Daily CISA KEV + EPSS Slack Digest with OpenAI (n8n Workflow)

Get a Daily CISA KEV + EPSS Analyst Digest in Slack (with OpenAI)

Stay ahead of actively exploited vulnerabilities: this n8n workflow checks the CISA Known Exploited Vulnerabilities (KEV) catalog every day, enriches matching CVEs with FIRST EPSS scores, generates a Slack-ready analyst digest using OpenAI, and posts the results directly to your chosen Slack channel.

What this workflow does

• Runs daily at 8 AM via an n8n schedule.
• Downloads the latest CISA KEV JSON catalog and filters for entries added within your configured lookback window and matching your specified vendors/products.
• De-duplicates by CVE ID so each vulnerability is only alerted once across executions.
• Queries the FIRST EPSS API for each remaining CVE to retrieve exploitation probability data.
• Calculates a priority (Critical/High/Medium) based on ransomware campaign use and configured EPSS thresholds, then sorts CVEs by priority and score.
• Uses OpenAI to transform structured CVE data into a Slack-formatted vulnerability digest, then posts it to Slack.

Use cases

• Security and engineering teams who need daily visibility into known exploited CVEs relevant to their SaaS stack.
• SaaS operators who want to triage vulnerabilities using KEV + EPSS signals, with automated summaries for faster action.
• Automation engineers building an n8n security monitoring workflow that delivers consistent alerts to Slack.

Technical details

• OpenAI Chat Model (requires an OpenAI API credential) to generate the Slack digest.
• Slack integration (“Post Digest to Slack” node) to deliver alerts to your selected channel.
• n8n nodes used: set, code, slack, aggregate, sticky note, and http request.

Setup (quick)

Add your OpenAI credential, add your Slack credential and target channel, update configuration values (e.g., techStack, lookbackDays, epssHighThreshold), run a test, then activate the workflow.