Aggregate Endpoint Security Risk Scores with EDR Vulnerability Data

This n8n workflow automates the process of fetching endpoint security risk scores and EDR (Endpoint Detection and Response) vulnerability data, then prepares this information for further analysis or reporting. It's designed to run on a schedule, ensuring your security data is consistently updated.

What it does

This workflow performs the following key steps:

1. Schedules Execution: The workflow is triggered on a predefined schedule (e.g., daily, weekly).
2. Prepares API Request: A "Function" node prepares the necessary data or parameters for an API call to retrieve endpoint security risk scores.
3. Fetches Endpoint Security Data: An "HTTP Request" node makes an API call to an external service to fetch the endpoint security risk scores.
4. Prepares EDR Vulnerability Request: Another "Function" node prepares the data for a subsequent API call to retrieve EDR vulnerability data.
5. Fetches EDR Vulnerability Data: An "HTTP Request" node makes an API call to an external service to fetch the EDR vulnerability data.
6. Combines Data: A "Merge" node combines the endpoint security risk scores and the EDR vulnerability data into a single dataset.
7. Writes to Google Sheets: The aggregated data is then written to a specified Google Sheet, providing a centralized repository for your security insights.

Prerequisites/Requirements

To use this workflow, you will need:

• n8n Instance: A running instance of n8n.
• Google Sheets Account: With appropriate permissions to write to a spreadsheet.
• Google Sheets Credential: Configured in n8n to connect to your Google Sheets account.
• API Endpoints: Access to the API endpoints for your endpoint security solution and EDR platform.
• API Credentials/Authentication: Any necessary API keys, tokens, or other authentication details for the security and EDR APIs.

Setup/Usage

1. Import the Workflow:

   • Download the provided JSON workflow definition.
   • In your n8n instance, click on "Workflows" in the left sidebar.
   • Click "New" and then "Import from JSON".
   • Paste the JSON content or upload the file.

2. Configure Credentials:

   • Locate the "Google Sheets" node. Click on it and select or create a new "Google Sheets API" credential.
   • For the "HTTP Request" nodes, you will need to configure the authentication method (e.g., API Key, OAuth2, Header Auth) according to the requirements of your endpoint security and EDR platforms.

3. Configure Nodes:

   • Cron: Adjust the schedule to your desired frequency (e.g., daily, weekly).
   • Function (Prepare Endpoint Security Request): Modify the JavaScript code to construct the API request (URL, headers, body) for your specific endpoint security platform.
   • HTTP Request (Get Endpoint Security Data): Update the URL, HTTP method, and any other parameters to match your endpoint security API.
   • Function (Prepare EDR Vulnerability Request): Modify the JavaScript code to construct the API request for your specific EDR platform.
   • HTTP Request (Get EDR Vulnerability Data): Update the URL, HTTP method, and any other parameters to match your EDR vulnerability API.
   • Google Sheets: Specify the Spreadsheet ID and Sheet Name where you want to write the aggregated data. Ensure the column headers in your Google Sheet match the keys in the data output by the "Merge" node.

4. Activate the Workflow:

   • Once all configurations are complete, save the workflow.
   • Toggle the "Active" switch in the top right corner to enable the workflow. It will now run automatically based on your defined schedule.