Prioritize and report Wazuh vulnerabilities with EPSS and CISA KEV

by Alberto Flores ✓ · 225 views · created 2026-08-03 · SecOps, AI Summarization

What this workflow does

This workflow has 15 nodes and runs manually, when you click “Execute workflow” (plus 1 other trigger). It uses only n8n's built-in nodes. It also calls api.first.org and cisa.gov over HTTP.

How it runs

Trigger: Manually, when you click “Execute workflow” (plus 1 other trigger).

1. Configure workflow (Edit Fields (Set)): sets 11 fields: organizationName, wazuhIndexerUrl, reportRecipient…
2. Query Wazuh Vulnerability Inventory (HTTP Request): calls an HTTP API (POST)
3. Normalize Vulnerabilities (Code): runs custom JavaScript code
4. Build EPSS Batches (Code): runs custom JavaScript code
5. Fetch EPSS in Batches (HTTP Request): calls api.first.org
6. Fetch CISA KEV Catalog (HTTP Request): calls cisa.gov
7. Apply Threat Intelligence (Code): runs custom JavaScript code
8. Load Lifecycle History (Data table): get
9. Compute Lifecycle Changes (Code): runs custom JavaScript code
10. Upsert Lifecycle Records (Data table): create or update

…plus 3 more steps. See the full node list below.

HTTP calls to: api.first.org, cisa.gov

Before you upgrade to n8n 3.0

Nodes used (7)

• Manual Triggern8n-nodes-base.manualTrigger
• HTTP Requestn8n-nodes-base.httpRequest
• Coden8n-nodes-base.code
• Schedule Triggern8n-nodes-base.scheduleTrigger
• Data tablen8n-nodes-base.dataTable
• Send Emailn8n-nodes-base.emailSend
• Edit Fields (Set)n8n-nodes-base.set

From the author

Quick overview This workflow runs daily (or manually) to pull vulnerability findings from Wazuh Indexer, enriches CVEs with FIRST EPSS and the CISA KEV catalog, calculates a priority score, tracks finding lifecycle in n8n Data Tables, and emails an executive…

View the original on n8n.io → Check your own copy