{
  "name": "NexGenData — CVE / CISA KEV Monitor → Slack",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "hoursInterval": 6
            }
          ]
        }
      },
      "id": "node-schedule",
      "name": "Schedule Trigger (every 6h)",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.3,
      "position": [
        0,
        300
      ]
    },
    {
      "parameters": {
        "method": "POST",
        "url": "https://api.apify.com/v2/acts/nexgendata~cve-vulnerability-monitor/run-sync-get-dataset-items",
        "sendQuery": true,
        "queryParameters": {
          "parameters": [
            {
              "name": "token",
              "value": "YOUR_APIFY_TOKEN"
            }
          ]
        },
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "{\n  \"vendors\": [\"fortinet\", \"microsoft\", \"apache\"]\n}",
        "options": {
          "timeout": 290000
        }
      },
      "id": "node-http",
      "name": "Run Apify Actor (CVE Monitor)",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.4,
      "position": [
        240,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "// Collect all rows (HTTP v4.x auto-splits a top-level array; guard handles a wrapped array too)\nlet rows = $input.all().map(i => i.json);\nif (rows.length === 1 && Array.isArray(rows[0])) rows = rows[0];\n// Keep only CISA KEV=true OR CVSS >= 9\nconst hot = rows.filter(r => r && (r.cisa_kev === true || Number(r.cvss) >= 9));\nreturn hot.map(r => ({ json: {\n  text: `:rotating_light: *${r.cve_id}* (${r.vendor || ''}) CVSS ${r.cvss} ${r.cisa_kev ? '· CISA KEV' : ''} EPSS ${r.epss || ''}\\n${r.summary || ''}`,\n  ...r\n} }));"
      },
      "id": "node-code",
      "name": "Filter KEV / CVSS>=9",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        480,
        300
      ]
    },
    {
      "parameters": {
        "resource": "message",
        "operation": "post",
        "select": "channel",
        "channelId": {
          "__rl": true,
          "mode": "name",
          "value": "#security-alerts"
        },
        "messageType": "text",
        "text": "={{ $json.text }}",
        "otherOptions": {}
      },
      "id": "node-slack",
      "name": "Post to Slack",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.5,
      "position": [
        720,
        300
      ]
    }
  ],
  "connections": {
    "Schedule Trigger (every 6h)": {
      "main": [
        [
          {
            "node": "Run Apify Actor (CVE Monitor)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Run Apify Actor (CVE Monitor)": {
      "main": [
        [
          {
            "node": "Filter KEV / CVSS>=9",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Filter KEV / CVSS>=9": {
      "main": [
        [
          {
            "node": "Post to Slack",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {
    "executionOrder": "v1"
  },
  "active": false,
  "pinData": {},
  "meta": {
    "instanceId": "nexgendata-template"
  }
}