用 n8n 编排安全漏洞修复：Port + OpenAI + Jira + Slack

安全扫描告警 → Port 服务目录补全上下文 → OpenAI 生成修复方案 → 按严重级别路由 → Jira 工单 + Claude Code 自动修复 → Slack 通知

给谁

有 n8n 自托管实例、使用 Port 作为软件目录的安全/平台工程师

你会得到

收到漏洞告警后自动创建分级 Jira 工单，关键漏洞触发 Claude Code 提 PR，Slack 通知责任团队

你需要

n8n · slack · jira · port

步骤

1. 配置触发器与 Port 上下文 enrichment

   在 n8n 中导入模板后，配置 Webhook Trigger 节点接收安全扫描器的 POST 请求（路径 security/vulnerability）。然后配置 Get Context From Port 节点：选择 operation 为 invokeAgent，agentIdentifier 填 context_retriever_agent，将下方提示词粘贴到 prompt 字段。该节点会向 Port 软件目录查询受影响服务、负责人、环境、SLA、Slack 频道和 Jira 项目 key。

   运行提示词 · 来源原文。Get Context From Port 节点的 prompt 字段

   复制提示词

   =You are an assistant that provides contextual enrichment for vulnerabilities using the Port catalog as a knowledge base. A new security vulnerability has been detected.
   Vulnerability Details:
   - Identifier: {{ $('Webhook Trigger').item.json.body.vulnerability_id }}
   - Description: {{ $('Webhook Trigger').item.json.body.description }}
   - Severity: {{ $('Webhook Trigger').item.json.body.severity }}
   - CVE: {{ $('Webhook Trigger').item.json.body.cve || 'N/A' }}
   - Package: {{ $('Webhook Trigger').item.json.body.package || 'N/A' }}
   
   Using the Port catalog, return relevant contextual information. Specifically, retrieve:
   1. The affected service or repository
   2. Service owners and responsible team
   3. Environment (production/staging/dev)
   4. Service tier and SLA requirements
   5. Team's Slack channel
   6. Related dependencies
   7. Jira project key for security tickets
   
   Your response must be a single valid JSON object only, without any code block formatting, markdown, explanations, or extra text.
   Do not include ```json or ``` or any surrounding characters — just raw JSON.
   
   Required output schema:
   {
     "service_name": "",
     "repository": "",
     "service_tier": "production|staging|development",
     "sla_hours": 0,
     "owners": [],
     "slack_channel": "",
     "environment": "",
     "dependencies": [],
     "jira_project_key": ""
   }

2. 配置 OpenAI 修复方案生成

   配置 OpenAI Remediation Plan 节点：resource 选 chat，model 选 gpt-4o-mini（或 gpt-4o），将下方提示词粘贴到 messages[0].content。该节点结合漏洞详情和 Port 上下文，输出包含摘要、影响评估、修复步骤、是否可自动修复、Claude Code 修复提示词和努力程度的 JSON。

   运行提示词 · 来源原文。OpenAI Remediation Plan 节点的 messages[0].content 字段

   复制提示词

   =You are a security engineer. Analyze this vulnerability and create a remediation plan.
   
   Vulnerability:
   - ID: {{ $('Webhook Trigger').item.json.body.vulnerability_id }}
   - Description: {{ $('Webhook Trigger').item.json.body.description }}
   - Severity: {{ $('Webhook Trigger').item.json.body.severity }}
   - CVE: {{ $('Webhook Trigger').item.json.body.cve || 'N/A' }}
   - Package: {{ $('Webhook Trigger').item.json.body.package || 'N/A' }}
   
   Service Context from Port:
   {{ $('Get Context From Port').item.json.executionMessage }}
   
   Your response must be a single valid JSON object only, without any code block formatting, markdown, explanations, or extra text.
   Do not include ```json or ``` or any surrounding characters — just raw JSON.
   
   Required output schema:
   {
     "summary": "Brief description of the vulnerability",
     "impact": "Business impact assessment",
     "remediation_steps": ["Step 1", "Step 2"],
     "is_auto_fixable": true or false,
     "fix_prompt": "Detailed prompt for a coding agent to fix this vulnerability",
     "estimated_effort": "low|medium|high"
   }

3. 配置严重级别路由与 Jira 工单

   配置 Check Severity Level 节点（Switch 类型）：value1 取 webhook body.severity.toLowerCase()，三条分支分别匹配 critical、high、和默认（regex .*）。然后分别配置三个 Jira 节点：Critical 优先级选 'Now (Urgent)'，High 选 'High'，Medium/Low 选 'Low'；每个节点的 project、issueType、summary、description 均需选择你的实际 Jira 项目。description 中已嵌入 Port 上下文和 AI 修复方案的表达式。

4. 配置关键漏洞自动修复与 Slack 告警

   在 Critical 分支后配置 Is Auto-Fixable? 节点（If 类型）：条件检查 OpenAI 输出的 is_auto_fixable 为 true，或 fix_prompt 长度大于 10。若 true，走 Trigger Fix via Port AI Agent 节点：method 为 POST，URL 为 https://api.getport.io/v1/actions/run_claude_code/runs，authentication 选 genericCredentialType + httpBearerAuth，jsonBody 使用模板中的表达式（含 service、prompt 属性）。随后接 Alert Critical to Slack 节点发送修复已触发通知。若 false，走 Alert Critical (Manual Fix) 节点发送需人工修复通知。两个 Slack 节点的 channel 均从 Port 上下文读取，fallback 为 #security-alerts。

   运行提示词 · 来源原文。Alert Critical to Slack 节点的 text 字段

   复制提示词

   =🚨 *CRITICAL SECURITY VULNERABILITY DETECTED*
   
   *Vulnerability:* {{ $('Webhook Trigger').item.json.body.vulnerability_id }}
   *CVE:* {{ $('Webhook Trigger').item.json.body.cve || 'N/A' }}
   *Severity:* CRITICAL 🔴
   
   *Affected Service:* {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.service_name || 'Unknown'; } catch(e) { return 'Unknown'; } })() }}
   *Environment:* {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.environment || 'Unknown'; } catch(e) { return 'Unknown'; } })() }}
   *Owners:* {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.owners?.join(', ') || 'Not specified'; } catch(e) { return 'Not specified'; } })() }}
   
   *Summary:*
   {{ (() => { try { let content = $('OpenAI Remediation Plan').item.json.message?.content || '{}'; if (content.includes('```json')) { content = content.replace(/```json\n?/g, '').replace(/```\n?/g, ''); } const ai = JSON.parse(content); return ai.summary || 'See Jira ticket'; } catch(e) { return 'See Jira ticket'; } })() }}
   
   *Impact:*
   {{ (() => { try { let content = $('OpenAI Remediation Plan').item.json.message?.content || '{}'; if (content.includes('```json')) { content = content.replace(/```json\n?/g, '').replace(/```\n?/g, ''); } const ai = JSON.parse(content); return ai.impact || 'See Jira ticket'; } catch(e) { return 'See Jira ticket'; } })() }}
   
   *Jira Ticket:* {{ $('Create Critical Jira Ticket').item.json?.key || 'Creating...' }}
   
   🤖 *Auto-Fix Status:* Triggered
   
   _SLA: Resolve within {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.sla_hours || 24; } catch(e) { return 24; } })() }} hours_

   运行提示词 · 来源原文。Alert Critical (Manual Fix) 节点的 text 字段

   复制提示词

   =🚨 *CRITICAL SECURITY VULNERABILITY - MANUAL FIX REQUIRED*
   
   *Vulnerability:* {{ $('Webhook Trigger').item.json.body.vulnerability_id }}
   *CVE:* {{ $('Webhook Trigger').item.json.body.cve || 'N/A' }}
   *Severity:* CRITICAL 🔴
   
   *Affected Service:* {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.service_name || 'Unknown'; } catch(e) { return 'Unknown'; } })() }}
   *Owners:* {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.owners?.join(', ') || 'Not specified'; } catch(e) { return 'Not specified'; } })() }}
   
   *Summary:*
   {{ (() => { try { let content = $('OpenAI Remediation Plan').item.json.message?.content || '{}'; if (content.includes('```json')) { content = content.replace(/```json\n?/g, '').replace(/```\n?/g, ''); } const ai = JSON.parse(content); return ai.summary || 'See Jira ticket'; } catch(e) { return 'See Jira ticket'; } })() }}
   
   *Remediation Steps:*
   {{ (() => { try { let content = $('OpenAI Remediation Plan').item.json.message?.content || '{}'; if (content.includes('```json')) { content = content.replace(/```json\n?/g, '').replace(/```\n?/g, ''); } const ai = JSON.parse(content); return ai.remediation_steps?.map((s, i) => (i+1) + '. ' + s).join('\n') || 'See Jira ticket'; } catch(e) { return 'See Jira ticket'; } })() }}
   
   *Jira Ticket:* {{ $('Create Critical Jira Ticket').item.json?.key || 'Creating...' }}
   
   ⚠️ *This vulnerability requires manual remediation*
   
   _SLA: Resolve within {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.sla_hours || 24; } catch(e) { return 24; } })() }} hours_

5. 配置高危漏洞 Slack 通知

   在 High 分支的 Create High Jira Ticket 节点后，配置 Alert High to Slack 节点：channel 从 Port 上下文读取，fallback 为 #security-alerts。text 字段使用下方模板，包含漏洞摘要和 Jira 工单链接。

   运行提示词 · 来源原文。Alert High to Slack 节点的 text 字段

   复制提示词

   =⚠️ *HIGH SEVERITY VULNERABILITY DETECTED*
   
   *Vulnerability:* {{ $('Webhook Trigger').item.json.body.vulnerability_id }}
   *CVE:* {{ $('Webhook Trigger').item.json.body.cve || 'N/A' }}
   *Severity:* HIGH 🟠
   
   *Affected Service:* {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.service_name || 'Unknown'; } catch(e) { return 'Unknown'; } })() }}
   *Owners:* {{ (() => { try { const ctx = $('Get Context From Port').item.json.executionMessage; const parsed = typeof ctx === 'string' ? JSON.parse(ctx) : ctx; return parsed?.owners?.join(', ') || 'Not specified'; } catch(e) { return 'Not specified'; } })() }}
   
   *Summary:*
   {{ (() => { try { let content = $('OpenAI Remediation Plan').item.json.message?.content || '{}'; if (content.includes('```json')) { content = content.replace(/```json\n?/g, '').replace(/```\n?/g, ''); } const ai = JSON.parse(content); return ai.summary || 'See Jira ticket'; } catch(e) { return 'See Jira ticket'; } })() }}
   
   *Jira Ticket:* {{ $('Create High Jira Ticket').item.json?.key || 'Creating...' }}

你正在搭建 n8n 安全漏洞自动修复工作流。先确认已具备：Port 账户及编目数据、n8n 自托管实例、Jira/Slack/OpenAI 凭证。导入模板后按步骤替换 Jira 项目、仓库组织名、Webhook URL，再用样例 payload 测试。