Automation library · Alerts and monitoring

Monitor attack surface changes with OpenAI and Postgres

Started by a clock, and works across Email, Postgres and Slack. It hands the judgement calls to OpenAI. 23 steps, 2 branches: large, and worth reading before you trust it with anything live.

LargeCalls a model: OpenAI

Download free
23 stepsLarge: read it before trusting it with anything live
2Branches: places the flow splits
0Loops or waits
3Services it connects to

The flow

Starts it 1Model 2Logic 11Service 9

The steps in the order they run, from what starts it.

  1. 1When Attack Surface Scan ScheduledSchedule triggerStarts it
  2. 2OpenAI GPT-4 ModelLm Chat Open AiModel
  3. 3Log Low-Severity ChangeNo OpLogic
  4. 4Set Configuration ParametersSetLogic
  5. 5Generate Risk Triage NarrativeAgentModel
  6. 6Fetch Subdomain DataHttp RequestService
  7. 7Fetch Exposed Services DataHttp RequestService
  8. 8Fetch Cloud Asset InventoryHttp RequestService
  9. 9Attach AI Risk NarrativeCodeLogic
  10. 10Merge Discovery SourcesMergeLogic
  11. 11Check Unauthorized Cloud RegionIfLogic
  12. 12Normalize and Deduplicate AssetsCodeLogic
  13. 13Email Compliance NotificationEmail SendService
  14. 14Route Alert By SeveritySwitchLogic
  15. 15Get Previous BaselinePostgresService
  16. 16Update Baseline with InventoryPostgresService
  17. 17Post Immediate Alert to SlackSlackService
  18. 18Email Security DigestEmail SendService
  19. 19Diff Current vs Baseline InventoryCompare DatasetsService
  20. 20Tag New AssetsSetLogic
  21. 21Tag Removed AssetsSetLogic
  22. 22Tag Changed AssetsSetLogic
  23. 23Classify and Assess Change RiskCodeLogic

How it's built

Starts on
A clock
Steps
23, with 2 branches
Size
Large: read it before trusting it with anything live
Connects to
Email, Postgres, Slack
Model
OpenAI

Questions

What does it need to run?

An n8n account, plus your own Email, Postgres and Slack accounts, and a key for OpenAI. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

Yes. It calls OpenAI. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Take your time. At 23 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 23 steps before you point it at anything that matters.