Send daily CISA KEV EPSS risk digests to Slack with OpenAI
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 11 nodes and runs on a schedule (every day at 08:00). Along the way it connects OpenAI Chat Model and Slack. It also calls cisa.gov and api.first.org over HTTP.
How it runs
Trigger: On a schedule (every day at 08:00).
- Configuration (Edit Fields (Set)): sets 3 fields: techStack, lookbackDays, epssHighThreshold
- Fetch CISA KEV Catalog (HTTP Request): calls cisa.gov
- Filter KEVs by Tech Stack (Code): runs custom JavaScript code
- Remove Previously Alerted CVEs (Remove Duplicates): removes duplicate items
- Get EPSS Score (HTTP Request): calls api.first.org
- Calculate Risk Priority (Code): runs custom JavaScript code
- Combine CVEs into Digest (Aggregate): combines items into one
- Write Analyst Digest (Basic LLM Chain): sends a prompt to an LLM, with model: OpenAI Chat Model
- Post Digest to Slack (Slack): uses Slack
Services it uses
HTTP calls to: cisa.gov, api.first.org
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (9)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Edit Fields (Set)
n8n-nodes-base.set - HTTP Request
n8n-nodes-base.httpRequest - Code
n8n-nodes-base.code - Remove Duplicates
n8n-nodes-base.removeDuplicates - Aggregate
n8n-nodes-base.aggregate - Basic LLM Chain
@n8n/n8n-nodes-langchain.chainLlm - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - Slack
n8n-nodes-base.slack
From the author
Quick Overview This workflow runs daily to monitor the CISA Known Exploited Vulnerabilities (KEV) catalog for CVEs matching your tech stack, enriches them with FIRST EPSS scores, uses OpenAI to generate a Slack-ready analyst digest, and posts the alert to a…