Automated Vulnerability Data Extraction and Incident Creation

This n8n workflow automates the process of extracting vulnerability information from various sources, analyzing it, and creating incident reports in ServiceNow. It is designed to streamline vulnerability management by integrating multiple tools and APIs into a seamless automated pipeline.

The workflow begins with a Schedule Trigger that initiates the process at a specified time each day. Once triggered, it fetches vulnerability data from a remote source via an HTTP request to the Jina API, which retrieves CVE details from the NVD (National Vulnerability Database). The data fetched is then processed through an Information Extractor node, which uses an OpenAI-powered language model to analyze and extract relevant vulnerability details such as publication dates, severity levels, CVE IDs, descriptions, and related CPE (Common Platform Enumeration) strings.

Following the extraction, the data is split into individual items using a Split Out node, preparing each vulnerability record for further processing. Each record is then used to create a new incident in ServiceNow, with details populated dynamically from the extracted data. The incident includes key information such as severity, CVE ID, publication dates, description, and matching CPE strings.

This workflow is particularly useful for security teams aiming to automate the identification, analysis, and documentation of vulnerabilities, ensuring timely incident creation for further investigation or mitigation. It helps organizations stay proactive in their vulnerability management efforts by continuously integrating external data sources with their internal incident response system.