# Monitor attack surface changes with OpenAI and Postgres: n8n workflow

> Started by a clock, and works across Email, Postgres and Slack. It hands the judgement calls to OpenAI.

Source: https://millionrounds.com/workflow/monitor-attack-surface-changes-with-openai-and-postgres (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Alerts and monitoring](https://millionrounds.com/workflows?category=Alerts+and+monitoring#library)

# Monitor attack surface changes with OpenAI and Postgres

Started by a clock, and works across Email, Postgres and Slack. It hands the judgement calls to OpenAI. 23 steps, 2 branches: large, and worth reading before you trust it with anything live.

Large Calls a model: OpenAI

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fmonitor-attack-surface-changes-with-openai-and-postgres)

**23 steps** Large: read it before trusting it with anything live

**2** Branches: places the flow splits

**0** Loops or waits

**3** Services it connects to

## The flow

Starts it 1 Model 2 Logic 11 Service 9

The steps in the order they run, from what starts it.

- 1 **When Attack Surface Scan Scheduled** Schedule trigger *Starts it*
- 2 **OpenAI GPT-4 Model** Lm Chat Open Ai *Model*
- 3 **Log Low-Severity Change** No Op *Logic*
- 4 **Set Configuration Parameters** Set *Logic*
- 5 **Generate Risk Triage Narrative** Agent *Model*
- 6 **Fetch Subdomain Data** Http Request *Service*
- 7 **Fetch Exposed Services Data** Http Request *Service*
- 8 **Fetch Cloud Asset Inventory** Http Request *Service*
- 9 **Attach AI Risk Narrative** Code *Logic*
- 10 **Merge Discovery Sources** Merge *Logic*
- 11 **Check Unauthorized Cloud Region** If *Logic*
- 12 **Normalize and Deduplicate Assets** Code *Logic*
- 13 **Email Compliance Notification** Email Send *Service*
- 14 **Route Alert By Severity** Switch *Logic*
- 15 **Get Previous Baseline** Postgres *Service*
- 16 **Update Baseline with Inventory** Postgres *Service*
- 17 **Post Immediate Alert to Slack** Slack *Service*
- 18 **Email Security Digest** Email Send *Service*
- 19 **Diff Current vs Baseline Inventory** Compare Datasets *Service*
- 20 **Tag New Assets** Set *Logic*
- 21 **Tag Removed Assets** Set *Logic*
- 22 **Tag Changed Assets** Set *Logic*
- 23 **Classify and Assess Change Risk** Code *Logic*

## How it's built

- **Starts on:** A clock
- **Steps:** 23, with 2 branches
- **Size:** Large: read it before trusting it with anything live
- **Connects to:** Email, Postgres, Slack
- **Model:** OpenAI

## Questions

What does it need to run?

An n8n account, plus your own Email, Postgres and Slack accounts, and a key for OpenAI. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

Yes. It calls OpenAI. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Take your time. At 23 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 23 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fmonitor-attack-surface-changes-with-openai-and-postgres)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Email](https://millionrounds.com/workflows?service=Email#library)[Postgres](https://millionrounds.com/workflows?service=Postgres#library)[Slack](https://millionrounds.com/workflows?service=Slack#library)

## Workflows like it

Also alerts and monitoring, with the same services where possible, closest in size first.

- [**Categorize emails & get Telegram alerts with Azure OpenAI** 23 steps · calls a model · Email, Google Sheets](https://millionrounds.com/workflow/categorize-emails-and-get-telegram-alerts-with-azure-openai)
- [**Detect and correct claims cost leakage with OpenAI** 23 steps · calls a model · Email, Postgres](https://millionrounds.com/workflow/detect-and-correct-claims-cost-leakage-with-openai)
- [**Monitor AI budgets and optimize costs with Claude and Slack** 23 steps · calls a model · Email, Slack](https://millionrounds.com/workflow/monitor-ai-budgets-and-optimize-costs-with-claude-and-slack)
- [**Analyze contract risk from PDFs with OpenAI and Supabase** 23 steps · Gmail, Slack](https://millionrounds.com/workflow/analyze-contract-risk-from-pdfs-with-openai-and-supabase)
- [**Back up your n8n workflows to GitHub with Slack** 23 steps · GitHub, Slack](https://millionrounds.com/workflow/back-up-your-n8n-workflows-to-github-with-slack)
- [**Build an event-driven pub/sub bus with HTTP and Slack** 23 steps · Slack](https://millionrounds.com/workflow/build-an-event-driven-pub-sub-bus-with-http-and-slack)