Monitor attack surface changes with OpenAI, Slack, Postgres and email
Needs changesNeeds changes. This template uses 1 thing(s) that n8n 3.0 removes: AI Agent v1 (old agent modes). 1 breaking item(s) found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 28 nodes and runs on a schedule (every 6 hours). Along the way it connects Postgres, OpenAI Chat Model and Slack.
How it runs
Trigger: On a schedule (every 6 hours).
- Set Configuration Parameters (Edit Fields (Set)): sets 11 fields: rootDomains, subdomainApiUrl, exposedServicesApiUrl…
- Fetch Subdomain Data (HTTP Request): calls an HTTP API
- Fetch Exposed Services Data (HTTP Request): calls an HTTP API
- Fetch Cloud Asset Inventory (HTTP Request): calls an HTTP API
- Merge: merges the data from its input branches
- Build Raw Observations (Code): runs custom JavaScript code
- Persist Raw Observations (Postgres): run a query
- Load Known Asset Identities (Postgres): run a query
- Merge: merges the data from its input branches
- Resolve Assets Across Sources (Code): runs custom JavaScript code
…plus 15 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- AI Agent v1 (old agent modes) in Generate Risk Triage Narrative (v1.6): replace with Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent.
Rather not rewrite it? Many of these flows can be rebuilt in Make (free plan).
| Removed in 3.0 | Replace with |
|---|---|
| AI Agent v1 (old agent modes) Generate Risk Triage Narrative (v1.6) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Nodes used (13)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Edit Fields (Set)
n8n-nodes-base.set - HTTP Request
n8n-nodes-base.httpRequest - Merge
n8n-nodes-base.merge - Code
n8n-nodes-base.code - Postgres
n8n-nodes-base.postgres - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - AI Agent
@n8n/n8n-nodes-langchain.agent - Split Out
n8n-nodes-base.splitOut - Switch
n8n-nodes-base.switch - Slack
n8n-nodes-base.slack - Send Email
n8n-nodes-base.emailSend - No Operation, do nothing
n8n-nodes-base.noOp
From the author
Quick overview This workflow runs every 6 hours to collect attack-surface assets from three HTTP APIs, normalize and deduplicate them, compare them to a Postgres baseline, and use OpenAI to generate risk narratives before sending critical/high alerts to Slack…