Send daily CISA KEV exposure briefings to Slack with Gemini and Google Drive

by Oliver Uribe · 1 views · created 2026-09-16 · SecOps, AI Summarization

What this workflow does

This AI workflow has 41 nodes and runs on a schedule (cron 30 17 * * *). Along the way it connects Google Gemini, Google Drive and Slack. It also calls api.tavily.com over HTTP.

How it runs

Trigger: On a schedule (cron 30 17 * * *).

1. Set Configuration Parameters (Edit Fields (Set)): sets 11 fields: PROBE_MODE, DEMO_MODE, ENABLE_CUSTOMER_STACK…
2. Configure Feed and Search Settings (Code): runs custom JavaScript code
3. If: checks a condition and branches into true / false
4. Configure Stack Endpoints (Code): runs custom JavaScript code
5. Skip Customer Stack Processing (Code): runs custom JavaScript code
6. If: checks a condition and branches into true / false
7. Collapse Stack Fetch Data (Code): runs custom JavaScript code
8. If: checks a condition and branches into true / false
9. If: checks a condition and branches into true / false
10. Fetch CISA KEV Feed Data (HTTP Request): calls an HTTP API

…plus 30 more steps. See the full node list below.

Services it uses

Google GeminiGoogle DriveSlack

HTTP calls to: api.tavily.com

Before you upgrade to n8n 3.0

Nodes used (12)

• Schedule Triggern8n-nodes-base.scheduleTrigger
• Edit Fields (Set)n8n-nodes-base.set
• Coden8n-nodes-base.code
• Ifn8n-nodes-base.if
• Stop and Errorn8n-nodes-base.stopAndError
• Switchn8n-nodes-base.switch
• HTTP Requestn8n-nodes-base.httpRequest
• Mergen8n-nodes-base.merge
• Google Gemini@n8n/n8n-nodes-langchain.googleGemini
• Convert to Filen8n-nodes-base.convertToFile
• Google Driven8n-nodes-base.googleDrive
• Slackn8n-nodes-base.slack

From the author

Quick overview This workflow runs daily to fetch new CISA KEV vulnerabilities, enrich them with NVD CVSS data, optionally match them against your RMM/EDR/network device inventory, and use Google Gemini plus Tavily Search to create a cybersecurity briefing…

View the original on n8n.io → Check your own copy