Automate SIEM Alert Enrichment from Google Drive to Zendesk

• Automate the extraction of TTP information from SIEM alerts.
• Enhance incident response by integrating historical data and external resources.
• Streamline the process of updating Zendesk tickets with enriched cybersecurity data.
• Utilize AI to provide actionable remediation steps based on alerts.

Trigger the workflow when a chat message is received or manually initiated. Extract JSON data from Google Drive containing MITRE ATT&CK information. Process the extracted data to enrich SIEM alerts using AI agents. Embed the enriched data into a Qdrant vector store for advanced querying. Update Zendesk tickets with the enriched information and remediation steps.

1. 1
   Import the workflow template into your n8n instance.
2. 2
   Connect your Google Drive and Zendesk accounts.
3. 3
   Set up the necessary credentials for OpenAI and Qdrant.
4. 4
   Test the workflow by triggering it with sample SIEM alert data.