{"product_id":"wazuh-vulnerability-prioritization-n8n-workflow-epss-cisa-kev","title":"Wazuh Vulnerability Prioritization n8n Workflow (EPSS \u0026 CISA KEV)","description":"\u003ch3\u003ePrioritize Wazuh vulnerabilities with EPSS + CISA KEV in n8n—automatically\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow pulls daily vulnerability findings from \u003cstrong\u003eWazuh Indexer\u003c\/strong\u003e, enriches each CVE with \u003cstrong\u003eFIRST EPSS\u003c\/strong\u003e and the \u003cstrong\u003eCISA Known Exploited Vulnerabilities (KEV)\u003c\/strong\u003e catalog, computes an explainable \u003cstrong\u003epriority score\u003c\/strong\u003e, tracks the finding lifecycle in n8n Data Tables, and emails an \u003cstrong\u003eexecutive security report\u003c\/strong\u003e.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns on a schedule or manually:\u003c\/strong\u003e executes daily at \u003cstrong\u003e07:00 UTC\u003c\/strong\u003e (or via manual trigger) and loads configuration such as Wazuh Indexer URL, scoring weights, thresholds, and email settings.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRetrieves Wazuh vulnerability findings:\u003c\/strong\u003e queries the Wazuh vulnerability inventory via the \u003cstrong\u003eWazuh Indexer\/OpenSearch API\u003c\/strong\u003e using \u003cstrong\u003eBasic Auth\u003c\/strong\u003e, with paginated \u003cstrong\u003esearch-after\u003c\/strong\u003e to retrieve all results.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eNormalizes and deduplicates:\u003c\/strong\u003e converts results into a consistent finding record (including a stable finding key) and deduplicates CVEs into batches.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eEnriches with EPSS and KEV:\u003c\/strong\u003e fetches \u003cstrong\u003eFIRST EPSS\u003c\/strong\u003e scores in batches, downloads the \u003cstrong\u003eCISA KEV\u003c\/strong\u003e catalog once per run, and adds both contexts to each finding.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCalculates an explainable priority score:\u003c\/strong\u003e prioritizes using CVSS context, \u003cstrong\u003eEPSS probability\u003c\/strong\u003e, and whether the vulnerability is present in \u003cstrong\u003eCISA KEV\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eTracks lifecycle history in Data Tables:\u003c\/strong\u003e reads prior lifecycle state from \u003ccode\u003ewazuh_vulnerability_lifecycle\u003c\/code\u003e, classifies findings (new\/ongoing\/reopened\/resolved), and upserts updates.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eAudits and reports:\u003c\/strong\u003e logs run summary metrics to \u003ccode\u003ewazuh_vulnerability_runs\u003c\/code\u003e and sends an \u003cstrong\u003eHTML executive email\u003c\/strong\u003e highlighting key counts and the top prioritized findings.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eSaaS operators needing a \u003cstrong\u003edaily prioritized vulnerability digest\u003c\/strong\u003e from Wazuh for faster triage.\u003c\/li\u003e\n  \u003cli\u003eAutomation engineers building an \u003cstrong\u003eEPSS + KEV-driven prioritization pipeline\u003c\/strong\u003e that stays explainable and auditable.\u003c\/li\u003e\n  \u003cli\u003eTeams tracking vulnerability \u003cstrong\u003elifecycle changes\u003c\/strong\u003e (new, reopened, resolved) directly in n8n.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eScheduled automation:\u003c\/strong\u003e daily run at 07:00 UTC or manual trigger.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eNodes\/tech used:\u003c\/strong\u003e set, code, data table, http request, email send, sticky note.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eData storage:\u003c\/strong\u003e requires n8n Data Tables named \u003ccode\u003ewazuh_vulnerability_lifecycle\u003c\/code\u003e and \u003ccode\u003ewazuh_vulnerability_runs\u003c\/code\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eExternal integrations:\u003c\/strong\u003e Wazuh Indexer\/OpenSearch API (Basic Auth), FIRST EPSS API, and CISA KEV catalog.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45758755340467,"sku":"N8N-17782","price":2.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/qpYOr_emVfqBXs7Ufjs3g_nZzpUhhe.png?v=1785834595","url":"https:\/\/buyflowscripts.com\/products\/wazuh-vulnerability-prioritization-n8n-workflow-epss-cisa-kev","provider":"N8N Commerce","version":"1.0","type":"link"}