How to Build AI Automation Workflows in n8n

TL;DR

Use a cleaned MITRE ATT&CK vector store to give an AI agent relevant cybersecurity context without placing a nearly 50 MB JSON file into its context window. The episode also shows how n8n pin data can streamline workflow development, compares execution-based billing with per-item operations, and demonstrates an agentic workflow for producing video content at scale.

Transcript

yo yo it's Max the original flow grandma and welcome to the second Studio update as always it's been a busy week in the Automation mindes in this episode I met with Angel to check in on his miter attack assistant and I've also got a walkthrough of a critical but often overlooked feature in NN and Oma from cloud station was gracious enough to show m... Read More

Key Insights

• A MITRE ATT&CK assistant can place an AI layer between cybersecurity engineers and ticketing systems, helping teams begin triage from generated reports instead of manually researching every alert from scratch.
• The MITRE ATT&CK JSON file is nearly 50 MB, so sending the complete dataset directly into an AI model does not fit the attempted context window and requires a retrieval-based design.
• A vector store works as a separate knowledge layer that an AI agent can query for relevant attack types and remediation tactics after the source data has been cleaned and prepared.
• Data preparation is a critical part of vector retrieval because the MITRE ATT&CK file contains extraneous information that should be removed before useful records are stored and exposed to an agent.
• The ticketing integration is decoupled from the MITRE ATT&CK ingestion logic, so Jira could be replaced by another ticketing system without rebuilding the core research and retrieval layer.
• n8n Cloud pricing counts a completed workflow run as one execution, whether that workflow has two steps processing one item or 20 steps processing 5,000 items.
• Make operations are counted when an item passes through a module, according to Max’s explanation, so five modules processing 1,000 items would produce 5,000 operations in his comparison.
• Agentic video production is a recurring automation use case in the community, with Oumnya demonstrating a workflow for scalable content creation and another builder independently sharing a video automation solution.

Questions & Answers

Q: How can an AI agent help cybersecurity teams triage alerts?

An AI agent can sit between the security alerts or tickets and the engineers responsible for reviewing them. By retrieving relevant MITRE ATT&CK attack types and remediation tactics, it can create a preliminary triage report for each ticket. That report gives the cybersecurity team a researched starting point, reducing repetitive manual investigation while leaving the engineers responsible for using the output in their workflow.

Q: Why use a vector store for MITRE ATT&CK data?

The MITRE ATT&CK source discussed in the episode is nearly 50 MB of JSON, which did not fit when it was piped directly into the attempted AI context. A vector store lets the agent retrieve relevant portions instead of receiving the complete file for every request. This design requires cleaning and organizing the source data before connecting the resulting store to the agent.

Q: How should MITRE ATT&CK JSON be prepared for retrieval?

The preparation process begins by identifying and removing extraneous information from the large JSON file. The useful attack and remediation content then needs to be organized into records suitable for storage and retrieval. Angel describes this as more complicated than simply adding JSON to a vector database, because the quality and structure of the ingested material affect what the AI agent can access.

Q: Can the MITRE ATT&CK assistant work without Jira?

Yes, the proposed knowledge and agent logic is not inherently tied to Jira. Jira is presented as one possible source of tickets, but another ticketing system could be substituted because the integration is separate from the work of cleaning, ingesting, and retrieving MITRE ATT&CK data. This separation could make the assistant useful to teams with different operational tooling.

Q: How does n8n execution-based pricing work?

Under the explanation provided, n8n counts a workflow when the entire workflow completes running. A workflow with two steps and one item counts as one execution, and a workflow with 20 steps processing 5,000 items also counts as one execution. The comparison emphasizes that the execution count is based on the completed workflow run rather than every item passing through every step.

Q: How does Make operation billing differ from n8n executions?

Max explains that a Make operation is counted whenever one item of data is processed through one module. In his examples, 100 spreadsheet rows passing through two modules create 200 operations, while 1,000 items passing through five modules create 5,000 operations. The comparable n8n workflow run is described as one execution, so the two billing units should not be compared one to one.

Q: What AI-agent tutorials are planned for n8n?

Max is working on the second part of a tutorial series about building AI agents. The next release is planned to focus on app AI tools. A segment about using n8n workflows as tools inside AI agents was postponed because the sub-workflow functionality is being overhauled. He intends to produce a deeper walkthrough after those changes become available.

Q: How can n8n support automated video content production?

The episode presents automated video production as an agentic workflow use case. Oumnya from Cloud Station demonstrates a system designed to automate the production of engaging video content at scale, and another community builder separately shared a solution for video automation. The provided material establishes the use case and demonstration, but it does not specify the complete node configuration or production steps.

Summary & Key Takeaways

• Angel is developing a MITRE ATT&CK assistant for cybersecurity teams overwhelmed by alerts flowing from security systems into ticketing platforms. His proposed AI layer would retrieve relevant attack and remediation information, then create triage reports that engineers could use as a starting point when reviewing tickets in n8n.

• The MITRE ATT&CK source is nearly 50 MB of JSON, making direct insertion into an AI model’s context impractical. Angel is cleaning away extraneous fields, restructuring the useful material, and building a vector store that an AI agent can query. The resulting knowledge layer could remain separate from any particular ticketing system.

• The update also contrasts n8n executions with Make operations, includes a walkthrough of n8n pin data, and presents Oumnya’s agentic workflow for producing video content at scale. Max is separately preparing an AI-agent tutorial on app AI tools, while postponing a sub-workflow deep dive until the planned overhaul becomes available.