Wazuh Vulnerability Prioritization n8n Workflow (EPSS & CISA KEV)

Prioritize Wazuh vulnerabilities with EPSS + CISA KEV in n8n—automatically

This n8n workflow pulls daily vulnerability findings from Wazuh Indexer, enriches each CVE with FIRST EPSS and the CISA Known Exploited Vulnerabilities (KEV) catalog, computes an explainable priority score, tracks the finding lifecycle in n8n Data Tables, and emails an executive security report.

What this workflow does

• Runs on a schedule or manually: executes daily at 07:00 UTC (or via manual trigger) and loads configuration such as Wazuh Indexer URL, scoring weights, thresholds, and email settings.
• Retrieves Wazuh vulnerability findings: queries the Wazuh vulnerability inventory via the Wazuh Indexer/OpenSearch API using Basic Auth, with paginated search-after to retrieve all results.
• Normalizes and deduplicates: converts results into a consistent finding record (including a stable finding key) and deduplicates CVEs into batches.
• Enriches with EPSS and KEV: fetches FIRST EPSS scores in batches, downloads the CISA KEV catalog once per run, and adds both contexts to each finding.
• Calculates an explainable priority score: prioritizes using CVSS context, EPSS probability, and whether the vulnerability is present in CISA KEV.
• Tracks lifecycle history in Data Tables: reads prior lifecycle state from wazuh_vulnerability_lifecycle, classifies findings (new/ongoing/reopened/resolved), and upserts updates.
• Audits and reports: logs run summary metrics to wazuh_vulnerability_runs and sends an HTML executive email highlighting key counts and the top prioritized findings.

Use cases

• SaaS operators needing a daily prioritized vulnerability digest from Wazuh for faster triage.
• Automation engineers building an EPSS + KEV-driven prioritization pipeline that stays explainable and auditable.
• Teams tracking vulnerability lifecycle changes (new, reopened, resolved) directly in n8n.

Technical details

• Scheduled automation: daily run at 07:00 UTC or manual trigger.
• Nodes/tech used: set, code, data table, http request, email send, sticky note.
• Data storage: requires n8n Data Tables named wazuh_vulnerability_lifecycle and wazuh_vulnerability_runs.
• External integrations: Wazuh Indexer/OpenSearch API (Basic Auth), FIRST EPSS API, and CISA KEV catalog.