CVE Triage Webhook Workflow: NVD, Gemini, Supabase & Jira

Auto-triage CVE alerts into the right Jira action—powered by NVD, Gemini, Supabase & Redis

This n8n CVE Triage Webhook Workflow receives vulnerability alerts via webhook, enriches them with NVD and Supabase asset context, uses Google Gemini for structured risk triage, deduplicates repeated events with Redis, and then automatically creates the appropriate Jira issue before responding to the caller.

What this workflow does

• Accepts webhook alerts via a POST request using header-based authentication.
• Validates the payload: checks for a properly formatted CVE ID and a non-empty `IP address`. If invalid, it immediately returns an error response.
• Deduplicates alerts: increments a Redis counter keyed by CVE ID + IP address and returns a duplicate response if the event was already seen.
• Enriches CVE data by fetching details from the NVD REST API.
• Looks up affected asset context in Supabase using the provided IP address.
• Triages with Gemini: sends combined vulnerability + CMDB context to a Google Gemini-powered agent that returns structured JSON including a risk score, action, and reasoning.
• Creates the right Jira issue for either emergency remediation (auto-patch) or manual review (ticket_only/unclear), then responds to the webhook request.

Use cases

• SecOps teams that want real-time CVE triage from scanner alerts to Jira tickets.
• SaaS operators linking IP-based asset context from Supabase/CMDB to vulnerability decisions.
• Organizations needing safe deduplication to prevent ticket spam for the same CVE/IP combination.

Technical details

• n8n nodes: webhook, if, set, redis, switch, jira.
• Integrations: NVD REST API for CVE enrichment, Google Gemini for structured triage output, Supabase for asset lookup, Jira for issue creation.
• Redis keyspace: `secops-dedup:*` (optionally configure TTL/eviction).