Triage security vulnerability alerts with NVD, Gemini, Supabase, and Jira
Needs changesNeeds changes. This template uses 1 thing(s) that n8n 3.0 removes: AI Agent v1 (old agent modes). 1 breaking item(s) found. Static check, last run 2026-10-19.
What to replace before upgrading
| Removed in 3.0 | Replace with |
|---|---|
| AI Agent v1 (old agent modes) Risk Analyst Agent (v1.9) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Nodes used (12)
- Webhook
n8n-nodes-base.webhook - If
n8n-nodes-base.if - Redis
n8n-nodes-base.redis - Edit Fields (Set)
n8n-nodes-base.set - Switch
n8n-nodes-base.switch - Jira Software
n8n-nodes-base.jira - Respond to Webhook
n8n-nodes-base.respondToWebhook - HTTP Request
n8n-nodes-base.httpRequest - Supabase
n8n-nodes-base.supabase - AI Agent
@n8n/n8n-nodes-langchain.agent - Google Gemini Chat Model
@n8n/n8n-nodes-langchain.lmChatGoogleGemini - Structured Output Parser
@n8n/n8n-nodes-langchain.outputParserStructured
What it does
Quick overview Youtube Video: https://youtu.be/8f-TzjNmbFI?si=V46dC5o45LGv28S0 This workflow receives vulnerability alerts via webhook, deduplicates repeated events with Redis, enriches CVE details from the NVD API and asset context from Supabase, uses Google Gemini to triage risk with structured output, and creates the appropriate Jira issue before responding to the caller. How it works 1. Receives a POST webhook request for a vulnerability alert using header-based authentication. 2. Validates that the payload contains a properly formatted CVE ID and a non-empty IP address, and immediately returns an error response if invalid. 3. Increments a Redis counter keyed by CVE ID and IP address to detect duplicates, and immediately returns a duplicate response if the alert was already seen. 4. Fetches CVE details from the NVD REST API and looks up the target asset in a Supabase table using the provided IP address. 5. Sends the combined vulnerability and CMDB context to a Google Gemini-powered agent that returns a structured JSON risk score, action, and reasoning. 6. Creates a Jira issue for either emergency remediation (auto-patch) or manual review (ticketonly/unclear) and responds to the original webhook request. Setup 1. Create an n8n Header Auth credential and configure the sending system to include the shared secret header when calling the webhook URL. 2. Add Redis credentials and ensure your Redis instance can store the deduplication keys (optionally add a TTL/eviction policy for the secops-dedup: keyspace). 3. Ensure the NVD API endpoint is reachable from your n8n instance (and add an API key or request headers if your usage requires it). 4. Add Supabase credentials and confirm your cmdbassets table includes an ipaddress field that matches incoming alerts. 5. Add Google Gemini (PaLM) API credentials for the Gemini chat model used by the risk analyst agent. 6. Add Jira Software Cloud credentials and update the target project and issue types (Bug/Task) to match your Jira configuration.