This n8n workflow creates a powerful alert enrichment engine:

1. Alert Ingestion: Captures SIEM alerts via chatbot or Zendesk
2. Vector Search: Queries Qdrant containing MITRE ATT&CK data
3. Threat Analysis: AI identifies relevant TTPs and techniques
4. Response Generation: Creates contextual remediation steps
5. Ticket Enhancement: Updates Zendesk with intelligence and response plans

The workflow leverages OpenAI embeddings to make MITRE ATT&CK data semantically searchable, ensuring accurate technique mapping even with imperfect alert descriptions.