Triage security vulnerability alerts with NVD, Gemini, Supabase, and Jira

Quick Overview

This workflow receives vulnerability alerts via webhook, deduplicates repeated events with Redis, enriches CVE details from the NVD API and asset context from Supabase, uses Google Gemini to triage risk with structured output, and creates the appropriate Jira issue before responding to the caller.

How it works

1. Receives a POST webhook request for a vulnerability alert using header-based authentication.
2. Validates that the payload contains a properly formatted CVE ID and a non-empty IP address, and immediately returns an error response if invalid.
3. Increments a Redis counter keyed by CVE ID and IP address to detect duplicates, and immediately returns a duplicate response if the alert was already seen.
4. Fetches CVE details from the NVD REST API and looks up the target asset in a Supabase table using the provided IP address.
5. Sends the combined vulnerability and CMDB context to a Google Gemini-powered agent that returns a structured JSON risk score, action, and reasoning.
6. Creates a Jira issue for either emergency remediation (auto-patch) or manual review (ticket_only/unclear) and responds to the original webhook request.

Setup

1. Create an n8n Header Auth credential and configure the sending system to include the shared secret header when calling the webhook URL.
2. Add Redis credentials and ensure your Redis instance can store the deduplication keys (optionally add a TTL/eviction policy for the secops-dedup:* keyspace).
3. Ensure the NVD API endpoint is reachable from your n8n instance (and add an API key or request headers if your usage requires it).
4. Add Supabase credentials and confirm your cmdb_assets table includes an ip_address field that matches incoming alerts.
5. Add Google Gemini (PaLM) API credentials for the Gemini chat model used by the risk analyst agent.
6. Add Jira Software Cloud credentials and update the target project and issue types (Bug/Task) to match your Jira configuration.