Automated Threat Intelligence & Incident Handling Workflow

This n8n workflow automates the collection, analysis, and response to cybersecurity threats, providing a comprehensive threat intelligence and incident management solution. It is triggered daily using a schedule trigger to fetch vulnerability data (CVE feed) and IOC (Indicators of Compromise) feed via HTTP requests. The collected threat data is merged and processed with custom code and AI-based modules for risk evaluation and vulnerability triage. Based on the analysis, the workflow triggers specific alerts, logs incidents to Google Sheets, and sends email notifications. Additionally, it includes an incident playbook selector and response routing to guide appropriate response actions, making it ideal for security teams looking to automate threat detection and incident response.