BlueOps Auto CVE & IOC feed ingestor with OpenAI risk triage & email alerts
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 17 nodes and runs on a schedule (every day). Along the way it connects Google Sheets.
How it runs
Trigger: On a schedule (every day).
- 🌐 Get CVE Feed (HTTP Request): calls an HTTP API
- 🛡️ Get IOC Feed (HTTP Request): calls an HTTP API
- Merge: merges the data from its input branches
- 🧠Combine Threat Data (Code): runs custom JavaScript code
- 🧠 AI – Risk Evaluation (Code): runs custom JavaScript code
- 🧠 AI – Triage Vulnerabilities (Code): runs custom JavaScript code
- Split Out: splits a list into separate items
- 🚨 ALERT – LEV Trigger (If): checks a condition and branches into true / false
- 🧠 AI – Incident Playbook Selector (Code): runs custom JavaScript code
- 📧 Send Alert Email (Send Email): sends an email over SMTP
…plus 6 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (9)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - HTTP Request
n8n-nodes-base.httpRequest - Merge
n8n-nodes-base.merge - Code
n8n-nodes-base.code - If
n8n-nodes-base.if - Send Email
n8n-nodes-base.emailSend - Google Sheets
n8n-nodes-base.googleSheets - Switch
n8n-nodes-base.switch - Split Out
n8n-nodes-base.splitOut
From the author
How it works This Blue Team workflow ingests threat intelligence from public CVE and IOC feeds, merges the data, performs automated triage using OpenAI, and routes actionable alerts via email. - 📥 CVE and IOC feeds pulled from trusted sources - 🤖 AI node…