Workflow Overview

This n8n workflow is designed to streamline security oversight by fetching advisories from Palo Alto's feed and filtering out alerts not pertinent to your products.

By utilizing a dynamic filter system, it excludes unrelated advisories, ensuring that your team receives only relevant security updates.

Coupled with a sample database of emails, this workflow offers a customizable solution to align with any corporate email directory, providing a strong foundation for your security information management strategy.

Execution Schedule

Scheduled to run every 24 hours at 1 am. If you change this timer, ensure to update the Deduplicate Advisories section to match.

Get Palo Alto security advisories

Adaptable and efficient, this segment of the workflow retrieves Palo Alto security advisories directly through their RSS feed.

You can tailor the feed URL in the RSS node below to meet your needs and ensure the Extract Info node captures the correct information.

This flexibility allows the workflow to stay current with the latest advisories, making it a vital component in maintaining up-to-date security measures across your network infrastructure.

Query Company Email Directory

The workflow includes a sample node setup that queries a company email directory, allowing for dynamic distribution of advisories to relevant personnel.

Replace the sample node with a connection to your corporate directory or a Google Sheet for an integrated approach. If you choose to go the google sheets route, create a column for name and a column for email and use the Google Sheets node to get the rows.

This ensures that every advisory reaches the appropriate individual, promoting a proactive security posture organization-wide.

Ensure that the node you use outputs the json in this format:

[
  {
    "name": "Jay Gatsby",
    "email": "user@example.com"
  },
  {
    "name": "José Arcadio Buendía",
    "email": "user@example.com"
  },
  {
    "name": "Max Sendak",
    "email": "user@example.com"
  }
]

Email advisory information to your team

Once advisories are filtered and prepared, this final node uses Gmail to disseminate the information to your team, ensuring that those who need to be aware of security updates are informed in a timely manner.

This step is pivotal in the communication chain, turning advisories into actionable insights for your team, thereby promoting a culture of responsiveness and awareness regarding network security.

You can replace this with your preferred email provider by substituting the node and expressions in the Gmail node.

Filter advisories based on Palo Alto Products used in your organization

This node enhances specificity by filtering advisories based on the Palo Alto products utilized within your organization.

By customizing the filter nodes to match your environment, you create a streamlined process that directs pertinent advisories to a Jira issue (or any incident management system that uses an API) for further investigation, ensuring your incident management process is both efficient and tailored to your specific security landscape.

Want to add a new filter? Duplicate one of the filter nodes below and connect it to the true output of the date filter node, decide whether you wish to add an incident management node, and then connect to your email directory node.

Want to create a ticket for your team to investigate if an advisory is found for your filtered product/keyword? Simply add the node for your favorite incident management platform if it exists, and an http request if it doesn't to integrate with any REST api.

Deduplicate Advisories

Filter advisories based on date

To maintain accuracy and avoid redundancy, this n8n node deduplicates advisories by date, ensuring that each security notice is unique and relevant.

It's programmed to sync with the scheduled trigger, preventing any overlap in data analysis.

Adjustments can be made to alter the frequency and timing of the trigger, allowing for weekly or custom schedules, demonstrating n8n's versatile capability to adapt to your operational requirements.

For example if you preferred to change it to weekly, set the Trigger Node to run weekly, and adjust the expression in the If node below from {{$today.minus({days: 1})}} to {{$today.minus({days: 7})}}.

Monitor_security_advisories

Purpose and structure

This folder contains the Monitor_security_advisories workflow. Its executable nodes use filter, gmail, if, jira, manualTrigger, n8nTrainingCustomerDatastore, noOp, rssFeedRead, scheduleTrigger, set. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

When clicking "Execute Workflow", Run workflow every 24 hours at 1am

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Filter/1772_Filter_Rssfeedread_Monitor_Scheduled.json MIT; preserve source notices.