Set up a CVE monitor with AI scoring and alerts

Use n8n to watch multiple vulnerability sources, score each CVE, and send near-real-time alerts to your team.

Done with n8n· Advanced

What they did
A developer built an n8n flow that checked CVE feeds from CISA, NIST, CERT-FR, and BleepingComputer. They used Bright Data nodes to collect the pages, then had a Cohere Command-R agent pull out the CVE details and assign a severity score with session memory. Enrichment came from CISA KEV, CIRCL, and AlienVault OTX, while parsing, normalization, and hash-based checks kept the same item from being counted twice.
How it went
The system was reported to process more than 100 CVEs per day and deliver alerts in under 5 minutes. The author also claimed 99.8% uptime, but said the Slack Ack/Investigate/Dismiss buttons were only a demo because the webhook was blocked, leaving the setup about 90% production-ready.
Tips
Lock down the model’s output format and parse it carefully, or the score can drift from run to run. Add deduping and retries early, and treat uptime and false-positive numbers as self-reported until you can measure them yourself.

Try it yourself with n8n

You are monitoring CVE feeds for [organization]. Pull new items from [sources], enrich them with [reference sources], and score each one for severity using [criteria]. Keep a memory of earlier items so you do not re-evaluate the same vulnerability differently. Before you send, delete, or submit anything, pause and ask me to approve that action. Return the results in a fixed structure with [fields], flag duplicates, and send alerts to [Slack/Gmail/Sheets] only after my approval.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on dev.to ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.