N8N Webhook Workflow: Software Risk Report with NVD, EPSS & Claude

Automatically generate a software risk report from a webhook—using NVD, EPSS, CISA KEV signals, and Claude

This n8n workflow receives a software vetting request via webhook, gathers vulnerability and supply-chain evidence from public sources like NVD, EPSS, CISA KEV, and more, then uses Anthropic Claude to draft a structured Markdown risk report—sent by email and logged for tracking.

What this workflow does

• Receives and normalizes intake: Accepts a POST webhook request containing software/vendor details, normalizes fields into a tracking record, and assigns initial risk flags and a tier label.
• Acknowledges immediately: Returns a JSON response with a tracking ID and the intake risk tier.
• Finds vulnerability evidence in NVD: Searches the NVD CVE API using keyword-matched CVEs for the product, extracts the highest-signal CVE details, and—when CVEs exist—retrieves EPSS probabilities for those CVEs.
• Checks CISA Known Exploited Vulnerabilities: Queries NVD again using the hasKev filter to identify matching CVEs that appear in the CISA KEV catalog.
• Collects external context: Pulls breach-related items from Google News RSS and searches SEC EDGAR for vendor cybersecurity disclosures.
• Enhances signals with GitHub and open-source feeds: If a GitHub repository is provided, fetches GitHub metadata and OpenSSF Scorecard results. If an OSS package is provided, queries OSV and deps.dev for vulnerability and version signals.
• Drafts, formats, and delivers the report: Compiles evidence into a weighted risk score, sends the evidence package to Anthropic Claude to generate a Markdown assessment, formats an HTML report, emails it via Microsoft Outlook, and logs results in an n8n Data Table.

Use cases

• Security teams and SaaS operators need rapid third-party software risk triage from an automated intake form.
• Automation engineers want a webhook-driven workflow that produces defensible evidence using NVD, EPSS, and CISA KEV.
• Vendor vetting processes can be documented and tracked with consistent reporting and audit-ready history.

Technical details

• n8n nodes / building blocks: webhook, if, code, merge, data table, sticky note.
• External data sources: NVD CVE API, EPSS (for discovered CVEs), NVD hasKev (CISA KEV), Google News RSS, SEC EDGAR, GitHub metadata, OpenSSF Scorecard, OSV, deps.dev.
• LLM & delivery: Anthropic Claude for Markdown risk assessment; HTML report formatting; email via Microsoft Outlook; results logged in an n8n Data Table.