Adnan Tariq This workflow corresponds to n8n.io template #6356 — we link there as the canonical source.
This workflow follows the Emailsend → Google Sheets recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"id": "FOKoHtdHL2JKFwpH",
"meta": {
"templateCredsSetupCompleted": true
},
"name": "CYBERPULSEBlueOps_Module1 client copy1",
"tags": [
{
"id": "0obxZlT9bSaIMBpV",
"name": "Threat Intake",
"createdAt": "2025-05-23T06:15:09.978Z",
"updatedAt": "2025-05-23T06:15:09.978Z"
},
{
"id": "2rUQt7xpJikyzCUP",
"name": "(ACSC E8 + ISM-Aligned)",
"createdAt": "2025-06-04T06:23:02.488Z",
"updatedAt": "2025-06-04T06:23:02.488Z"
}
],
"nodes": [
{
"id": "b9325536-f714-437d-8dc3-2dfbfd6d58a7",
"name": "\u23f0 Cron \u2013 Daily Trigger",
"type": "n8n-nodes-base.scheduleTrigger",
"position": [
-220,
-560
],
"parameters": {},
"typeVersion": 1.2
},
{
"id": "c9f242d6-6d9c-4a27-8a43-b678c4b3dbeb",
"name": "\ud83c\udf10 Get CVE Feed",
"type": "n8n-nodes-base.httpRequest",
"position": [
20,
-640
],
"parameters": {},
"typeVersion": 4.2
},
{
"id": "e1f9ea1c-e934-4ecd-957d-8c7e5f8c1452",
"name": "\ud83d\udee1\ufe0f Get IOC Feed",
"type": "n8n-nodes-base.httpRequest",
"position": [
20,
-480
],
"parameters": {},
"typeVersion": 4.2
},
{
"id": "080ac947-b10c-4492-8f55-79e27b9982c0",
"name": "\ud83e\udde0 Merge Threat Data",
"type": "n8n-nodes-base.merge",
"position": [
220,
-560
],
"parameters": {},
"typeVersion": 3.1
},
{
"id": "80c5acb7-743a-44d7-8482-a5d429a973bd",
"name": "\ud83e\udde0Combine Threat Data",
"type": "n8n-nodes-base.code",
"position": [
220,
-360
],
"parameters": {},
"typeVersion": 2
},
{
"id": "68ccba75-0a92-4cd1-8306-24daafe59333",
"name": "\ud83e\udde0 AI \u2013 Risk Evaluation",
"type": "n8n-nodes-base.code",
"position": [
220,
-180
],
"parameters": {},
"typeVersion": 2
},
{
"id": "9f74ff1c-57ae-48ae-989d-b27b64895c53",
"name": "\ud83e\udde0 AI \u2013 Triage Vulnerabilities",
"type": "n8n-nodes-base.code",
"position": [
220,
0
],
"parameters": {},
"typeVersion": 2
},
{
"id": "3cbac00e-3bf1-4f68-99e2-e2027d3d2648",
"name": "\ud83d\udea8 ALERT \u2013 LEV Trigger",
"type": "n8n-nodes-base.if",
"position": [
220,
200
],
"parameters": {},
"typeVersion": 2.2
},
{
"id": "2341d7f3-4f5e-4bf0-8b96-fb64c4d46344",
"name": "\ud83d\udce7 Send Alert Email",
"type": "n8n-nodes-base.emailSend",
"position": [
420,
140
],
"parameters": {},
"typeVersion": 2.1
},
{
"id": "bead2d6d-aeec-49a3-99b0-6550976cfa91",
"name": "Google Sheets",
"type": "n8n-nodes-base.googleSheets",
"position": [
420,
300
],
"parameters": {},
"typeVersion": 4.5
},
{
"id": "6be8438a-956d-4ac6-94e5-dc22cebaa178",
"name": "\ud83e\udde0 AI \u2013 Incident Playbook Selector",
"type": "n8n-nodes-base.code",
"position": [
660,
-180
],
"parameters": {},
"typeVersion": 2
},
{
"id": "2aa9749e-cf1d-49ee-8a82-b75a6a62d1af",
"name": "Code",
"type": "n8n-nodes-base.code",
"position": [
840,
-180
],
"parameters": {},
"typeVersion": 2
},
{
"id": "6dd8f1cf-4459-4496-b547-205da0aa2ab7",
"name": "\ud83e\udded Response Router",
"type": "n8n-nodes-base.switch",
"position": [
1020,
-180
],
"parameters": {},
"typeVersion": 3.2
},
{
"id": "4123923e-bbbd-4234-8769-43dcd65cf9c8",
"name": "Send Alert Email",
"type": "n8n-nodes-base.emailSend",
"position": [
1340,
-360
],
"parameters": {},
"typeVersion": 2.1
},
{
"id": "d76f1894-ae5c-4c22-b326-7daec1cdf359",
"name": "Log to Google Sheet",
"type": "n8n-nodes-base.googleSheets",
"position": [
1340,
-180
],
"parameters": {},
"typeVersion": 4.5
},
{
"id": "9d9a56b4-13fd-40f8-a29a-4d3a3febfc19",
"name": "HTTP Request",
"type": "n8n-nodes-base.httpRequest",
"position": [
1340,
0
],
"parameters": {},
"typeVersion": 4.2
},
{
"id": "d5376f73-da94-4a39-9129-7f94c9b6d86c",
"name": "Split Out",
"type": "n8n-nodes-base.splitOut",
"position": [
500,
-180
],
"parameters": {},
"typeVersion": 1
},
{
"id": "da91b5b0-a2ff-4d91-9837-eafdb1aa7ed4",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
1600,
-380
],
"parameters": {
"content": ""
},
"typeVersion": 1
},
{
"id": "1bae77e9-6f51-4a51-85d6-051ad1198030",
"name": "Sticky Note1",
"type": "n8n-nodes-base.stickyNote",
"position": [
2180,
-380
],
"parameters": {
"content": ""
},
"typeVersion": 1
},
{
"id": "0a7a9166-b06d-4a48-9420-70af07392046",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
2180,
320
],
"parameters": {
"content": ""
},
"typeVersion": 1
},
{
"id": "c3323b86-bb2b-4d62-9dcc-2509a1a6b893",
"name": "Sticky Note3",
"type": "n8n-nodes-base.stickyNote",
"position": [
2180,
520
],
"parameters": {
"content": ""
},
"typeVersion": 1
}
],
"active": false,
"settings": {
"timezone": "Australia/Sydney",
"callerPolicy": "workflowsFromSameOwner",
"executionOrder": "v1"
},
"versionId": "b9d78a57-e42a-4b2a-92d4-30a29f06178a",
"connections": {
"Code": {
"main": [
[
{
"node": "\ud83e\udded Response Router",
"type": "main",
"index": 0
}
]
]
},
"Split Out": {
"main": [
[
{
"node": "\ud83e\udde0 AI \u2013 Incident Playbook Selector",
"type": "main",
"index": 0
}
]
]
},
"Send Alert Email": {
"main": [
[]
]
},
"\ud83c\udf10 Get CVE Feed": {
"main": [
[
{
"node": "\ud83e\udde0 Merge Threat Data",
"type": "main",
"index": 0
}
]
]
},
"\ud83d\udee1\ufe0f Get IOC Feed": {
"main": [
[
{
"node": "\ud83e\udde0 Merge Threat Data",
"type": "main",
"index": 1
}
]
]
},
"\ud83e\udded Response Router": {
"main": [
[
{
"node": "Send Alert Email",
"type": "main",
"index": 0
}
],
[
{
"node": "Log to Google Sheet",
"type": "main",
"index": 0
}
],
[
{
"node": "HTTP Request",
"type": "main",
"index": 0
}
]
]
},
"\ud83d\udce7 Send Alert Email": {
"main": [
[]
]
},
"\ud83e\udde0 Merge Threat Data": {
"main": [
[
{
"node": "\ud83e\udde0Combine Threat Data",
"type": "main",
"index": 0
}
]
]
},
"\ud83e\udde0Combine Threat Data": {
"main": [
[
{
"node": "\ud83e\udde0 AI \u2013 Risk Evaluation",
"type": "main",
"index": 0
}
]
]
},
"\u23f0 Cron \u2013 Daily Trigger": {
"main": [
[
{
"node": "\ud83c\udf10 Get CVE Feed",
"type": "main",
"index": 0
},
{
"node": "\ud83d\udee1\ufe0f Get IOC Feed",
"type": "main",
"index": 0
}
]
]
},
"\ud83d\udea8 ALERT \u2013 LEV Trigger": {
"main": [
[
{
"node": "\ud83d\udce7 Send Alert Email",
"type": "main",
"index": 0
},
{
"node": "Google Sheets",
"type": "main",
"index": 0
}
]
]
},
"\ud83e\udde0 AI \u2013 Risk Evaluation": {
"main": [
[
{
"node": "\ud83e\udde0 AI \u2013 Triage Vulnerabilities",
"type": "main",
"index": 0
},
{
"node": "Split Out",
"type": "main",
"index": 0
}
]
]
},
"\ud83e\udde0 AI \u2013 Triage Vulnerabilities": {
"main": [
[
{
"node": "\ud83d\udea8 ALERT \u2013 LEV Trigger",
"type": "main",
"index": 0
}
]
]
},
"\ud83e\udde0 AI \u2013 Incident Playbook Selector": {
"main": [
[
{
"node": "Code",
"type": "main",
"index": 0
}
]
]
}
}
}
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
This Blue Team workflow ingests threat intelligence from public CVE and IOC feeds, merges the data, performs automated triage using OpenAI, and routes actionable alerts via email. 📥 CVE and IOC feeds pulled from trusted sources 🤖 AI node evaluates risk severity and recommends…
Source: https://n8n.io/workflows/6356/ — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
QFO Rank Tracking - EmbeddingGemma Semantic Dedup & Daily Tracking. Uses googleSheets, httpRequest, googleBigQuery. Scheduled trigger; 16 nodes.
This workflow automates patient communication for medical clinics using the WhatsApp Business API. It supports appointment booking, rescheduling, service inquiries, follow-ups, and document submission
WooriFisa 최종. Uses memoryMongoDbChat, agent, httpRequest, documentDefaultDataLoader. Scheduled trigger; 68 nodes.
This workflow automates end-to-end customer journey management by intelligently routing queries through multiple AI models (OpenAI, Claude) based on complexity and context. Designed for customer succe
Ditch the endless scroll for AI trends. Meet Archi, your personal AI research assistant that hits you up once a week with everyone you need to know. 🧑🏽🔬