Attack Surface Change Monitoring with n8n, Postgres & OpenAI

Attack Surface Change Monitoring—Automated in n8n with Postgres & OpenAI

This scheduled n8n workflow continuously inventories your external attack surface from three HTTP APIs, diffs it against a Postgres baseline, and uses OpenAI to generate concise risk notes—then sends critical/high alerts to Slack and medium updates by email. When it detects unauthorized cloud footprint, it can also send compliance emails.

What this workflow does

• Runs every 6 hours via a schedule trigger to keep monitoring current.
• Collects and normalizes assets by querying three external HTTP API sources in parallel (e.g., subdomains, exposed services, and public cloud resources), then merges them into a deduplicated inventory with stable fingerprints.
• Diffs against a Postgres baseline by loading the previous inventory from Postgres and comparing it to the current run to identify new, changed, and removed assets.
• Scores and flags risk-relevant changes, including identifying new cloud resources outside allowed provider/region allowlists.
• Generates risk triage narratives with OpenAI (one to two sentences per change) and attaches them to each change record.
• Routes notifications by severity:
  • Critical/High: posts alerts to Slack
  • Medium: emails security recipients
  • Low/Removed: logs without notifying
• Updates the baseline by upserting the full current inventory into Postgres for the next diff.

Use cases

• SaaS security teams need automated attack surface monitoring without manual diffing across sources.
• Operators want quick new exposure detection with AI-generated triage notes and severity-based routing.
• Compliance-minded teams need unauthorized cloud footprint alerts with optional compliance emails.

Technical details

• n8n scheduled workflow (every 6 hours)
• HTTP Request nodes for three authenticated API sources (header-auth or equivalent)
• Postgres for storing and loading the baseline inventory (diff + upsert)
• OpenAI for generating concise risk triage narratives
• Notification routing via Slack and email
• Workflow logic uses nodes such as if, set, code, no op, and merge