How to monitor new CVEs and get AI-scored alerts with n8n

Engineering & securityn8n

The problem

Security teams need to know quickly when a relevant vulnerability is published, without reading every advisory feed.

Tools needed

• n8n
• Bright Data (scraping)
• Cohere Command-R
• CISA KEV, CIRCL and AlienVault OTX (enrichment)
• Slack
• Gmail
• Google Sheets

Step-by-step recipe

1. Scrape sources such as CISA, NIST, CERT-FR and BleepingComputer on a schedule.
2. Have an AI agent extract CVE details and score severity, enriched with CISA KEV, CIRCL and AlienVault OTX data.
3. Parse and normalise the output so scores stay consistent.
4. Remove duplicates with hash-based diff checks.
5. Send alerts to Slack and Gmail and log them in Google Sheets, with retries when a source fails.

Copyable prompt

Extract vulnerability details from the advisory below. Return JSON only:
{"cve_id": "...", "product": "...", "vendor": "...", "cvss": number|null (only if stated), "exploited_in_wild": true|false|null, "summary": "one sentence", "relevance": "high|medium|low" for a stack using [YOUR STACK], "reason": "..."}
Do not compute a CVSS score yourself; use null if none is given.

Advisory: {{text}}

What the builder reported

The author reports handling 100+ CVEs a day with alerts in under 5 minutes and 99.8% uptime; these are the author's own, unverified claims. Interactive Slack buttons were only a demo, so they call it about 90% production-ready.

These are the source author's own claims. AgentRecipes has not tested or verified them.

Watch out for

• Without strict output constraints and parsing, the AI scored inconsistently.
• Prefer official feeds and APIs over scraping where they exist.

Source

More engineering & security recipes