Analyze pentest reports and create remediation tickets with OpenAI and Slack
Needs changesNeeds changes. This template uses 1 thing(s) that n8n 3.0 removes: AI Agent v1 (old agent modes). 1 breaking item(s) found. Static check, last run 2026-10-19.
What to replace before upgrading
| Removed in 3.0 | Replace with |
|---|---|
| AI Agent v1 (old agent modes) AI Agent - Vulnerability Extractor (v1.6) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Nodes used (11)
- Webhook
n8n-nodes-base.webhook - Edit Fields (Set)
n8n-nodes-base.set - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - AI Agent
@n8n/n8n-nodes-langchain.agent - Code
n8n-nodes-base.code - If
n8n-nodes-base.if - Slack
n8n-nodes-base.slack - Wait
n8n-nodes-base.wait - Switch
n8n-nodes-base.switch - HTTP Request
n8n-nodes-base.httpRequest - Respond to Webhook
n8n-nodes-base.respondToWebhook
What it does
Quick overview This workflow receives a penetration test report via webhook, uses OpenAI to extract and normalize vulnerability findings, alerts Slack when critical issues are present, and creates severity-routed remediation tickets in an external ticketing system API before returning a JSON summary to the requester. How it works 1. Receives a POST request via webhook containing scan metadata and the raw penetration test report text. 2. Uses OpenAI (via an AI Agent) to extract a structured JSON list of vulnerabilities from the report. 3. Parses and validates the extracted JSON, normalizes severity (including optional CVSS-to-tier mapping), assigns IDs, and computes a report-level severity summary. 4. If critical vulnerabilities exist, posts a Slack alert to the configured channel and pauses execution until a security lead resumes the workflow via a wait webhook. 5. Builds one remediation ticket payload per finding with mapped priority, SLA hours, labels, and scan context. 6. Routes each ticket by severity to set the target assignee team and urgency flags, then creates the ticket via an HTTP POST to your ticketing system API. 7. Waits for a ticket sync confirmation via a second wait webhook and responds to the original webhook call with a JSON summary and the tickets created. Setup 1. Add an OpenAI credential for the OpenAI Chat Model used by the AI Agent. 2. Add a Slack credential and ensure the target Slack channel (for example, security-alerts) exists and is set in the workflow configuration. 3. Add an HTTP Header Auth credential for your ticketing system and update the ticket API URL and project key used to create issues. 4. Configure the two resume webhooks for triage approval and ticket sync confirmation in the systems that will call them (for example, a Slack button/action for triage and your ticketing system callback for creation confirmation). 5. Send POST requests to the trigger webhook with scanId, targetSystem, reportFormat, reportText, and submittedBy fields to start the analysis.