Auto-Monitor AI Vulnerability RSS and Create ServiceNow Security Incidents with n8n

Input: AI vulnerability RSS feed; Process: scheduled fetch → full-text extraction → GPT parsing → split into items → write to ServiceNow; Output: ServiceNow Security Incident

Who

Security operations teams or engineers who want to automate AI vulnerability intelligence tracking

You get

Automatically monitor RSS on a schedule, turn new vulnerabilities into structured summaries, and create ServiceNow security incidents without manual feed watching

You need

n8n · servicenow · jina-ai

Steps

1. Configure Schedule Trigger and RSS Source

   Add a Schedule Trigger node in n8n and set the run interval (e.g., every 15 minutes). Then add an RSS Read node and set its URL to an accessible AI vulnerability RSS address (the template example is https://rss.app/feeds/tbFqDT5HIb59.xml; replace with your actual feed). When run, you should see a list of RSS items as output.

2. Fetch Full Article Content

   Add a Read URL content (Jina AI) node and set the URL parameter to `={{ $json.link }}` to receive article links from RSS Read and retrieve full content. Configure the jinaAiApi credential beforehand. When run, it should output an article object containing fields such as metadata and content.

   Execution prompt · Source text。Read URL content node url parameter

   Copy prompt

   ={{ $json.link }}

3. Configure Information Extractor and OpenAI Model

   Add an Information Extractor node and bind an OpenAI Chat Model as the language model. In OpenAI Chat Model, select the model (template default is gpt-4.1-mini; gpt-4.1 or gpt-4 are also selectable) and configure the openAiApi credential. In Information Extractor, fill in text and systemPromptTemplate as shown below. When run, it should output a JSON array named results containing title, link, pubDate, creator, and content.

   Execution prompt · Source text。Information Extractor node text parameter

   Copy prompt

   =Snippet {{ $json.metadata.description}}
   Title{{ $json.title}}
   pubDate{{ $json.publishedTime}}
   Creator {{ $json.metadata.author}}
   content {{ $json.content}}

   Execution prompt · Source text。Information Extractor node options.systemPromptTemplate parameter

   Copy prompt

   You are an expert extraction algorithm.
   Only extract relevant information from the input text.
   Extract data as JSON objects with the following fields:
   
   title (string): The title of the news article or vulnerability report.
   link (string): The URL linking to the full article.
   pubDate (string, ISO 8601 format preferred): The publication date of the article.
   creator (string): The author or source of the article.
   content (string): A brief summary or snippet of the article content.
   
   
   If any field is missing or not found, omit that field in the output.
   Output a JSON array called results containing the extracted objects.

4. Split Extraction Results

   Add a Split Out node. Set Field to Split Out to `output.results`, and in Options set Destination Field Name to `response`. This splits the JSON array into separate records for per-item incident creation. When run, you should see multiple independent items as output.

5. Create ServiceNow Security Incident

   Add a Create an incident (ServiceNow) node. Configure the serviceNowBasicApi credential with basicAuth. Set Resource to incident and Operation to create. Set Short description to `=Ai Vulnerability {{ $json.response.title }}`; for Additional fields, use the following template for description. When run, a corresponding Security Incident should be created in ServiceNow.

   Execution prompt · Source text。ServiceNow node additionalFields.description parameter

   Copy prompt

   =Snippet {{ $json.response.content }}
   Creator {{ $json.response.creator }}
   PubDate {{ $json.response.pubDate}}

   Execution prompt · Source text。ServiceNow node short_description parameter

   Copy prompt

   =Ai Vulnerability {{ $json.response.title }}

6. Connect Nodes and Test

   Connect nodes in this order: Schedule Trigger → RSS Read → Read URL content → Information Extractor → Split Out → Create an incident. Also connect OpenAI Chat Model to Information Extractor as ai_languageModel. In Settings, confirm executionOrder is v1. Save, run once manually, and verify that ServiceNow incidents are created correctly; activate the workflow after confirmation.

You are reproducing an n8n workflow that auto-monitors an AI vulnerability RSS feed and creates ServiceNow security incidents. Follow this order: 1) Confirm you have an n8n instance and the three credentials openAiApi, serviceNowBasicApi, and jinaAiApi; 2) Import workflow.json or build manually; 3) Replace the RSS URL with a real vulnerability intelligence source; 4) Set the Schedule Trigger interval; 5) Test run and verify ServiceNow incident fields. Note: the default model is gpt-4.1-mini, and you can switch to gpt-4.1 or gpt-4.