The flow
Starts it 2Logic 6Service 7
The steps in the order they run, from what starts it.
- 1Run manuallyManual triggerStarts it
- 2Run daily at 07:00 UTCSchedule triggerStarts it
- 3Configure workflowSetLogic
- 4Query Wazuh Vulnerability InventoryHttp RequestService
- 5Normalize VulnerabilitiesCodeLogic
- 6Build EPSS BatchesCodeLogic
- 7Fetch EPSS in BatchesHttp RequestService
- 8Fetch CISA KEV CatalogHttp RequestService
- 9Apply Threat IntelligenceCodeLogic
- 10Load Lifecycle HistoryData TableService
- 11Compute Lifecycle ChangesCodeLogic
- 12Upsert Lifecycle RecordsData TableService
- 13Build Run SummaryCodeLogic
- 14Log Workflow RunData TableService
- 15Send Executive Security ReportEmail SendService
How it's built
- Starts on
- A clock
- Steps
- 15
- Size
- Medium: a working afternoon
- Connects to
- Email, n8n data table
- Model
- None. This is plumbing, not judgement
Questions
What does it need to run?
An n8n account, plus your own Email account. You connect your own accounts after importing it; none are included.
What starts it?
It starts on a clock.
Does it use AI?
No. Every step is fixed logic or a call to a service, so it does the same thing every time.
How long does it take to set up?
Plan an afternoon. 15 steps is enough that you should read each one before running it.
How do I import it?
Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.
Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 15 steps before you point it at anything that matters.