Every week, CISA adds newly exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. For security teams, that usually means the same routine all over again: look up the CVE, understand what it does, write a Sigma rule, notify the SOC, and document everything. It's repetitive work, and depending on the vulnerability, it can easily take several hours.

I wanted to see if that entire process could be automated.

The workflow starts with n8n, which checks the CISA KEV catalog every week for new entries. When a new vulnerability appears, it collects the important details like the vendor, affected product, and vulnerability description.

Instead of manually analyzing that information, the workflow sends it to Google Gemini with a specific role: act like an experienced SOC detection engineer and generate a production-ready Sigma rule in YAML format. The goal isn't just to create a rule, but to produce something that's immediately useful to defenders.

Once the rule is ready, the rest of the process takes care of itself. A Slack message is sent to the security team, the week's findings are included in an email report, and everything is logged in a Google Sheet for future reference.

The result is simple. A process that once required 4 to 6 hours of manual work for every new vulnerability now runs automatically with almost no human intervention. That gives analysts more time to focus on investigating threats instead of repeating the same research and documentation process every week.

Full Documentation is on my Github