{
  "name": "Mission Control — CISA KEV incident drill",
  "nodes": [
    {
      "id": "start-mission",
      "name": "Start mission",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        300
      ],
      "parameters": {
        "httpMethod": "GET",
        "path": "mission-control",
        "responseMode": "responseNode",
        "options": {}
      },
      "webhookId": "a019e7c2-d2bf-4091-a04e-a962fa019c1e"
    },
    {
      "id": "cisa-exploited-vulnerabilities",
      "name": "CISA exploited vulnerabilities",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        230,
        300
      ],
      "parameters": {
        "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
        "options": {
          "timeout": 30000
        }
      }
    },
    {
      "id": "create-mission",
      "name": "Create mission",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        460,
        300
      ],
      "parameters": {
        "mode": "runOnceForAllItems",
        "jsCode": "const raw=$input.first().json;\nconst rows=Array.isArray(raw.vulnerabilities)?raw.vulnerabilities:Array.isArray(raw)?raw:[];\nconst sorted=rows.filter(x=>x.cveID&&x.vendorProject&&x.product).sort((a,b)=>String(b.dateAdded||'').localeCompare(String(a.dateAdded||''))).slice(0,50);\nif(!sorted.length) throw new Error('CISA KEV catalog has no entries');\nconst chosen=sorted[Math.floor(Math.random()*sorted.length)];\nconst clean=x=>String(x||'').slice(0,500);\nreturn [{json:{source:'CISA Known Exploited Vulnerabilities',fictionalDrill:true,cve:clean(chosen.cveID),vendor:clean(chosen.vendorProject),product:clean(chosen.product),dateAdded:clean(chosen.dateAdded),description:clean(chosen.shortDescription),action:clean(chosen.requiredAction),phases:['detect','contain','recover'],timeLimitSeconds:90}}];"
      }
    },
    {
      "id": "return-mission",
      "name": "Return mission",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1.1,
      "position": [
        690,
        300
      ],
      "parameters": {
        "respondWith": "json",
        "responseBody": "={{ JSON.stringify($json) }}",
        "options": {}
      }
    }
  ],
  "connections": {
    "Start mission": {
      "main": [
        [
          {
            "node": "CISA exploited vulnerabilities",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "CISA exploited vulnerabilities": {
      "main": [
        [
          {
            "node": "Create mission",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Create mission": {
      "main": [
        [
          {
            "node": "Return mission",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {
    "executionOrder": "v1"
  },
  "pinData": {},
  "meta": {
    "source": "https://daniele-michelin.com/mission-control/"
  }
}