Cybersecurity Threat Intelligence Daily Digest Generator - n8n Workflow

Cyber Threat Intelligence (CTI) Analysts needing to process large volumes of daily reports.
Security Operations Center (SOC) teams looking for high-signal summaries.
Anyone interested in creating custom, automated daily news briefings using an n8n workflow.
Users looking for advanced examples of n8n templates combining RSS, LLMs, and structured data storage.

The modern threat landscape generates overwhelming amounts of data. This powerful n8n workflow solves the "signal-to-noise" problem for cybersecurity professionals. It utilizes a scheduled n8n trigger to pull news from ten major cybersecurity RSS feeds daily. Instead of simply aggregating, this advanced n8n workflow leverages the power of the Gemini AI model to act as an intelligence analyst. The AI summarizes, deduplicates, and structures the high-volume data into a concise, actionable daily digest. Furthermore, the n8n workflow stores historical reports in Baserow and analyzes the last seven days of data to identify highly persistent, "viral" threat topics, ensuring no critical, sustained campaign is missed. This high-value n8n template dramatically cuts down manual review time, offering a sophisticated example of an AI-powered n8n workflow.

This complex n8n workflow executes daily at 7 AM using an n8n trigger.

1. Ingestion: Ten separate RSS Feed n8n node operations simultaneously scrape the latest articles from top cybersecurity news outlets (e.g., Bleepingcomputer, Mandiant, The Hacker News). The workflow starts with this massive data collection.


2. Preparation: The articles are merged using the Merge collected articles n8n node and then passed to a Code n8n node (Precook data) which filters out any posts older than 24 hours, preparing a clean text input (articlesText) for the LLM.


3. Daily Digest Creation: The Write basic digest for today n8n node uses the Google Gemini AI model (via LangChain) and a structured output parser n8n node to process the articles. The prompt mandates categorization (Nation State, Vulnerabilities, etc.) and strict deduplication.


4. Dissemination (Daily): The structured JSON output is saved to Baserow and converted into rich HTML using a custom Code n8n node. A final Email n8n node sends the comprehensive daily threat intelligence digest.


5. Historical Analysis Setup: The n8n workflow then calculates the date seven days prior and fetches all stored daily reports from Baserow using the Get data of previous days n8n node.


6. Viral Topic Identification: The Identify viral topics and write digest n8n node feeds the last seven days of reports to the LLM. The AI's task is to identify recurring topics (those mentioned on multiple days) and consolidate them into a unified, high-signal report.


7. Dissemination (Viral): The resulting "viral topics" report is saved to Baserow and delivered via a second email n8n node, completing the daily intelligence cycle of this highly effective n8n workflow.

This n8n template requires the setup of several credentials and accounts.

1. Import: Import this n8n workflow JSON file into your n8n instance.


2. RSS Feeds: The RSS URLs are pre-configured. No changes are usually needed unless you want to add or remove sources.


3. AI Credentials: Provide credentials for the Google Gemini Chat Model n8n node. This typically involves setting up a Google PaLM/Gemini API key connection for the LLM.


4. Database Credentials: Configure your Baserow API key (Baserow account). You must create and provide the correct Database ID and Table IDs used for storing the daily reports (Table ID 562928) and the viral reports (Table ID 628338) within the respective Baserow n8n node settings.


5. Email Setup: Configure the SMTP credentials (SMTP account) for the Send daily digest email and Send viral topics email n8n node actions. Update the toEmail field parameters to your desired recipient address.


6. Activation: Activate the n8n workflow. It is set to run daily at 7 AM via the schedule n8n trigger.

Daily trigger (Schedule Trigger): The starting n8n node, configured to execute the entire n8n workflow daily at 7 AM.
RSS Feed Read nodes (10 nodes): Collects raw text and snippets from diverse security sources including Bleepingcomputer, The Hacker News, and Microsoft Security. These nodes ensure comprehensive data collection for the n8n workflow.
Precook data (Code): A custom n8n node script that cleans the data, filtering out old content (older than 24 hours) and formatting the remaining articles into a concise text block for the LLM input.
Write basic digest for today (Chain LLM): This n8n node sends the raw daily articles to the Google Gemini AI. It acts on detailed prompts to deduplicate, summarize, and categorize the news, focusing on high-signal threat intelligence.
Structured Output Parser (LangChain): Ensures the AI's output adheres to a strict JSON schema, defining fields for different threat categories (e.g., Nation State, Vulnerabilities). This is crucial for consistent output in the n8n workflow.
Baserow Push Data / Get data of previous days (Baserow): These n8n node configurations handle persistence, storing daily reports and retrieving historical data required for the viral topic analysis.
Identify viral topics and write digest (Chain LLM): A specialized AI n8n node that analyzes the historical data to identify and synthesize recurring threats, a complex function enabled by the advanced capabilities of the n8n template.
Send daily digest email / Send viral topics email (Email Send): The final n8n node actions responsible for delivering the two high-value threat intelligence summaries via SMTP.