Monitor and score CVEs with real-time alerts
An n8n workflow monitors CVEs from sources like CISA and OTX, scores them with AI, and alerts via Slack, Gmail and Google Sheets. Task: The author built an n8n workflow using Bright Data nodes to scrape CISA, NIST, CERT-FR, and BleepingComputer. A Cohere Command-R agent with session memory extracts CVE details and scores severity, enriched by CISA KEV, CIRCL, and AlienVault OTX. Output parsing and hash-based diff checks normalize data and remove duplicates. Alerts are sent to Slack, Gmail, and Google Sheets. The source does not explicitly detail specific human intervention steps beyond the initial build.; tools: n8n. Human role: Source evidence is unavailable regarding specific human roles or manual intervention steps in this workflow.; limitations: Strict output constraints and parsing are required to prevent inconsistent AI scoring. The workflow relies on n8n infrastructure and Bright Data for scraping, which may incur costs or require specific tier access. Slack webhook integration is currently non-functional for real actions. Source reliability is secondary, and performance metrics are author claims. Human approval is needed for alert dismissal and investigation workflows once webhooks are active..
Tools
Published on Agent Work Atlas:
Overview
An n8n workflow monitors CVEs from sources like CISA and OTX, scores them with AI, and alerts via Slack, Gmail and Google Sheets.
Workflow
The author built an n8n workflow using Bright Data nodes to scrape CISA, NIST, CERT-FR, and BleepingComputer. A Cohere Command-R agent with session memory extracts CVE details and scores severity, enriched by CISA KEV, CIRCL, and AlienVault OTX. Output parsing and hash-based diff checks normalize data and remove duplicates. Alerts are sent to Slack, Gmail, and Google Sheets. The source does not explicitly detail specific human intervention steps beyond the initial build.
Reported result
The author reports processing 100+ CVEs daily with alerts in under 5 minutes and 99.8% uptime. However, Slack interactive buttons (Ack/Investigate/Dismiss) are currently demo-only because the webhook integration was blocked during testing. False-positive rates and uptime figures are self-reported and not independently verified. The system is described as 90% production-ready, pending full webhook functionality.
Human role
Source evidence is unavailable regarding specific human roles or manual intervention steps in this workflow.
Limitations
Strict output constraints and parsing are required to prevent inconsistent AI scoring. The workflow relies on n8n infrastructure and Bright Data for scraping, which may incur costs or require specific tier access. Slack webhook integration is currently non-functional for real actions. Source reliability is secondary, and performance metrics are author claims. Human approval is needed for alert dismissal and investigation workflows once webhooks are active.
Try it
I want to build a CVE monitoring workflow in n8n. Please configure Bright Data nodes to scrape CISA, NIST, CERT-FR, and BleepingComputer. Use a Cohere Command-R agent with session memory to extract CVE details and score severity, enriching data with CISA KEV, CIRCL, and AlienVault OTX. Implement output parsing and hash-based diff checks to normalize data and remove duplicates. Send alerts to Slack, Gmail, and Google Sheets. First, run a dry run with 5 sample CVEs to verify scoring consistency and deduplication. Show me the output format and alert structure for human confirmation before connecting live webhooks. If Slack webhooks fail, fallback to email notifications. Do not publish or send real alerts until I approve the dry run results.
Source reports are not independently verified. Publication date is the catalog publication date, not the original article date.