Attack Surface Monitoring: OpenAI, Slack & Postgres (n8n)

Attack Surface Monitoring that alerts you to new risk—automatically

This n8n workflow runs every 6 hours to discover attack-surface assets from three HTTP APIs, compare them against a Postgres baseline, and use OpenAI to generate clear risk narratives. It then sends high/critical findings to Slack and medium updates via email, keeping your engineering and security teams informed as your footprint changes.

What this workflow does

• Scheduled inventory runs: Executes every 6 hours to keep monitoring continuous.
• Collects assets from three HTTP APIs: Enumerates subdomains, exposed services, and public cloud resources, then merges the results into a single inventory.
• Normalizes & deduplicates: Converts discovered items into a consistent schema, computes stable fingerprints, and removes duplicates.
• Diffs against a Postgres baseline: Loads the previous state from Postgres, identifies new, changed, and removed assets.
• Severity classification + OpenAI narrative: Classifies changes by severity (including out-of-policy cloud provider/region) and uses OpenAI to produce short risk narratives for the team.
• Routes alerts by impact: Sends critical/high changes to Slack, medium changes by email, and logs low/removed changes without alerting.
• Compliance email for unauthorized cloud footprint: Triggers an additional compliance email when an unauthorized cloud footprint is detected.
• Updates baseline: Upserts the full current inventory into Postgres so the next run compares against the latest known state.

Use cases

• SaaS security monitoring for unexpected new subdomains, services, or cloud resources
• Tracking configuration drift (changed assets) against a known-good baseline in Postgres
• Reducing alert fatigue by only messaging Slack/email for critical/high and medium events
• Compliance-oriented notification when cloud footprint appears outside approved regions/providers

Technical details

• Integrations: OpenAI, Slack, Postgres
• Discovery inputs: three HTTP APIs using header authentication (or equivalent), configurable API URLs and root domain list
• Workflow nodes/logic: if, set, code, no op, merge, Slack (plus baseline comparison and upsert behavior per configuration)