Auto CVE & IOC Feed Ingestor with OpenAI Risk Triage & Email Alerts

This n8n workflow is designed for cybersecurity teams to automate the collection and analysis of threat intelligence. It pulls data from public CVE (Common Vulnerabilities and Exposures) and IOC (Indicators of Compromise) feeds, merges the datasets, and uses OpenAI's AI capabilities to evaluate risk severity, recommend responses, and classify threats based on playbook logic. High-risk items trigger email notifications via Gmail, while all data is logged to Google Sheets for auditing and further analysis. Modular no-code nodes ensure easy customization and scalability.

Key benefits include significant time savings for SOC analysts by automating manual feed monitoring and initial triage, reducing alert fatigue through intelligent prioritization, and enabling proactive defense without coding expertise. The workflow supports compliance with standards like ACSC E8 and ISM through structured logging and alerting.

Ideal use cases: Blue teams in SMEs, cybersecurity students practicing automation, SOC operations for daily threat intake, and defenders integrating no-code tools into existing stacks. Trigger via Cron for daily runs or Webhook for on-demand execution.

Setup is straightforward: configure OpenAI API key, Gmail credentials, Google Sheets access, and optional scheduler. Requires internet connectivity and basic n8n knowledge.