The following high-risk CVEs were identified:
\n{{ JSON.stringify($json.expert, null, 2) }}\n","options":{},"subject":"π¨ CyberPulse Alert β Critical Vulnerabilities Detected","toEmail":"security-team@example.com","fromEmail":"security-team@example.com"},"credentials":{"smtp":{"id":"RM0pJJ95IhrbFLCv","name":"SMTP account"}},"typeVersion":2.1},{"id":"bead2d6d-aeec-49a3-99b0-6550976cfa91","name":"Google Sheets","type":"n8n-nodes-base.googleSheets","position":[420,300],"parameters":{"columns":{"value":{"IOCs":"={{ JSON.stringify($(\"π¨ ALERT β LEV Trigger\").item.json.expert[0].iocs) }}","Score":"={{ $json.expert[0].cve.cve.impact.baseMetricV3.cvssV3.baseScore }}","CVE_ID":"={{ $(\"π¨ ALERT β LEV Trigger\").item.json.expert[0].cve.cve.CVE_data_meta.ID }}","Severity":"={{ $json.expert[0].cve.cve.impact.baseMetricV3.cvssV3.baseSeverity }}","LEV_label":"={{ $json.expert[0].levLabel }}","LEV_score":"={{ $json.expert[0].levScore }}","timestamp":"={{ new Date().toISOString() }}","aiRisk_score":"={{ $json.expert[0].aiRisk }}","compliance_tags":"\"{{ 'ISM-0412, E8-6' }}\"","response_action":"={{ $json.expert[0].levLabel.toLowerCase() }}"},"schema":[{"id":"timestamp","type":"string","display":true,"removed":false,"required":false,"displayName":"timestamp","defaultMatch":false,"canBeUsedToMatch":true},{"id":"CVE_ID","type":"string","display":true,"removed":false,"required":false,"displayName":"CVE_ID","defaultMatch":false,"canBeUsedToMatch":true},{"id":"Severity","type":"string","display":true,"removed":false,"required":false,"displayName":"Severity","defaultMatch":false,"canBeUsedToMatch":true},{"id":"Score","type":"string","display":true,"removed":false,"required":false,"displayName":"Score","defaultMatch":false,"canBeUsedToMatch":true},{"id":"IOCs","type":"string","display":true,"removed":false,"required":false,"displayName":"IOCs","defaultMatch":false,"canBeUsedToMatch":true},{"id":"aiRisk_score","type":"string","display":true,"removed":false,"required":false,"displayName":"aiRisk_score","defaultMatch":false,"canBeUsedToMatch":true},{"id":"LEV_score","type":"string","display":true,"removed":false,"required":false,"displayName":"LEV_score","defaultMatch":false,"canBeUsedToMatch":true},{"id":"LEV_label","type":"string","display":true,"removed":false,"required":false,"displayName":"LEV_label","defaultMatch":false,"canBeUsedToMatch":true},{"id":"response_action","type":"string","display":true,"removed":false,"required":false,"displayName":"response_action","defaultMatch":false,"canBeUsedToMatch":true},{"id":"compliance_tags","type":"string","display":true,"removed":false,"required":false,"displayName":"compliance_tags","defaultMatch":false,"canBeUsedToMatch":true}],"mappingMode":"defineBelow","matchingColumns":[],"attemptToConvertTypes":false,"convertFieldsToString":false},"options":{},"operation":"append","sheetName":{"__rl":true,"mode":"list","value":"gid=0","cachedResultUrl":"https://docs.google.com/spreadsheets/d/1LeES3AaZG1AZHFd4g2FMgZx790AP_9Qd1OsIE774R-M/edit#gid=0","cachedResultName":"Sheet1"},"documentId":{"__rl":true,"mode":"id","value":"={{ $env.SHEET_ID }}"}},"credentials":{"googleSheetsOAuth2Api":{"id":"sJHywbRNYHkS71FB","name":"Google Sheets account"}},"typeVersion":4.5},{"id":"6be8438a-956d-4ac6-94e5-dc22cebaa178","name":"π§ AI β Incident Playbook Selector","type":"n8n-nodes-base.code","position":[660,-180],"parameters":{"jsCode":"const threat = $json;\nconst score = threat.Score || 0;\nconst severity = (threat.Severity || \"\").toUpperCase();\n\nlet playbook = \"notify\"; // Default response\n\nif (score >= 9 || severity === \"CRITICAL\") {\n playbook = \"isolation\";\n} else if (score >= 6 || severity === \"HIGH\") {\n playbook = \"monitor\";\n}\n\nreturn [\n {\n json: {\n ...threat,\n response: {\n playbook: playbook,\n decisionReason: `Based on CVSS ${score} and severity ${severity}`\n }\n }\n }\n];\n"},"typeVersion":2},{"id":"2aa9749e-cf1d-49ee-8a82-b75a6a62d1af","name":"Code","type":"n8n-nodes-base.code","position":[840,-180],"parameters":{"jsCode":"const threat = $json;\nconst score = threat.Score || 0;\nconst severity = (threat.Severity || \"\").toUpperCase();\n\nlet playbook = \"notify\"; // Default fallback\n\nif (score >= 9 || severity === \"CRITICAL\") {\n playbook = \"isolation\";\n} else if (score >= 6 || severity === \"HIGH\") {\n playbook = \"monitor\";\n}\n\nreturn [\n {\n json: {\n ...threat,\n response: {\n playbook,\n decisionReason: `Based on CVSS ${score} and severity ${severity}`\n }\n }\n }\n];"},"typeVersion":2},{"id":"6dd8f1cf-4459-4496-b547-205da0aa2ab7","name":"π§ Response Router","type":"n8n-nodes-base.switch","position":[1020,-180],"parameters":{"rules":{"values":[{"outputKey":"notify","conditions":{"options":{"version":2,"leftValue":"","caseSensitive":false,"typeValidation":"strict"},"combinator":"and","conditions":[{"id":"04b84cf7-971d-4f6e-a4c3-4609afd67140","operator":{"type":"string","operation":"equals"},"leftValue":"={{ $json.response.playbook }}","rightValue":"notify"}]},"renameOutput":true},{"outputKey":"monitor","conditions":{"options":{"version":2,"leftValue":"","caseSensitive":false,"typeValidation":"strict"},"combinator":"and","conditions":[{"id":"402dbac5-1a9e-4862-a281-7dfd42cf2729","operator":{"name":"filter.operator.equals","type":"string","operation":"equals"},"leftValue":"={{ $json.response.playbook }}","rightValue":" monitor"}]},"renameOutput":true},{"outputKey":"islolation","conditions":{"options":{"version":2,"leftValue":"","caseSensitive":false,"typeValidation":"strict"},"combinator":"and","conditions":[{"id":"b0100303-40c4-409e-8f95-b9cab699eedd","operator":{"name":"filter.operator.equals","type":"string","operation":"equals"},"leftValue":"={{ $json.response.playbook }}","rightValue":"isolation"}]},"renameOutput":true}]},"options":{"ignoreCase":true}},"typeVersion":3.2},{"id":"4123923e-bbbd-4234-8769-43dcd65cf9c8","name":"Send Alert Email","type":"n8n-nodes-base.emailSend","position":[1340,-360],"webhookId":"decb9f47-14ee-49f7-9317-2d52a39f97bd","parameters":{"html":"=\n\n\n \n\n\n\nπ° Summary: {{ $json.cve.description.description_data[0].value }}
\nπ Severity: \n \n {{ $json.cve.impact.baseMetricV3.cvssV3.baseSeverity }}\n \n
\nπ CVSS Score: {{ $json.cve.impact.baseMetricV3.cvssV3.baseScore }}
\n| Type | Value |
|---|---|
| ${ioc.type} | ${ioc.value} |
\n
\n π Aligned with ACSC Essential Eight & ISM 2024 (Australia), and structured using the NIST Cybersecurity Framework and ISO/IEC 27001 principles.
\n Designed for SMEs and security teams worldwide.\n
\n This alert was automatically generated by CYBERPULSEBlueOps using n8n.\n
\n","options":{},"subject":"=π¨ Cyber Alert: {{ $json.response.playbook.toUpperCase() }} Required","toEmail":"security-team@example.com","fromEmail":"security-team@example.com"},"credentials":{"smtp":{"id":"RM0pJJ95IhrbFLCv","name":"SMTP account"}},"typeVersion":2.1},{"id":"d76f1894-ae5c-4c22-b326-7daec1cdf359","name":"Log to Google Sheet","type":"n8n-nodes-base.googleSheets","position":[1340,-180],"parameters":{"operation":"append","sheetName":{"__rl":true,"mode":"list","value":"","cachedResultUrl":"","cachedResultName":""},"documentId":{"__rl":true,"mode":"id","value":"={{ $env.SHEET_ID }}"}},"credentials":{"googleSheetsOAuth2Api":{"id":"sJHywbRNYHkS71FB","name":"Google Sheets account"}},"typeVersion":4.5},{"id":"9d9a56b4-13fd-40f8-a29a-4d3a3febfc19","name":"HTTP Request","type":"n8n-nodes-base.httpRequest","position":[1340,0],"parameters":{"url":"https://edr-api.example.com/isolate","method":"POST","options":{},"jsonBody":"={\n \"device_ip\": \"{{ $json.iocs[0].value }}\",\n \"cve_id\": \"{{ $json.cve.cve.CVE_data_meta.ID }}\",\n \"severity\": \"{{ $json.cve.cve.impact.baseMetricV3.cvssV3.baseSeverity }}\"\n}\n","sendBody":true,"sendHeaders":true,"specifyBody":"json","headerParameters":{"parameters":[{"name":"Authorization"},{"name":"Content-Type","value":"application/json"}]}},"typeVersion":4.2},{"id":"d5376f73-da94-4a39-9129-7f94c9b6d86c","name":"Split Out","type":"n8n-nodes-base.splitOut","position":[500,-180],"parameters":{"include":"allOtherFields","options":{},"fieldToSplitOut":"iocs"},"typeVersion":1},{"id":"da91b5b0-a2ff-4d91-9837-eafdb1aa7ed4","name":"Sticky Note","type":"n8n-nodes-base.stickyNote","position":[1600,-380],"parameters":{"color":7,"width":560,"height":1160,"content":"\nπ‘οΈ CYBERPULSEBlueOps β Module 1: Threat Feed Ingestion\n\nVersion: 1.0\nLast Updated: 2025-06-04\nAuthor: Adnan Tariq\nStatus: β Production-Ready\n\nπ Purpose\n\nAutomates daily ingestion of CVE and IOC threat feeds, enriches and evaluates risks using AI-based triage, and routes alerts to notification, isolation, or monitoring actions. Structured to align with compliance frameworks and operational defense workflows.\n\nπ Data Sources\n\nCVE Feed: GitHub Gist (cve_data)\n\nIOC Feed: GitHub Gist (ioc_data)\n\nIngest frequency: Daily via Cron Trigger\n\nπ§ Key Components\n\nAI β Risk Evaluation for aiRisk scoring\n\nAI β Triage Vulnerabilities for LEV scoring & labels\n\nπ Response Router assigns notify, monitor, or isolate\n\nLogs exported to Google Sheets with:\n\nCVE_ID, Severity, Score, IOCs\n\naiRisk_score, LEV_score, LEV_label, response_action\n\nCompliance tags: ISM-0412, E8-6\n\nβ Compliance Alignment\n\n ACSC Essential Eight (Australia)\n\n ISM 2024 Logging Guidelines\n\n NIST Cybersecurity Framework\n\n ISO/IEC 27001 Control Mapping\n\nβοΈ Output\n\nHTML emails with risk-based alert summaries\n\nGoogle Sheets row logs\n\n(Optional) HTTP isolation request via EDR API\n\nβ οΈ Do not modify node structure without understanding data propagation and rule routing. All logic assumes LEV triage is the decision root."},"typeVersion":1},{"id":"1bae77e9-6f51-4a51-85d6-051ad1198030","name":"Sticky Note1","type":"n8n-nodes-base.stickyNote","position":[2180,-380],"parameters":{"color":7,"width":1080,"height":680,"content":"\nπ§ What is Module 1?\nModule 1 is like a security robot that wakes up every morning, reads danger news from the internet (called CVEs and IOCs), checks how risky it is, and then tells the grown-ups what to do.\n\nπ§Ύ Why are there 2 Google Sheet blocks?\n1οΈβ£ First Google Sheet:\nβ‘οΈ It writes down big dangerous alerts that need attention (like βCritical Virus Found!β).\nThis is like a red alert notebook.\n\n2οΈβ£ Second Google Sheet:\nβ‘οΈ It writes down everything it finds, even small stuff, in a daily logbook.\nThis is the diary of what the robot saw today.\n\nβοΈ Why are there 2 Email Alerts?\n1οΈβ£ First Email:\nπ¨ Sends a special alert when something very risky happens (like an emergency siren).\nExample: \"This computer might be in big trouble!\"\n\n2οΈβ£ Second Email:\nπ¨ Sends a daily summary email with a table.\nExample: βToday I saw: 1 Critical, 1 Medium, 1 Low.β\n\nπ Why is there 1 HTTP Request?\nπ This is the robotβs panic button.\nIf the robot says, βThis is too dangerous,β it can call another robot (like an EDR system) to shut down or isolate the infected computer.\n\nBut this button is optional β like only calling the fire truck when needed.\n\nπ‘ In Short:\nπ§Ύ Two sheets: one for alerts, one for daily diary\n\nβοΈ Two emails: one for emergency, one for daily summary\n\nπ One optional panic button: for calling help if danger is too high"},"typeVersion":1},{"id":"0a7a9166-b06d-4a48-9420-70af07392046","name":"Sticky Note2","type":"n8n-nodes-base.stickyNote","position":[2180,320],"parameters":{"color":7,"width":580,"height":180,"content":"\nπ Module 1 Glossary β What Each Term Means\n\nβ’ **aiRisk** β AI-generated risk score (e.g. 6.5) based on CVE severity + behavior \nβ’ **LEV Score** β Local Exploitability score (e.g. 0.93) β how likely it affects *you* \nβ’ **LEV Label** β Text label from LEV score (e.g. `notify`, `monitor`, `isolate`) \nβ’ **response_action** β What the system decided to do (e.g. alert, log, isolate) \nβ’ **IOC** β Indicator of Compromise like a suspicious IP, domain, or file hash \nβ’ **CVE** β Known vulnerability from public sources (e.g. CVE-2023-26479)\n"},"typeVersion":1},{"id":"c3323b86-bb2b-4d62-9dcc-2509a1a6b893","name":"Sticky Note3","type":"n8n-nodes-base.stickyNote","position":[2180,520],"parameters":{"color":7,"width":580,"height":480,"content":"\nπ‘οΈ Framework Integration Summary β Module 1\n\nACSC Essential Eight (Australia)\nβ Implements daily threat monitoring and log collection, aligning with mitigation strategies like patching and application control.\n\nISM 2024 Logging Guidelines (Australia)\nβ Logs high-risk CVEs, IOCs, and AI-evaluated actions to structured, queryable formats (Google Sheets, Emails).\nβ Includes severity, timestamps, and response decisions β meets ISM log detail requirements.\n\nNIST Cybersecurity Framework (CSF) (US)\nβ Aligns with:\n\nIdentify (tracking known CVEs),\n\nDetect (via AI risk analysis),\n\nRespond (action routing via LEV logic).\n\nISO/IEC 27001\nβ Supports control A.12.4 (Event logging) and A.16 (Incident response) by providing automated alerts, logs, and response recommendations."},"typeVersion":1}],"active":false,"pinData":{},"settings":{"timezone":"Australia/Sydney","callerPolicy":"workflowsFromSameOwner","executionOrder":"v1"},"versionId":"b9d78a57-e42a-4b2a-92d4-30a29f06178a","connections":{"Code":{"main":[[{"node":"π§ Response Router","type":"main","index":0}]]},"Split Out":{"main":[[{"node":"π§ AI β Incident Playbook Selector","type":"main","index":0}]]},"Send Alert Email":{"main":[[]]},"π Get CVE Feed":{"main":[[{"node":"π§ Merge Threat Data","type":"main","index":0}]]},"π‘οΈ Get IOC Feed":{"main":[[{"node":"π§ Merge Threat Data","type":"main","index":1}]]},"π§ Response Router":{"main":[[{"node":"Send Alert Email","type":"main","index":0}],[{"node":"Log to Google Sheet","type":"main","index":0}],[{"node":"HTTP Request","type":"main","index":0}]]},"π§ Send Alert Email":{"main":[[]]},"π§ Merge Threat Data":{"main":[[{"node":"π§ Combine Threat Data","type":"main","index":0}]]},"π§ Combine Threat Data":{"main":[[{"node":"π§ AI β Risk Evaluation","type":"main","index":0}]]},"β° Cron β Daily Trigger":{"main":[[{"node":"π Get CVE Feed","type":"main","index":0},{"node":"π‘οΈ Get IOC Feed","type":"main","index":0}]]},"π¨ ALERT β LEV Trigger":{"main":[[{"node":"π§ Send Alert Email","type":"main","index":0},{"node":"Google Sheets","type":"main","index":0}]]},"π§ AI β Risk Evaluation":{"main":[[{"node":"π§ AI β Triage Vulnerabilities","type":"main","index":0},{"node":"Split Out","type":"main","index":0}]]},"π§ AI β Triage Vulnerabilities":{"main":[[{"node":"π¨ ALERT β LEV Trigger","type":"main","index":0}]]},"π§ AI β Incident Playbook Selector":{"main":[[{"node":"Code","type":"main","index":0}]]}}}