output Parser** Output Parser Structured *Model*
- 11 **Get all Zendesk Tickets** Zendesk *Service*
- 12 **AI Agent** Agent *Model*
- 13 **Embed JSON in Qdrant Collection** Vector Store Qdrant *Model*
- 14 **Default Data Loader** Document Default Data Loader *Model*
- 15 **Query Qdrant Vector Store** Vector Store Qdrant *Model*
- 16 **Pull Mitre Data From Gdrive** Google Drive *Service*
- 17 **AI Agent1** Agent *Model*
- 18 **Qdrant Vector Store query** Vector Store Qdrant *Model*
- 19 **Loop Over Items** Split In Batches *Logic*
- 20 **Extract from File** Extract From File *Service*
- 21 **Update Zendesk with Mitre Data** Zendesk *Service*
- 22 **Split Out** Split Out *Logic*
- 23 **Move on to next ticket** No Op *Logic*

## How it's built

- **Starts on:** Someone opening a chat with it
- **Steps:** 23, 1 loop or waits
- **Size:** Large: read it before trusting it with anything live
- **Connects to:** Google Drive, Qdrant, Zendesk
- **Model:** OpenAI
- **Retrieval:** Answers are drawn from documents you supply, not from the model alone

## Questions

What does it need to run?

An n8n account, plus your own Google Drive, Qdrant and Zendesk accounts, and a key for OpenAI. You connect your own accounts after importing it; none are included.

What starts it?

It starts on someone opening a chat with it.

Does it use AI?

Yes. It calls OpenAI. Its answers draw on documents you give it, not on the model alone. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Take your time. At 23 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 23 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fautomate-siem-alert-enrichment-with-mitre-att-and-qdrant)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Google Drive](https://millionrounds.com/workflows?service=Google+Drive#library)[Qdrant](https://millionrounds.com/workflows?service=Qdrant#library)[Zendesk](https://millionrounds.com/workflows?service=Zendesk#library)

## Workflows like it

Also lead generation, with the same services where possible, closest in size first.

- [**Send validated outreach emails with Gmail and Google Sheets** 23 steps · Gmail, Google Drive](https://millionrounds.com/workflow/send-validated-outreach-emails-with-gmail-and-google-sheets)
- [**Qualify mortgage leads and collect documents with Gemini** 24 steps · calls a model · Gmail, Google Drive](https://millionrounds.com/workflow/qualify-mortgage-leads-and-collect-documents-with-gemini)
- [**Review and reply to business emails with Gmail and OpenAI** 22 steps · calls a model · Email, Gmail](https://millionrounds.com/workflow/review-and-reply-to-business-emails-with-gmail-and-openai)
- [**Scrape Businesses with LLM-expanded and Deduplicate** 22 steps · calls a model · Gmail, Google Drive](https://millionrounds.com/workflow/scrape-businesses-with-llm-expanded-and-deduplicate)
- [**Generate personalized cold email openers with Claude** 21 steps · calls a model · Google Drive, Google Sheets](https://millionrounds.com/workflow/generate-personalized-cold-email-openers-with-claude)
- [**Lead generator + email hunter with Gemini and Google Drive** 21 steps · calls a model · Google Drive, Google Sheets](https://millionrounds.com/workflow/lead-generator-email-hunter-with-gemini-and-google-drive)