How I Automated My Daily CVE Intel Pipeline for $0 (And Saved My Management From Terminal Brain Rot)
Let’s be honest: explaining zero-day vulnerabilities to C-suite executives, non-technical project managers, or your family is a special kind of hell.
If you hand them a raw NIST CVSS vector string like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, their eyes instantly roll back into their heads. If you tell them "an unauthenticated remote attacker can cause arbitrary code execution via a heap buffer overflow," they hear "blah blah tech noise blah."
I wanted a system that automatically grabs daily CISA vulnerability updates, parses them, and fires off an automated daily email digest. But I didn't want just another boring security list—I wanted three explicit tiers for every single CVE:
The "For Dummies" Writeup: A plain-English, zero-jargon analogy so managers actually understand the threat.
The Blue Team Breakdown: The operational impact, target components, and immediate triage steps.
The Deep-Dive Technical View: Memory addresses, exploit mechanics, and raw payload context for the red/blue team nerds.
Here is the exact step-by-step guide on how I set up an n8n automation engine inside Docker on an Oracle Cloud Free Tier VPS, connected it to CISA data, filtered it, enriched it, and sent daily automated briefs—completely free.
The Architecture Overview
Here is what the pipeline looks like under the hood:
[Cron Trigger (Daily 08:00)]
│
▼
[HTTP Request: Fetch CISA Known Exploited Vulnerabilities / NVD Feed]
│
▼
[Code Node: 24-Hour Lookback & JS Data Filtering]
│
▼
[LLM / Custom Summarizer Node: Parse 3 Views (Dummies / Breakdown / Deep-Dive)]
│
▼
[Gmail SMTP Node: Deliver Clean HTML Security Brief]
Step 1: Provisioning the $0 Infrastructure (Oracle Cloud + Docker)
First, grab an Oracle Cloud Always Free ARM instance (4 vCPUs, 24 GB RAM—overkill for this, which makes it perfect). Just make sure you're using it often - Oracle seems to shut down devices without usage.
I won't go into too much detail about this but something to note - you'll want to make sure you set it up with a forward facing public IP so you can interact with it via SSH and your web browser.
To keep it locked down we're going to also setup ingress rules on the dedicated security list. What you'll want to add is your IP and the n8n port we'll setup below. SSH by default is available to all IP's because you need to connect with a private key - so make sure you set that up during the install and save it! You can't get another copy!
1. Fire up the VPS and Docker
SSH into your fresh Ubuntu server and run:
Bash
# Update system and get prerequisites
sudo apt update && sudo apt upgrade -y
sudo apt install curl docker.io docker-compose -y
# Enable Docker without needing sudo every 5 seconds
sudo usermod -aG docker $USER
newgrp docker
2. Spinning up n8n with Docker Compose
Create a directory for n8n and set up your docker-compose.yml:
Bash
mkdir ~/n8n-docker && cd ~/n8n-docker
nano docker-compose.yml
Paste the following configuration:
YAML
version: '3.8'
services:
n8n:
image: docker.n8n.io/n8nio/n8n:latest
container_name: n8n_pipeline
restart: always
ports:
- "5678:5678"
environment:
- N8N_HOST=your-server-ip-or-domain
- N8N_PORT=5678
- N8N_PROTOCOL=http
- NODE_ENV=production
- WEBHOOK_URL=http://your-server-ip-or-domain:5678/
- GENERIC_TIMEZONE=America/Toronto
volumes:
- n8n_data:/home/node/.n8n
volumes:
n8n_data:
Fire it up:
Bash
docker-compose up -d
Head over to http://<YOUR-SERVER-IP>:5678, set up your admin credentials, and welcome to your new automation hub.
Step 2: Building the n8n Workflow
Here's my full flow diagram. You'll notice I have a loop built so that it takes each item it pulls from the CISA site one at a time, runs it through the AI Agent and then once it's all put together THEN we push it to our email. You'll also notice I'm using some tools here for investigation to help with the output. I've got Wikipedia for general knowledge and also a GitHub search for POC's and technical writeups.
Node 1: Schedule Trigger
Add a Schedule Trigger node set to run daily at 08:00 AM.
Node 2: HTTP Request (Fetch CISA KEV Catalog)
Add an HTTP Request node to pull CISA’s Known Exploited Vulnerabilities JSON feed:
Node 3: Code Node (The 24-Hour Lookback Filter)
CISA’s JSON feed contains thousands of historically exploited vulnerabilities. We only want what was added in the last 24 hours.
Add a Code node (JavaScript) and paste this custom filter logic:
JavaScript
// Filter CISA KEV entries for vulnerabilities added within the last 24 hours
const items = $input.all()[0].json.vulnerabilities;
const now = new Date();
const twentyFourHoursAgo = new Date(now.getTime() - (24 * 60 * 60 * 1000));
const recentCVEs = items.filter(item => {
const dateAdded = new Date(item.dateAdded);
return dateAdded >= twentyFourHoursAgo;
});
// Fallback if no CVEs were published in the last 24 hours
if (recentCVEs.length === 0) {
return [{
json: {
hasCVEs: false,
message: "No new critical CISA vulnerabilities reported in the last 24 hours."
}
}];
}
return recentCVEs.map(cve => ({
json: {
hasCVEs: true,
cveID: cve.cveID,
vendorProject: cve.vendorProject,
product: cve.product,
vulnerabilityName: cve.vulnerabilityName,
shortDescription: cve.shortDescription,
requiredAction: cve.requiredAction,
dueDate: cve.dueDate
}
}));
Step 4: Structuring the Three-Tier Output
To format the output into three distinct operational views, pass the parsed CVE metadata into a processing node (or an internal LLM node like Gemini / OpenAI) using this exact prompt structure. Note, this part likely isn'g going to be free - you'll need to setup an API with your chosen LLM. Using a small Flash version (I"m using Gemini 3.5 Flash) will keep those costs down. I'm well below $25 a month using this mode. I know, I know - I used a click-bait title to get you here... but hey, you're halfway through the project, let's just finish up.
Prompt
Please analyze the following vulnerability data:
- CVE ID: {{ $json.cveID }}
- Vendor/Product: {{ $json.vendorProject }} - {{ $json.product }}
- Description: {{ $json.shortDescription }}System Message
You are an elite Red Team Exploit Analyst and penetration testing mentor. Analyze the incoming vulnerability data. Ignore generic corporate compliance impact statements. Instead, extract and summarize:
The Root Cause: What specific programming flaw allows this (e.g., buffer overflow, missing input sanitization in an expression engine, type confusion)? I need this in a "for dummies" output.
Attack Vector & Requirements: Is it unauthenticated remote code execution (RCE)? Does it require local access? What are the prerequisites?
The Exploit Mechanics: Explain how the vulnerability is triggered at a protocol or code level.
PoC Status: Search for and evaluate public Proof of Concept code. State if the PoC is weaponized or just a crash replication.Step 5: Formatting the Email Output (Gmail Node)
Add a Gmail / Email Read-Write Node or SMTP Node configured to send an HTML payload.
Here is the HTML layout template for the email body that I've made in that final javascript code node:
HTML
<h2>🚨 Daily Security Intelligence Briefing</h2>
<p><b>Target Window:</b> Last 24 Hours</p>
<hr/>
<div style="font-family: Arial, sans-serif; background-color: #f4f4f4; padding: 15px; border-radius: 5px;">
<h3 style="color: #d9534f;">[{{ $json.cveID }}] - {{ $json.vulnerabilityName }}</h3>
<p><b>Affected Vendor/Product:</b> {{ $json.vendorProject }} {{ $json.product }}</p>
<div style="background-color: #ffffff; padding: 10px; border-left: 4px solid #5bc0de; margin-bottom: 10px;">
<h4>💡 For Dummies View</h4>
<p>{{ $json.dummiesView }}</p>
</div>
<div style="background-color: #ffffff; padding: 10px; border-left: 4px solid #f0ad4e; margin-bottom: 10px;">
<h4>🛡️ Blue Team Breakdown</h4>
<p>{{ $json.blueTeamView }}</p>
<p><b>Required Remediation Action:</b> {{ $json.requiredAction }}</p>
</div>
<div style="background-color: #ffffff; padding: 10px; border-left: 4px solid #d9534f;">
<h4>🔬 Deep-Dive Technical Analysis</h4>
<p>{{ $json.technicalView }}</p>
</div>
</div>
Issues We Ran Into (And How We Fixed Them)
No project is complete without hitting a few wall-slammers. Here is what broke during build and how to fix it:
Issue 1: CISA Feed Formatting Shift / Timezone Mismatches
Symptom: The script returned 0 vulnerabilities even when new ones hit the news.
Fix: CISA uses YYYY-MM-DD strings in dateAdded. Standardizing timestamps through explicit UTC conversion in JavaScript (new Date(item.dateAdded).getTime()) fixed the drop-off issues completely.
Issue 2: Gmail SMTP Authentication Lockout
Symptom: Google blocked n8n SMTP requests with 535-5.7.8 Username and Password not accepted.
Fix: You cannot use your normal account password. Enable 2-Factor Authentication on your Google Account, navigate to App Passwords, generate a dedicated 16-character string for n8n, and put that in the SMTP password field.
Issue 3: Oracle Cloud Inbound Port Blocking
Symptom: Couldn't load the n8n Web UI at http://<IP>:5678.
Fix: Oracle’s default Ubuntu image runs strict iptables rules alongside Oracle Security Lists. You must open port 5678 inside Ubuntu directly:
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 5678 -j ACCEPT sudo netfilter-persistent saveThe Verdict
For (almost) $0/month in host infrastructure, we built an automated vulnerability intelligence agent that runs on auto-pilot. Management gets the simple explanation they need, the SOC team gets actionable mitigation tasks, and red teamers get technical detail on vector paths—all delivered to inbox inboxes every morning at 8 AM.
Comments