Automate SIEM Alert Enrichment with MITRE ATT&CK, Qdrant & Zendesk in n8n n8n Workflow Template

n8n workflow template · 22 nodes · OpenAI

Automate SIEM Alert Enrichment with MITRE ATT&CK, Qdrant & Zendesk in n8n is a free n8n workflow template that starts when a chat message is received and works with OpenAI, Google Drive, Qdrant and Zendesk. It has 22 nodes, 15 of them AI nodes (Chat Trigger, AI Agent, OpenAI Chat Model and OpenAI Embeddings). The notes inside the workflow say: “This flow adds contextual information to your tickets using the Mitre Attack framework to help contextualize the ticket data.” To run it, you add your own credentials for Google Drive OAuth2, OpenAI API, Qdrant API and Zendesk API.

Download JSON How to import into n8n

At a glance

Trigger: Chat Trigger (When chat message received)
Nodes: 22
Apps: OpenAI, Google Drive, Qdrant and Zendesk
AI nodes: 15
Credentials: 4 types
Category: RAG, documents and vector search

Apps and integrations

OpenAI
Google Drive
Qdrant
Zendesk

Node types used

Chat Trigger
AI Agent
OpenAI Chat Model
Split Out
OpenAI Embeddings
Default Data Loader
Token Splitter
Window Buffer Memory
Extract from File
Manual Trigger
Loop Over Items
Structured Output Parser
Google Drive
Qdrant Vector Store
Zendesk

How it works

The text below comes from the sticky notes inside the workflow. We removed links, code samples and anything that looks like a key or token.

Deploy your Vector Store

This flow adds contextual information to your tickets using the Mitre Attack framework to help contextualize the ticket data.

Talk to your Vector Store

Now that your vector store has been updated with the embedded data, you can use the n8n chat interface to talk to your data using OpenAI, Ollama, or any of our supported LLMs.

Setup notes

The text below comes from the sticky notes inside the workflow. We removed links, code samples and anything that looks like a key or token.

Embed your Vector Store

To provide data for your Vector store, you need to pass it in as JSON, and ensure it's setup correctly. This flow pulls the JSON file from Google Drive and extracts the JSON data and then passes it into the qdrant collection.

Nodes in this workflow

The 22 nodes in file order (sticky notes excluded). Branches and connections determine execution order in n8n:

When chat message received (Chat Trigger)
AI Agent (AI Agent)
OpenAI Chat Model (OpenAI Chat Model)
Split Out (Split Out)
Embeddings OpenAI1 (OpenAI Embeddings)
Default Data Loader (Default Data Loader)
Token Splitter1 (Token Splitter)
Window Buffer Memory (Window Buffer Memory)
Embeddings OpenAI2 (OpenAI Embeddings)
Extract from File (Extract from File)
When clicking ‘Test workflow’ (Manual Trigger)
AI Agent1 (AI Agent)
OpenAI Chat Model1 (OpenAI Chat Model)
Embeddings OpenAI (OpenAI Embeddings)
Loop Over Items (Loop Over Items)
Structured Output Parser (Structured Output Parser)
Pull Mitre Data From Gdrive (Google Drive)
Embed JSON in Qdrant Collection (Qdrant Vector Store)
Query Qdrant Vector Store (Qdrant Vector Store)
Qdrant Vector Store query (Qdrant Vector Store)
Get all Zendesk Tickets (Zendesk)
Update Zendesk with Mitre Data (Zendesk)

Credentials you need

Google Drive OAuth2 – used by Pull Mitre Data From Gdrive
OpenAI API – used by Embeddings OpenAI, Embeddings OpenAI1, Embeddings OpenAI2 and OpenAI Chat Model and others
Qdrant API – used by Embed JSON in Qdrant Collection, Qdrant Vector Store query and Query Qdrant Vector Store
Zendesk API – used by Get all Zendesk Tickets and Update Zendesk with Mitre Data

Configure your own credentials after importing. Create each credential in n8n, then select it in the node.

How to import into n8n

Download the JSON file with the button above.
In n8n, open a new workflow, select the ... menu and choose Import from File. You can also paste the JSON straight into the editor canvas.
Open each node that shows a warning and select or create its credential.
Read the notes on the canvas, test the workflow with sample data, then activate it.

Do you need somewhere to run it? Read our guide to self-hosted n8n.