CYBER THREAT INTELLIGENCE BULLETIN / STRATEGIC ANALYSIS & TECHNICAL DETECTION REPORT
C541 Intelligence — Product DescriptionTwo self‑hosted security‑automation workflows for n8n. Each delivers value on its own; together they produce a single daily report that combines broad situational awareness with deep, inventory‑specific vulnerability analysis. Everything runs in your environment — your data never leaves.1) Daily Threat Intelligence Bulletin (standalone) What it is. An automated morning briefing that turns the firehose of open‑source security content into one report your team will actually read.What it does. Ingests 230+ curated sources across five streams: AI security, cyber news, ransomware activity, vulnerabilities/PoC, and social/community chatter. Deduplicates across runs and remembers what it already told you — an item that reappears is badged "previously reported," and after three reports it's suppressed, so you're never spammed. Summarizes with an LLM (local Ollama or any cloud provider) with automatic failover across providers — if one is down, the next takes over. Tracks ransomware victims and CISA KEV activity, and surfaces MITRE ATT&CK trends. Renders one email‑safe HTML report plus JSON, and distributes it by email and Telegram — per section if you want (e.g. KEV to the patch team, ransomware to the SOC). What you get. A repeatable, hands‑off daily bulletin with an executive summary, section‑by‑section intelligence, and full control over what's included and who receives it — all from a single config table.2) Vulnerability Intelligence Suite (CVE) (standalone) What it is. A correlation engine that answers the only question that matters during a CVE storm: "Does this affect us — and what do we do about it?"What it does. Pulls NVD + CISA KEV + FIRST EPSS + GitHub/OSV PoC signals for recent and actively‑exploited CVEs. Matches them against your own technology inventory by CPE — and only on CPE evidence, so there's no hallucinated mapping. No CPE match, no claim. Prioritizes every finding Critical / High / Medium / Low using KEV status, EPSS, exploit availability, and internet exposure — evidence, not guesswork. Writes a per‑CVE analysis (via LLM) covering attack vector, practical exploitation, mitigation, and detection — each returned as structured data, formatted by code so nothing drifts. Ships each finding with a ready Splunk SPL query, a valid Sigma rule, the likely MITRE ATT&CK technique, the affected assets, and the owning team. What you get. A prioritized, detection‑ready vulnerability report scoped to your estate — turning "300 new CVEs today" into "these five matter to us, here's how to detect and fix them."3) Combined: one report, breadth + depthRun both and they interlock. The CVE suite runs on its own schedule and caches its consolidated analysis; the daily bulletin embeds that analysis as an Appendix: CVE Analysis for Inventory Assets.The result is a single morning report that gives you: Situational awareness — what's happening across the threat landscape (news, ransomware, KEV, social), and Personal relevance — exactly which actively‑exploited vulnerabilities touch your inventory, with detections and an action plan for each. Because the heavy CVE pipeline is cached and embedded (not re‑run per bulletin), you get depth without duplication, extra emails, or extra load. One report, from the whole internet down to your own stack.How it's deliveredBoth are n8n Community 2.x workflows using native Data Tables — no external SaaS, no vendor lock‑in, no mounted disk, no env vars. LLM summarization can run fully local (Ollama) or on the cloud provider of your choice. You keep your inventory, your sources, your recipients, and your data.Who it's for: SOC and detection teams, vulnerability management, CISOs who need a briefing they can forward, and MSSPs who want one engine that scales across many customers.
Get it → c541.gumroad.com