Auto-Remediate Critical Attack Paths in Neo4j Security Graph

Input: Neo4j security graph + GitHub IaC repo; Process: scheduled scan → path scoring → AI-generated fix → Jira ticket → GitHub PR; Output: remediated IaC file with linked ticket

Who

Security ops or platform engineers with n8n experience, maintaining a Neo4j security graph, Jira, and GitHub repos

You get

Automatically discover high-risk attack paths from internet-facing to crown-jewel assets, generate fixes, and create Jira tickets and GitHub PRs

You need

n8n · neo4j · jira · github

Steps

1. Configure credentials and global parameters

   After importing the template into n8n: 1) Add Neo4j HTTP Basic Auth credentials to the 'Post to Security Graph API' node; 2) Add GitHub API credentials (repo scope) to all GitHub HTTP Request nodes; 3) Add Jira Software Cloud credentials (email + API token) to both Jira HTTP Request nodes; 4) Add OpenAI API key to the 'OpenAI GPT-4.1 Mini Agent' node; 5) Update values in 'Set Configuration Parameters': neo4jUrl, riskScoreThreshold, jiraBaseUrl, jiraProjectKey, repoOwner, repoName, baseBranch, defaultIacPath.

2. Trigger scan and query the security graph

   The workflow starts via 'When Daily Graph Scan Starts' (default cron 0 5 * * *, daily at 05:00) or 'When Test Run Initiated' (manual). After loading config, 'Post to Security Graph API' sends a Cypher query to Neo4j /db/neo4j/tx/commit: MATCH shortestPath from internet-facing Asset to Assets with criticality in ['crown-jewel','critical'], returning path, source/target names, hop count, limited to 25 results.

3. Parse attack paths

   'Parse and Extract Attack Paths' (Code, JS) parses the Neo4j transactional response, building one candidate attack-path object per row. Extracts sourceAsset, targetAsset, targetCriticality, hopCount, exposedPorts, misconfigResourceAddress, misconfigResourceType, misconfigFilePath, nodeCount, and merges upstream config parameters.

4. Score and branch on criticality

   'Analyze and Rank Attack Paths' (Code, Python) performs composite risk scoring: target criticality (40) + port exposure/exploitability (25) + hop proximity (20) + blast-radius density (15). Sorts descending, picks the top path, and marks isCriticalPath=true if riskScore >= riskScoreThreshold (default 50). 'If Critical Path Detected' checks this boolean; if true, proceeds to remediation.

5. Fetch IaC and generate remediation

   If critical: 1) 'Retrieve IaC File from GitHub' fetches the misconfigFilePath file content (base64) via GitHub API; 2) 'Remediation Strategy Agent' (AI Agent, define prompt) receives attack-path details and base64-encoded IaC, instructing the AI to identify the misconfigured resource block and output JSON with: remediationSummary, remediationSteps, updatedFileContent (complete corrected file, plain text), cvssEstimate, jiraSummary, jiraDescription, prBranchName, prTitle, prBody, commitMessage; 3) 'OpenAI GPT-4.1 Mini Agent' provides the LLM; 4) 'Parse AI and Build Payloads' (Code, JS) parses the AI output, strips markdown fences, and prepares Jira/GitHub payloads, encoding the corrected file to base64.

   Execution prompt · Source text。Remediation Strategy Agent node text field (define prompt)

   Copy prompt

   =You are a cloud security remediation expert. An attack path was found in the security graph and needs a concrete fix.
   
   Attack Path:
   - Source (internet-facing): {{ $('Analyze and Rank Attack Paths').item.json.sourceAsset }}
   - Target ({{ $('Analyze and Rank Attack Paths').item.json.targetCriticality }}): {{ $('Analyze and Rank Attack Paths').item.json.targetAsset }}
   - Hop count: {{ $('Analyze and Rank Attack Paths').item.json.hopCount }}
   - Exposed ports on the entry point: {{ $('Analyze and Rank Attack Paths').item.json.exposedPorts }}
   - Risk score: {{ $('Analyze and Rank Attack Paths').item.json.riskScore }}/100 ({{ $('Analyze and Rank Attack Paths').item.json.severity }})
   - Misconfigured resource: {{ $('Analyze and Rank Attack Paths').item.json.misconfigResourceAddress }} ({{ $('Analyze and Rank Attack Paths').item.json.misconfigResourceType }})
   
   Current IaC file ({{ $('Analyze and Rank Attack Paths').item.json.misconfigFilePath }}), base64-encoded content:
   {{ $json.content }}
   
   Decode the base64 content mentally, identify the specific resource block causing this attack path (overly permissive security group rule, wildcard IAM policy, public S3/network ACL, missing MFA/role trust condition, etc.), and:
   1. Write a remediationSummary (2-3 sentences) explaining why this path exists.
   2. Write remediationSteps: an array of 3-6 short, concrete steps.
   3. Produce updatedFileContent: the COMPLETE corrected file content (plain text, not base64) applying least-privilege / closing the exposure — keep all unrelated content unchanged.
   4. cvssEstimate: a number 0-10 estimating severity.
   5. jiraSummary: a short ticket title.
   6. jiraDescription: a 2-4 sentence ticket description.
   7. prBranchName: a short kebab-case branch name.
   8. prTitle: a concise PR title.
   9. prBody: a markdown PR description including the attack path, the fix, and the risk score above.
   10. commitMessage: a concise commit message.
   
   Return ONLY a JSON object with keys: remediationSummary, remediationSteps, updatedFileContent, cvssEstimate, jiraSummary, jiraDescription, prBranchName, prTitle, prBody, commitMessage. No markdown fences, no commentary.

6. Create Jira tracking issue

   'Submit Jira Issue API' creates an Issue via Jira REST API v3, including: project key, summary (from AI jiraSummary), issuetype (default Bug), description (Atlassian Document Format with attack path details and riskScore/severity), labels (attack-path, auto-remediation).

7. Prepare GitHub fix branch and PR

   1) 'Fetch GitHub Base Branch Reference' gets the baseBranch git ref sha; 2) 'Create New GitHub Branch' creates a remediation branch from that sha; 3) 'Update IaC File on Branch' commits the base64-encoded corrected file to the new branch; 4) 'Propose Pull Request on GitHub' opens a PR with title/body from AI output, appending the Jira ticket link.

8. Post PR link back to Jira

   'Post PR Link to Jira' waits for the PR creation, then adds a comment to the corresponding Jira issue: 'Auto-remediation PR opened:' + PR html_url, closing the loop between ticket and code change.

You are a cloud security automation assistant. The user wants to set up the 'Neo4j Attack Path Auto-Remediation' n8n template. First confirm they have: 1) an accessible Neo4j instance with Asset nodes and required properties; 2) write access and API credentials for a GitHub repo; 3) a Jira Software Cloud project and API credentials; 4) an OpenAI API key. Then help them import the template, configure credentials, modify URL/project/repo values in the Set node, and suggest testing with 'When Test Run Initiated' before enabling the schedule trigger.