See llms.txt for all machine-readable content.

Back to Templates

Analyze pentest reports and create remediation tickets with OpenAI and Slack

Created by

Created by: Oneclick AI Squad || oneclick-ai
Oneclick AI Squad

Last update

Last update a day ago

Categories

Share

Quick overview

This workflow receives a penetration test report via webhook, uses OpenAI to extract and normalize vulnerability findings, alerts Slack when critical issues are present, and creates severity-routed remediation tickets in an external ticketing system API before returning a JSON summary to the requester.

How it works

  1. Receives a POST request via webhook containing scan metadata and the raw penetration test report text.
  2. Uses OpenAI (via an AI Agent) to extract a structured JSON list of vulnerabilities from the report.
  3. Parses and validates the extracted JSON, normalizes severity (including optional CVSS-to-tier mapping), assigns IDs, and computes a report-level severity summary.
  4. If critical vulnerabilities exist, posts a Slack alert to the configured channel and pauses execution until a security lead resumes the workflow via a wait webhook.
  5. Builds one remediation ticket payload per finding with mapped priority, SLA hours, labels, and scan context.
  6. Routes each ticket by severity to set the target assignee team and urgency flags, then creates the ticket via an HTTP POST to your ticketing system API.
  7. Waits for a ticket sync confirmation via a second wait webhook and responds to the original webhook call with a JSON summary and the tickets created.

Setup

  1. Add an OpenAI credential for the OpenAI Chat Model used by the AI Agent.
  2. Add a Slack credential and ensure the target Slack channel (for example, #security-alerts) exists and is set in the workflow configuration.
  3. Add an HTTP Header Auth credential for your ticketing system and update the ticket API URL and project key used to create issues.
  4. Configure the two resume webhooks for triage approval and ticket sync confirmation in the systems that will call them (for example, a Slack button/action for triage and your ticketing system callback for creation confirmation).
  5. Send POST requests to the trigger webhook with scanId, targetSystem, reportFormat, reportText, and submittedBy fields to start the analysis.