Automate SIEM alert enrichment with MITRE ATT&CK, Qdrant & Zendesk in n8n
Needs changesNeeds changes. This template uses 1 thing(s) that n8n 3.0 removes: AI Agent v1 (old agent modes). 1 breaking item(s) found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 23 nodes and runs when a chat message arrives (plus 1 other trigger). Along the way it connects OpenAI Chat Model, Embeddings OpenAI, Google Drive and Qdrant Vector Store and 1 more.
How it runs
Trigger: When a chat message arrives (plus 1 other trigger).
- AI Agent: runs an AI agent, with model: OpenAI Chat Model; 1 tool (Query Qdrant Vector Store); memory: Window Buffer Memory
- Pull Mitre Data From Gdrive (Google Drive): download
- Extract from File: extracts data from a file (from json)
- Split Out: splits a list into separate items
- Embed JSON in Qdrant Collection (Qdrant Vector Store): stores documents in the Qdrant vector store, with embeddings: Embeddings OpenAI; document loader: Default Data Loader
- Get all Zendesk Tickets (Zendesk): get many
- Loop Over Items (Loop Over Items (Split in Batches)): loops over the items in batches
- AI Agent: runs an AI agent, with model: OpenAI Chat Model; 1 tool (Qdrant Vector Store); output parser: Structured Output Parser
- Update Zendesk with Mitre Data (Zendesk): update
Services it uses
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- AI Agent v1 (old agent modes) in AI Agent (v1.7), AI Agent1 (v1.7): replace with Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent.
Rather not rewrite it? Many of these flows can be rebuilt in Make (free plan).
| Removed in 3.0 | Replace with |
|---|---|
| AI Agent v1 (old agent modes) AI Agent (v1.7), AI Agent1 (v1.7) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Nodes used (16)
- Chat Trigger
@n8n/n8n-nodes-langchain.chatTrigger - AI Agent
@n8n/n8n-nodes-langchain.agent - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - Split Out
n8n-nodes-base.splitOut - Embeddings OpenAI
@n8n/n8n-nodes-langchain.embeddingsOpenAi - Default Data Loader
@n8n/n8n-nodes-langchain.documentDefaultDataLoader - Token Splitter
@n8n/n8n-nodes-langchain.textSplitterTokenSplitter - Simple Memory
@n8n/n8n-nodes-langchain.memoryBufferWindow - Extract from File
n8n-nodes-base.extractFromFile - Manual Trigger
n8n-nodes-base.manualTrigger - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - Structured Output Parser
@n8n/n8n-nodes-langchain.outputParserStructured - Google Drive
n8n-nodes-base.googleDrive - Qdrant Vector Store
@n8n/n8n-nodes-langchain.vectorStoreQdrant - Zendesk
n8n-nodes-base.zendesk - No Operation, do nothing
n8n-nodes-base.noOp
From the author
n8n Workflow: Automate SIEM Alert Enrichment with MITRE ATT&CK & Qdrant --- Who is this for? This workflow is ideal for: - Cybersecurity teams & SOC analysts who want to automate SIEM alert enrichment. - IT security professionals looking to integrate MITRE…